mirror of
https://github.com/Sea-Haven-Industries/seahaven-account-baseline.git
synced 2026-08-04 16:56:14 +00:00
Adam Moussa
5d2a3a46bb
INFRA-91: codify the Bedrock model-invocation logging applied out-of-band in us-west-2 and us-east-2 (per-region delivery role seahaven-bedrock-invocation-logging-<region> + log group /aws/bedrock/model-invocations 90d, CloudWatch-only). The account-level logging config itself has no CFN resource type and is applied via CLI (already live), same as us-east-1. INFRA-16: add the still-missing us-east-2 detective controls — AWS Config recorder role + delivery bucket (recorder/channel via CLI to avoid the CFN stabilization deadlock seen in us-east-1) and Security Hub with FSBP + CIS v3.0. GuardDuty + flow logs already live in us-east-2 and are left for a follow-up adoption to keep this change non-destructive. The us-east-1 baseline stays region-pinned; these are separate RegionalBaselineStack instances composed opt-in per region. CHECKPOINT: new multi-region stacks. The live Bedrock role + log group already exist (CLI-created), so a plain deploy would collide — these need cdk import / changeset adoption, not cdk deploy. Code + diff captured for review, NOT deployed. Refs: INFRA-91, INFRA-16
56 lines
2.3 KiB
JavaScript
56 lines
2.3 KiB
JavaScript
#!/usr/bin/env node
|
|
import "source-map-support/register";
|
|
import * as cdk from "aws-cdk-lib";
|
|
import { AccountBaselineStack } from "../lib/account-baseline-stack";
|
|
import { BackupOffsiteStack } from "../lib/backup-offsite-stack";
|
|
import { BackupStack } from "../lib/backup-stack";
|
|
import { RegionalBaselineStack } from "../lib/regional-baseline-stack";
|
|
|
|
const ACCOUNT = "328440206208";
|
|
|
|
const app = new cdk.App();
|
|
|
|
new AccountBaselineStack(app, "account-baseline", {
|
|
stackName: "seahaven-account-baseline",
|
|
env: { account: ACCOUNT, region: "us-east-1" },
|
|
monthlyBudgetUsd: 1200,
|
|
budgetAlertEmail: "adam@seahavenind.com",
|
|
});
|
|
|
|
// ── Secondary-region baselines (INFRA-16, INFRA-91) ──────────────────────────
|
|
// The us-east-1 baseline above is region-pinned by design. These stacks extend
|
|
// a minimal detective/logging footprint into the secondary regions, codifying
|
|
// state applied out-of-band this week so it lives in IaC.
|
|
|
|
// us-west-2: Bedrock invocation logging only (INFRA-91). Shares the region with
|
|
// the offsite backup vault but is an independent concern (separate stack).
|
|
new RegionalBaselineStack(app, "regional-baseline-us-west-2", {
|
|
stackName: "seahaven-regional-baseline-us-west-2",
|
|
env: { account: ACCOUNT, region: "us-west-2" },
|
|
bedrockLogging: true,
|
|
});
|
|
|
|
// us-east-2: Bedrock invocation logging (INFRA-91) + the still-missing AWS
|
|
// Config recorder and Security Hub (INFRA-16). GuardDuty + flow logs already
|
|
// live here (adopted as a follow-up, see lib/regional-baseline-stack.ts).
|
|
new RegionalBaselineStack(app, "regional-baseline-us-east-2", {
|
|
stackName: "seahaven-regional-baseline-us-east-2",
|
|
env: { account: ACCOUNT, region: "us-east-2" },
|
|
bedrockLogging: true,
|
|
configRecorder: true,
|
|
securityHub: true,
|
|
});
|
|
|
|
// AWS Backup (audit C-7). Offsite vault (us-west-2) must exist before the
|
|
// primary plan that copies to it, hence the explicit dependency.
|
|
const backupOffsite = new BackupOffsiteStack(app, "backup-offsite", {
|
|
stackName: "seahaven-backup-offsite",
|
|
env: { account: "328440206208", region: "us-west-2" },
|
|
});
|
|
|
|
const backupPrimary = new BackupStack(app, "backup", {
|
|
stackName: "seahaven-backup",
|
|
env: { account: "328440206208", region: "us-east-1" },
|
|
});
|
|
|
|
backupPrimary.addDependency(backupOffsite);
|