Adam Moussa 3ba90ddc40 Add monitoring + logging layer (audit Day 2: H-1/H-14/M-13) (#6) ... - H-1: 15 CIS Section 4 metric filters (4.1-4.15) on the CloudTrail log group, each alarming to a new SSE SNS topic seahaven-cis-alarms (email to adam). ALARM-only actions per Sea Haven preference. 4.16 = Security Hub (Day 1). - H-14: VPC flow logs (ALL traffic) on all 5 VPCs → hardened S3 bucket. Delivery bucket policy cross-reviewed; kept the AWS-required s3:x-amz-acl condition + logs:*:* source-ARN (cross-reviewer wrongly flagged these; verified against AWS flow-logs-s3-permissions docs), dropped the unneeded s3:ListBucket. - M-13: SES configuration set seahaven-email-events capturing bounce/complaint/ reject to CloudWatch for reputation visibility. L-4 (log retention) and L-5 (alarm action) applied via CLI, documented in README.		2026-06-02 15:16:24 -04:00
..
account-baseline-stack.ts	Add monitoring + logging layer (audit Day 2: H-1/H-14/M-13) (#6)	2026-06-02 15:16:24 -04:00
backup-offsite-stack.ts	Add AWS Backup with offsite vault (audit C-7) (#3)	2026-05-29 18:06:17 -04:00
backup-stack.ts	Add AWS Backup with offsite vault (audit C-7) (#3)	2026-05-29 18:06:17 -04:00
cis-monitoring.ts	Add monitoring + logging layer (audit Day 2: H-1/H-14/M-13) (#6)	2026-06-02 15:16:24 -04:00
detective-controls.ts	Account detective layer + budget (audit Day 1) (#5)	2026-06-01 17:56:12 -04:00
flow-logs.ts	Add monitoring + logging layer (audit Day 2: H-1/H-14/M-13) (#6)	2026-06-02 15:16:24 -04:00
governance-toggles.ts	Account detective layer + budget (audit Day 1) (#5)	2026-06-01 17:56:12 -04:00
ses-monitoring.ts	Add monitoring + logging layer (audit Day 2: H-1/H-14/M-13) (#6)	2026-06-02 15:16:24 -04:00