mirror of
https://github.com/Sea-Haven-Industries/seahaven-account-baseline.git
synced 2026-08-04 16:56:14 +00:00
dc079edb93
Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside. IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS grant, now added (SourceArn + encryption-context scoped).
20 lines
350 B
YAML
20 lines
350 B
YAML
name: Deploy
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: deploy
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy:
|
|
uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@main
|
|
with:
|
|
node-version: "24"
|
|
secrets:
|
|
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
|