10555af9e2
Stripped fork of seahaven-account-baseline for the isolated external-dev account (396287094661). Single stack: AWS Config, GuardDuty, Security Hub (FSBP + CIS v3.0), IAM Access Analyzer, VPC flow logs (VPC ids via context), and a $200/mo budget alerting adam@seahaven.com. Drops all org-level / prod-specific controls (local CloudTrail, CIS metric alarms, WAF, SES, Bedrock, DynamoDB CMK, Backup) per the isolated-account design; the org trail already covers this account centrally. Inspector2 is a documented post-deploy CLI step (no CloudFormation enable resource exists).
2.8 KiB
seahaven-external-dev-baseline
Account-local security baseline (CDK, TypeScript) for seahaven-external-dev
(account 396287094661, us-east-1), the isolated AWS account used by the
external web-app dev team. A stripped fork of
seahaven-account-baseline.
The external team works only in this account; they have no access to the
management/production account 328440206208. This stack ensures the isolated
account is not a monitoring blind spot.
Architecture
Single stack seahaven-external-dev-baseline:
| Control | Resource | Notes |
|---|---|---|
| AWS Config | recorder + delivery channel + seahaven-extdev-config-<acct> bucket |
Records all supported resource types; foundation for Security Hub CIS |
| GuardDuty | detector (15-min findings) | Account-local threat detection |
| Security Hub | FSBP v1.0.0 + CIS AWS Foundations v3.0.0 | CIS evaluated against Config — no local trail required |
| IAM Access Analyzer | account-scoped external-access analyzer | |
| VPC flow logs | seahaven-extdev-vpc-flow-logs-<acct> bucket |
ALL traffic; VPC ids passed via context |
| Budget | seahaven-extdev-monthly-cost, $200/mo |
80%/100% actual + 100% forecast → adam@seahaven.com (Sea Haven ops) |
Deliberately excluded
- No local CloudTrail. The management-account organization trail
seahaven-org-trailalready captures this account's management + data events centrally. A second local trail would duplicate that at extra cost. - No CIS Section-4 metric-filter alarms. Those bind to a local CloudTrail CloudWatch Logs group, which does not exist here. The Security Hub CIS standard evaluates the same controls against AWS Config instead.
- No WAF, SES monitoring, Bedrock logging, DynamoDB CMK, or AWS Backup — all production-only concerns in the source baseline.
Configuration
| Input | Where | Value |
|---|---|---|
| Target account | bin/app.ts |
396287094661 |
| Region | bin/app.ts |
us-east-1 (account is SCP region-locked) |
| Budget | bin/app.ts |
$200/mo → adam@seahaven.com |
| Flow-log VPC ids | cdk context flowLogVpcIds |
comma-separated; empty by default |
# Deploy attaching flow logs to specific VPCs:
npm ci
npx cdk deploy -c flowLogVpcIds=vpc-aaaa,vpc-bbbb
Post-deploy runbook
Enable Inspector2 (no CloudFormation enable resource exists):
aws inspector2 enable --resource-types EC2 ECR LAMBDA --account-ids 396287094661
This is a one-time per-account toggle; it persists across stack deploys.
Deployment
CI/CD via the org reusable workflows (ci-typescript-cdk.yaml, cd-cdk.yaml,
node 24). Push to main deploys via GitHub OIDC into 396287094661 using the
githubdeploy-seahaven-external-dev-baseline role (repo secret
AWS_DEPLOY_ROLE_ARN).