seahaven-account-baseline/.github/workflows/ci.yaml at 6a63a4f9b0d02c9db7dae87d787397e74fede2f6 - adam/seahaven-account-baseline - Sea Haven Git

adam/seahaven-account-baseline

mirror of https://github.com/Sea-Haven-Industries/seahaven-account-baseline.git synced 2026-08-04 16:56:14 +00:00

Adam Moussa dc079edb93 Initial account-baseline stack with CloudTrail (audit C-1)

Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an
Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of
the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside.

IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS
grant, now added (SourceArn + encryption-context scoped).

2026-05-29 17:44:55 -04:00

10 lines

183 B

YAML

Raw Blame History

 name: CI
 on:
   pull_request:
     branches: [main]
 jobs:
   ci:
     uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
     with:
       node-version: "24"