Security & Compliance
CIS-hardened configs, GuardDuty, Security Hub, WAF rules, IAM least-privilege, and compliance baselines.
Available Assets
Zero Trust SSH with Short-Lived Certificates
SSH to servers without exposing port 22. Cloudflare Tunnel + Zero Trust Access with ephemeral certificates, no long-lived keys.
AWS Account Security Bootstrap
CloudFormation template that enables GuardDuty, Security Hub, CloudTrail across all regions, AWS Config, and removes default VPCs. One-click security baseline.
CIS Level 1 EC2 Hardening Script
Bash script applying CIS Amazon Linux 2023 Level 1 benchmark. Every change documented with the corresponding CIS control reference. Safe to run on existing instances.
SOC2 Baseline CloudFormation Stack
Enables every AWS service auditors look for: Config rules, CloudTrail, VPC flow logs, Access Analyzer, and Security Hub with CIS standard enabled.
IAM Password Policy and MFA Enforcer
CloudFormation that sets a strong account password policy plus an SCP that denies all API calls from IAM users without MFA enabled.
S3 Security Guardrails Stack
AWS Config rules plus Lambda auto-remediation that automatically blocks any S3 bucket that becomes public. Includes SNS alert on remediation.
Secrets Manager Rotation Template
CloudFormation for automated RDS credential rotation. Includes the Lambda rotator function, IAM roles, and rotation schedule. Works for MySQL and Postgres.
VPC Flow Logs and Athena Query Pack
Enables VPC flow logs to S3 and creates an Athena table for querying them. Includes 10 security queries: port scanners, unusual protocols, rejected traffic analysis.
CloudTrail Security Alerting Stack
CloudWatch metric filters and alarms on CloudTrail for root login, console login without MFA, IAM policy changes, and security group modifications. SNS notifications included.
Cloudflare WAF Baseline Ruleset
Terraform config applying OWASP Core Rule Set, bot management, rate limiting, and custom rules for SQLi, XSS, and path traversal. Ready to apply to any zone.
AWS Access Analyzer Weekly Digest
Deploys Access Analyzer with an EventBridge rule triggering a Lambda that emails a formatted weekly digest of all external access findings.