AWS Account Security Bootstrap

AWS Account Security Bootstrap

Spin up a complete security baseline for your AWS account in a single CloudFormation deploy. No manual console clicks, no missed regions — everything is enabled consistently and documented as code.

What Gets Enabled

• Amazon GuardDuty — threat detection enabled in every region with a multi-region StackSet
• AWS Security Hub — central findings aggregator with CIS AWS Foundations and AWS Foundational Security Best Practices standards activated
• AWS CloudTrail — organization-wide trail writing to an S3 bucket with log file validation and SSE-KMS encryption
• AWS Config — configuration recorder and delivery channel across all regions, storing history to S3
• Default VPC Removal — a Lambda-backed custom resource that removes the default VPC in every region so workloads are never accidentally deployed into insecure defaults

Developer Experience

The package includes a single security-baseline.yaml CloudFormation template, a deploy.sh helper that handles the StackSet prerequisites, and a README.md walking through each parameter. Designed to be deployed once to a management account and propagated to member accounts via AWS Organizations.

What You Get

• security-baseline.yaml — main CloudFormation template
• stackset-deploy.sh — automates StackSet creation and instance deployment
• .env.example — org-id, log bucket name, KMS key ARN
• README.md — deployment walkthrough and architecture diagram

Requirements

AWS Organizations with all-features enabled. Deployment must be run from the management (payer) account. Terraform users: a companion main.tf wrapping the same resources is included.