adam/seahaven-account-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-account-baseline.git synced 2026-08-04 16:56:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
52 commits 2 branches 0 tags 1.5 MiB
Commit graph

3 commits

Author SHA1 Message Date
Adam Moussa
bfdec9b18f
ci: add least-privilege permissions blocks to workflow callers 
Resolves code scanning alerts #3 and #4 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match."
 2026-07-23 13:32:48 -04:00
Adam Moussa
6ce8b96b22
chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) (#35)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details
2026-07-06 18:27:41 -04:00
Adam Moussa
dc079edb93 Initial account-baseline stack with CloudTrail (audit C-1) 
Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an
Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of
the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside.

IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS
grant, now added (SourceArn + encryption-context scoped).
 2026-05-29 17:44:55 -04:00