☁️ Cloud Architecture — Cloud Security Baseline Demo

• **AWS Account** (or AWS Organizations for multi-account setup)
• **Terraform** >= 1.5.0
• **Python** >= 3.10 (stdlib only -- no pip packages needed)
• **AWS CLI** v2 configured with admin credentials
• **Permissions**: IAM, KMS, VPC, CloudTrail, Config, GuardDuty, SecurityHub admin access
• **`iam_baseline.tf`** -- Password policy, permission boundaries, admin/audit roles, MFA enforcement, IP restrictions, service-linked roles. Maps to CIS Section 1.

# Clone/unzip this product into your infrastructure repo
cp -r terraform/ /path/to/your/infra/security-baseline/

# Review and customize variables
cd /path/to/your/infra/security-baseline/
cp ../examples/compliance_config.yaml ./config.yaml  # optional: review config

# Initialize and plan
terraform init
terraform plan -var="environment=production" \
               -var="organization_name=acme-corp" \
               -var="alert_email=security-team@example.com"

# Review the plan carefully, then apply
terraform apply -var="environment=production" \
                -var="organization_name=acme-corp" \
                -var="alert_email=security-team@example.com"


# SecurityHub with CIS conformance pack
aws cloudformation deploy \
  --template-file cloudformation/security-hub-baseline.yaml \
  --stack-name security-hub-baseline \
  --parameter-overrides \
    AlertEmail=security-team@example.com \
    EnableCISBenchmark=true \
  --capabilities CAPABILITY_IAM

# GuardDuty (organization-wide)
aws cloudformation deploy \
  --template-file cloudformation/guardduty-org-setup.yaml \
  --stack-name guardduty-org-setup \
  --parameter-overrides \
    FindingPublishingFrequency=FIFTEEN_MINUTES \
    EnableS3Protection=true \
  --capabilities CAPABILITY_IAM

# Clone/unzip this product into your infrastructure repo
cp -r terraform/ /path/to/your/infra/security-baseline/

# Review and customize variables
cd /path/to/your/infra/security-baseline/
cp ../examples/compliance_config.yaml ./config.yaml  # optional: review config

# Initialize and plan
terraform init
terraform plan -var="environment=production" \
               -var="organization_name=acme-corp" \
               -var="alert_email=security-team@example.com"

# Review the plan carefully, then apply
terraform apply -var="environment=production" \
                -var="organization_name=acme-corp" \
                -var="alert_email=security-team@example.com"