mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-09-30 08:03:19 +00:00
3ab3bc773a
* Parameterize baseline constructs for multi-account reuse DetectiveControls, FlowLogs, and GovernanceToggles were forked into seahaven-external-dev-baseline with only physical-name and VPC-sourcing differences. Prefix/name props let one implementation serve both accounts; synthesized templates are unchanged (verified: empty cdk diff against all deployed stacks). * Absorb external-dev member baseline stack Moves seahaven-external-dev-baseline's stack in as MemberBaselineStack, construct ids and physical names byte-identical to the deployed stack (logical IDs are path-derived; empty cdk diff verified via change set against 396287094661). Retires the forked repo so member-account baselines share one drift surface and one dependency pin. * Rename package to seahaven-org-baseline Prepares the repo rename: the app now spans the management account and org member accounts, so 'account-baseline' undersells the scope. README documents the two-account deploy topology and logical-ID constraints. * Commit extdev flow-log VPC ids in code, not -c context Security review SH-ORG-004 (confirmed high): with the ids sourced from ephemeral cdk context, any context-less deploy silently removes every flow log in the isolated account. A committed list makes the attachment set reviewable and immune to a forgotten -c flag. Empty list matches the deployed stack (zero diff). * Split CD into per-account deploy jobs The app now spans two AWS accounts; cdk deploy --all under one role fails on the other account's stacks (security review IAC-01). Each job passes explicit stack selectors and its own account's OIDC role via the new cd-cdk stacks input.
64 lines
2.6 KiB
TypeScript
64 lines
2.6 KiB
TypeScript
import * as cdk from "aws-cdk-lib";
|
|
import { Construct } from "constructs";
|
|
import { DetectiveControls } from "./detective-controls";
|
|
import { FlowLogs } from "./flow-logs";
|
|
import { GovernanceToggles } from "./governance-toggles";
|
|
|
|
export interface MemberBaselineStackProps extends cdk.StackProps {
|
|
/**
|
|
* Physical-name prefix for account-scoped resources (e.g. "seahaven-extdev").
|
|
* Also names the monthly budget (`<namePrefix>-monthly-cost`). Stable per
|
|
* account — changing it on a deployed stack replaces live resources.
|
|
*/
|
|
readonly namePrefix: string;
|
|
/** Monthly cost budget ceiling in USD. */
|
|
readonly monthlyBudgetUsd: number;
|
|
/** Sea Haven ops address that receives budget alerts (not the account's tenants). */
|
|
readonly budgetAlertEmail: string;
|
|
/** VPC ids to attach flow logs to (from cdk context; may be empty). */
|
|
readonly flowLogVpcIds: string[];
|
|
/** Value for the ManagedBy tag on every resource in the stack. */
|
|
readonly managedByTag: string;
|
|
}
|
|
|
|
/**
|
|
* Account-local security baseline for org MEMBER accounts (first tenant:
|
|
* seahaven-external-dev). Absorbed from the retired seahaven-external-dev-baseline
|
|
* repo — a stripped fork of the management-account baseline, now sharing its
|
|
* constructs (prefix-parameterized) instead of forking them.
|
|
*
|
|
* Deliberately excludes everything that is org-level or prod-specific:
|
|
* - No local CloudTrail — the management-account org trail (seahaven-org-trail)
|
|
* already captures every member account's events centrally.
|
|
* - No CIS Section-4 metric-filter alarms — the Security Hub CIS standard
|
|
* evaluates those controls against Config without a local trail log group.
|
|
* - No WAF, SES monitoring, Bedrock logging, DynamoDB CMK, or AWS Backup —
|
|
* all prod-only concerns.
|
|
*
|
|
* Contains: AWS Config, GuardDuty, Security Hub (FSBP + CIS v3.0), IAM Access
|
|
* Analyzer, Inspector2 (post-deploy CLI, see README), VPC flow logs, and a
|
|
* monthly cost Budget.
|
|
*/
|
|
export class MemberBaselineStack extends cdk.Stack {
|
|
constructor(scope: Construct, id: string, props: MemberBaselineStackProps) {
|
|
super(scope, id, props);
|
|
|
|
new DetectiveControls(this, "DetectiveControls", {
|
|
namePrefix: props.namePrefix,
|
|
});
|
|
|
|
new FlowLogs(this, "FlowLogs", {
|
|
namePrefix: props.namePrefix,
|
|
vpcIds: props.flowLogVpcIds,
|
|
});
|
|
|
|
new GovernanceToggles(this, "GovernanceToggles", {
|
|
budgetName: `${props.namePrefix}-monthly-cost`,
|
|
monthlyLimitUsd: props.monthlyBudgetUsd,
|
|
alertEmail: props.budgetAlertEmail,
|
|
});
|
|
|
|
cdk.Tags.of(this).add("Owner", props.budgetAlertEmail);
|
|
cdk.Tags.of(this).add("ManagedBy", props.managedByTag);
|
|
}
|
|
}
|