adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-02 17:53:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
seahaven-org-baseline/package.json

27 lines
534 B
JSON
Raw Normal View History

Initial account-baseline stack with CloudTrail (audit C-1) Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside. IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS grant, now added (SourceArn + encryption-context scoped).
2026-05-29 17:44:55 -04:00
{
Merge external-dev member baseline; rename to seahaven-org-baseline (#43) * Parameterize baseline constructs for multi-account reuse DetectiveControls, FlowLogs, and GovernanceToggles were forked into seahaven-external-dev-baseline with only physical-name and VPC-sourcing differences. Prefix/name props let one implementation serve both accounts; synthesized templates are unchanged (verified: empty cdk diff against all deployed stacks). * Absorb external-dev member baseline stack Moves seahaven-external-dev-baseline's stack in as MemberBaselineStack, construct ids and physical names byte-identical to the deployed stack (logical IDs are path-derived; empty cdk diff verified via change set against 396287094661). Retires the forked repo so member-account baselines share one drift surface and one dependency pin. * Rename package to seahaven-org-baseline Prepares the repo rename: the app now spans the management account and org member accounts, so 'account-baseline' undersells the scope. README documents the two-account deploy topology and logical-ID constraints. * Commit extdev flow-log VPC ids in code, not -c context Security review SH-ORG-004 (confirmed high): with the ids sourced from ephemeral cdk context, any context-less deploy silently removes every flow log in the isolated account. A committed list makes the attachment set reviewable and immune to a forgotten -c flag. Empty list matches the deployed stack (zero diff). * Split CD into per-account deploy jobs The app now spans two AWS accounts; cdk deploy --all under one role fails on the other account's stacks (security review IAC-01). Each job passes explicit stack selectors and its own account's OIDC role via the new cd-cdk stacks input.
2026-07-14 13:53:07 -04:00
"name": "seahaven-org-baseline",
Initial account-baseline stack with CloudTrail (audit C-1) Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside. IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS grant, now added (SourceArn + encryption-context scoped).
2026-05-29 17:44:55 -04:00
"version": "1.0.0",
"bin": {
"app": "bin/app.js"
},
"scripts": {
"build": "tsc",
"cdk": "cdk",
"synth": "cdk synth",
"deploy": "cdk deploy",
"diff": "cdk diff"
},
"devDependencies": {
build(deps-dev): bump the minor-and-patch group with 2 updates (#40) Bumps the minor-and-patch group with 2 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk). Updates `@types/node` from 24.13.2 to 24.13.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `aws-cdk` from 2.1129.0 to 2.1130.0 - [Release notes](https://github.com/aws/aws-cdk-cli/releases) - [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1130.0/packages/aws-cdk) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 24.13.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: aws-cdk dependency-version: 2.1130.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
2026-07-10 20:23:49 +00:00
"@types/node": "^24.13.3",
Initial account-baseline stack with CloudTrail (audit C-1) Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside. IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS grant, now added (SourceArn + encryption-context scoped).
2026-05-29 17:44:55 -04:00
"@types/source-map-support": "^0.5.10",
build(deps-dev): bump the minor-and-patch group with 2 updates (#40) Bumps the minor-and-patch group with 2 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk). Updates `@types/node` from 24.13.2 to 24.13.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `aws-cdk` from 2.1129.0 to 2.1130.0 - [Release notes](https://github.com/aws/aws-cdk-cli/releases) - [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1130.0/packages/aws-cdk) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 24.13.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: aws-cdk dependency-version: 2.1130.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
2026-07-10 20:23:49 +00:00
"aws-cdk": "^2.1130.0",
Initial account-baseline stack with CloudTrail (audit C-1) Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside. IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS grant, now added (SourceArn + encryption-context scoped).
2026-05-29 17:44:55 -04:00
"source-map-support": "^0.5.21",
build(deps): migrate CDK app ts-node->tsx, adopt typescript 7 (INFRA-183) (#39) ts-node 10.x is incompatible with the TypeScript 7 compiler API (cdk synth fails with "Cannot read properties of undefined (reading 'fileExists')"). Switch the cdk.json app runner to tsx (pinned 4.23.0, matching sh-mcp) and bump typescript to ~7.0.2. Synthesized templates are byte-identical across all six stacks; toolchain-only change.
2026-07-08 17:48:30 -04:00
"tsx": "4.23.0",
"typescript": "~7.0.2"
Initial account-baseline stack with CloudTrail (audit C-1) Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside. IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS grant, now added (SourceArn + encryption-context scoped).
2026-05-29 17:44:55 -04:00
},
"dependencies": {
Bump the minor-and-patch group with 2 updates (#33)
2026-07-04 01:15:09 -04:00
"aws-cdk-lib": "2.261.0",
Initial account-baseline stack with CloudTrail (audit C-1) Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside. IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS grant, now added (SourceArn + encryption-context scoped).
2026-05-29 17:44:55 -04:00
"constructs": "^10.0.0"
}
}
Reference in a new issue Copy permalink