seahaven-account-baseline/lib/account-baseline-stack.ts

import * as cdk from "aws-cdk-lib";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as kms from "aws-cdk-lib/aws-kms";
import * as iam from "aws-cdk-lib/aws-iam";
import * as logs from "aws-cdk-lib/aws-logs";
import * as cloudtrail from "aws-cdk-lib/aws-cloudtrail";
import { Construct } from "constructs";

/**
 * Account-level security baseline for Sea Haven (account 328440206208).
 *
 * First resident: a multi-region CloudTrail with log-file validation, KMS
 * encryption, an Object-Lock'd S3 log bucket, and CloudWatch Logs delivery.
 * Closes audit finding C-1 and CIS 3.1/3.2/3.4/3.6/3.7 (+3.8 via key rotation),
 * and provides the CloudWatch Logs group that the CIS Section 4 metric filters
 * (H-1) attach to.
 *
 * Future residents (same stack): AWS Config (H-2), GuardDuty (H-3),
 * Security Hub (H-4), IAM Access Analyzer (M-5), Inspector2 (M-6).
 */
export class AccountBaselineStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const trailName = "seahaven-org-trail";
    // Static trail ARN (built from name, not trail.trailArn) so the key policy
    // does not create a circular dependency with the Trail resource.
    const trailArn = cdk.Arn.format(
      { service: "cloudtrail", resource: "trail", resourceName: trailName },
      this
    );

    // ── KMS CMK ── encrypts CloudTrail log files (CIS 3.7); rotation = CIS 3.8.
    const trailKey = new kms.Key(this, "TrailKey", {
      alias: "cloudtrail-logs",
      description: "Encrypts CloudTrail log files for the account-wide trail",
      enableKeyRotation: true,
      removalPolicy: cdk.RemovalPolicy.RETAIN,
    });

    // The L2 Trail construct does NOT grant the CloudTrail service principal use
    // of a customer-provided key, so delivery of encrypted logs would fail.
    // Grant it explicitly, scoped to this account's trail via SourceArn and the
    // CloudTrail encryption context. (Caught by cross-review 2026-05-29.)
    trailKey.addToResourcePolicy(
      new iam.PolicyStatement({
        sid: "AllowCloudTrailEncrypt",
        effect: iam.Effect.ALLOW,
        principals: [new iam.ServicePrincipal("cloudtrail.amazonaws.com")],
        actions: ["kms:GenerateDataKey*"],
        resources: ["*"],
        conditions: {
          StringEquals: { "aws:SourceArn": trailArn },
          StringLike: {
            "kms:EncryptionContext:aws:cloudtrail:arn": `arn:${this.partition}:cloudtrail:*:${this.account}:trail/*`,
          },
        },
      })
    );
    trailKey.addToResourcePolicy(
      new iam.PolicyStatement({
        sid: "AllowCloudTrailDescribeKey",
        effect: iam.Effect.ALLOW,
        principals: [new iam.ServicePrincipal("cloudtrail.amazonaws.com")],
        actions: ["kms:DescribeKey"],
        resources: ["*"],
      })
    );

    // Central, pre-existing access-logs bucket (manually created, imported
    // read-only) — receives S3 server access logs for the trail bucket (CIS 3.6).
    const accessLogsBucket = s3.Bucket.fromBucketName(
      this,
      "AccessLogsBucket",
      "seahaven-s3-access-logs"
    );

    // ── Hardened, tamper-resistant log bucket ──
    // Private (BPA all on), KMS-encrypted, versioned, TLS-only, Object-Lock
    // GOVERNANCE 365d so logs cannot be silently deleted/overwritten.
    const logBucket = new s3.Bucket(this, "TrailLogBucket", {
      bucketName: `seahaven-cloudtrail-logs-${this.account}`,
      encryption: s3.BucketEncryption.KMS,
      encryptionKey: trailKey,
      bucketKeyEnabled: true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      enforceSSL: true,
      versioned: true,
      objectLockEnabled: true,
      objectLockDefaultRetention: s3.ObjectLockRetention.governance(
        cdk.Duration.days(365)
      ),
      serverAccessLogsBucket: accessLogsBucket,
      serverAccessLogsPrefix: "cloudtrail-bucket-access/",
      lifecycleRules: [
        {
          id: "transition-and-expire",
          transitions: [
            {
              storageClass: s3.StorageClass.GLACIER,
              transitionAfter: cdk.Duration.days(90),
            },
          ],
          expiration: cdk.Duration.days(365),
          abortIncompleteMultipartUploadAfter: cdk.Duration.days(7),
        },
      ],
      removalPolicy: cdk.RemovalPolicy.RETAIN,
    });

    // ── Multi-region trail ──
    // Management events (read + write), log-file validation, global service
    // events, delivered to the KMS-encrypted bucket and to CloudWatch Logs.
    // Data events (CIS 3.10/3.11) intentionally deferred — management events
    // only for now to control cost (see README).
    const trail = new cloudtrail.Trail(this, "Trail", {
      trailName,
      bucket: logBucket,
      encryptionKey: trailKey,
      isMultiRegionTrail: true,
      includeGlobalServiceEvents: true,
      enableFileValidation: true,
      sendToCloudWatchLogs: true,
      cloudWatchLogsRetention: logs.RetentionDays.ONE_YEAR,
      managementEvents: cloudtrail.ReadWriteType.ALL,
    });

    cdk.Tags.of(this).add("Project", "account-baseline");
    cdk.Tags.of(this).add("Owner", "adam@seahavenind.com");
    cdk.Tags.of(this).add("Environment", "prod");
    cdk.Tags.of(this).add("ManagedBy", "cdk");

    new cdk.CfnOutput(this, "TrailArn", { value: trail.trailArn });
    new cdk.CfnOutput(this, "LogBucketName", { value: logBucket.bucketName });
    new cdk.CfnOutput(this, "TrailKmsKeyArn", { value: trailKey.keyArn });
  }
}