seahaven-org-baseline/bin/app.ts

#!/usr/bin/env node
import "source-map-support/register";
import * as cdk from "aws-cdk-lib";
import { AccountBaselineStack } from "../lib/account-baseline-stack";
import { BackupOffsiteStack } from "../lib/backup-offsite-stack";
import { BackupStack } from "../lib/backup-stack";
import { RegionalBaselineStack } from "../lib/regional-baseline-stack";
import { DynamoDbCmkStack } from "../lib/dynamodb-cmk-stack";

const ACCOUNT = "328440206208";

const app = new cdk.App();

new AccountBaselineStack(app, "account-baseline", {
  stackName: "seahaven-account-baseline",
  env: { account: ACCOUNT, region: "us-east-1" },
  monthlyBudgetUsd: 1200,
  budgetAlertEmail: "adam@seahavenind.com",
});

// ── Shared DynamoDB CMK (INFRA-95 / M-3) ─────────────────────────────────────
// Dedicated, standalone stack so the customer-managed key for sensitive
// finance/PII DynamoDB tables is an independent shared dependency for the owning
// app repos (payments-dashboard, procurement-ingest, exec-aide). Its ARN is
// published to SSM (/seahaven/dynamodb/cmk-arn) for those stacks to consume.
new DynamoDbCmkStack(app, "dynamodb-cmk", {
  stackName: "seahaven-dynamodb-cmk",
  env: { account: ACCOUNT, region: "us-east-1" },
});

// ── Secondary-region baselines (INFRA-16, INFRA-91) ──────────────────────────
// The us-east-1 baseline above is region-pinned by design. These stacks extend
// a minimal detective/logging footprint into the secondary regions, codifying
// state applied out-of-band this week so it lives in IaC.

// us-west-2: Bedrock invocation logging only (INFRA-91). Shares the region with
// the offsite backup vault but is an independent concern (separate stack).
new RegionalBaselineStack(app, "regional-baseline-us-west-2", {
  stackName: "seahaven-regional-baseline-us-west-2",
  env: { account: ACCOUNT, region: "us-west-2" },
  bedrockLogging: true,
});

// us-east-2: Bedrock invocation logging (INFRA-91) + the still-missing AWS
// Config recorder and Security Hub (INFRA-16). GuardDuty + flow logs already
// live here (adopted as a follow-up, see lib/regional-baseline-stack.ts).
new RegionalBaselineStack(app, "regional-baseline-us-east-2", {
  stackName: "seahaven-regional-baseline-us-east-2",
  env: { account: ACCOUNT, region: "us-east-2" },
  bedrockLogging: true,
  configRecorder: true,
  securityHub: true,
});

// AWS Backup (audit C-7). Offsite vault (us-west-2) must exist before the
// primary plan that copies to it, hence the explicit dependency.
const backupOffsite = new BackupOffsiteStack(app, "backup-offsite", {
  stackName: "seahaven-backup-offsite",
  env: { account: "328440206208", region: "us-west-2" },
});

const backupPrimary = new BackupStack(app, "backup", {
  stackName: "seahaven-backup",
  env: { account: "328440206208", region: "us-east-1" },
});

backupPrimary.addDependency(backupOffsite);