mirror of
https://github.com/Sea-Haven-Industries/seahaven-account-baseline.git
synced 2026-08-04 16:56:14 +00:00
993702f421
Some checks failed
Deploy / deploy (push) Has been cancelled
Audit L-14, plus a latent Day-2 bug: seahaven-cis-alarms was encrypted with the AWS-managed alias/aws/sns key, whose policy cannot grant cloudwatch.amazonaws.com - CloudWatch alarms silently fail to publish to topics it encrypts. All 15 CIS alarms would have fired into the void. New customer-managed key (rotation on) grants CloudWatch GenerateDataKey*/Decrypt/DescribeKey scoped by SourceAccount. The unmanaged site-alerts topic now uses the same key (set via CLI). Cross-reviewed: no BLOCKs. Verified: forced ALARM on the payroll DLQ alarm published successfully through the encrypted site-alerts. |
||
|---|---|---|
| .. | ||
| account-baseline-stack.ts | ||
| backup-offsite-stack.ts | ||
| backup-stack.ts | ||
| bedrock-logging.ts | ||
| cis-monitoring.ts | ||
| detective-controls.ts | ||
| flow-logs.ts | ||
| governance-toggles.ts | ||
| ses-monitoring.ts | ||
| web-acl.ts | ||