What's Included

This chapter covers the core features and capabilities of Cloud Security Baseline.

What's Included

CIS Benchmark Coverage

This baseline implements 42 of the 58 CIS AWS Foundations Benchmark v3.0 controls out of the box:

Section 1 - Identity and Access Management:  14/16 controls  ████████████████████░░  87%
Section 2 - Storage:                          6/6  controls  ██████████████████████  100%
Section 3 - Logging:                          8/8  controls  ██████████████████████  100%
Section 4 - Monitoring:                       8/12 controls  ██████████████████░░░░  67%
Section 5 - Networking:                       6/6  controls  ██████████████████████  100%
                                             ─────
                                             42/48 automated  (87% coverage)

The remaining controls require manual/organizational processes (MFA hardware tokens, root account procedures, etc.) and are documented in docs/cis_benchmark_guide.md.

Prerequisites

• AWS Account (or AWS Organizations for multi-account setup)
• Terraform >= 1.5.0
• Python >= 3.10 (stdlib only -- no pip packages needed)
• AWS CLI v2 configured with admin credentials
• Permissions: IAM, KMS, VPC, CloudTrail, Config, GuardDuty, SecurityHub admin access

Quick Start

Follow this guide to get Cloud Security Baseline up and running in your environment.

Quick Start

1. Deploy the Security Baseline (Terraform)

# Clone/unzip this product into your infrastructure repo
cp -r terraform/ /path/to/your/infra/security-baseline/

# Review and customize variables
cd /path/to/your/infra/security-baseline/
cp ../examples/compliance_config.yaml ./config.yaml  # optional: review config

# Initialize and plan
terraform init
terraform plan -var="environment=production" \
               -var="organization_name=acme-corp" \
               -var="alert_email=security-team@example.com"

# Review the plan carefully, then apply
terraform apply -var="environment=production" \
                -var="organization_name=acme-corp" \
                -var="alert_email=security-team@example.com"

2. Deploy SecurityHub + GuardDuty (CloudFormation)

# SecurityHub with CIS conformance pack
aws cloudformation deploy \
  --template-file cloudformation/security-hub-baseline.yaml \
  --stack-name security-hub-baseline \
  --parameter-overrides \
    AlertEmail=security-team@example.com \
    EnableCISBenchmark=true \
  --capabilities CAPABILITY_IAM

# GuardDuty (organization-wide)
aws cloudformation deploy \
  --template-file cloudformation/guardduty-org-setup.yaml \
  --stack-name guardduty-org-setup \
  --parameter-overrides \
    FindingPublishingFrequency=FIFTEEN_MINUTES \
    EnableS3Protection=true \
  --capabilities CAPABILITY_IAM

3. Run Your First Compliance Check

# Full CIS benchmark compliance check
python scripts/compliance_checker.py --profile production --format report

# IAM-specific deep audit
python scripts/iam_audit.py --profile production --output iam-audit-report.json

# Overall security posture score
python scripts/security_score_calculator.py --profile production

Configuration Reference

Terraform Variables

Compliance Checker Configuration (compliance_config.yaml)

# Which CIS sections to check (all enabled by default)
checks:
  iam: true
  storage: true
  logging: true
  monitoring: true
  networking: true

# Severity thresholds for pass/fail
thresholds:
  critical_max: 0     # Fail if any critical findings
  high_max: 3         # Fail if more than 3 high findings
  medium_max: 10      # Warn if more than 10 medium findings

# Output options
output:
  format: "report"    # "report", "json", "csv"
  file: null          # null = stdout, or path to output file
  include_passing: false  # Include passing checks in output

Security Architecture

┌─────────────────────────────────────────────────────────────────┐
│                        AWS Account                              │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                   IAM Baseline                            │   │
│  │  ┌─────────┐  ┌──────────┐  ┌─────────────┐             │   │
│  │  │Password │  │ MFA      │  │ Permission  │             │   │
│  │  │Policy   │  │ Enforce  │  │ Boundaries  │             │   │
│  │  └─────────┘  └──────────┘  └─────────────┘             │   │
│  └──────────────────────────────────────────────────────────┘   │
│                                                                  │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────────────┐   │
│  │  Encryption  │  │   Network    │  │  Logging & Monitor   │   │
│  │  ┌────────┐  │  │  ┌────────┐  │  │  ┌──────────────┐   │   │
│  │  │  KMS   │  │  │  │  VPC   │  │  │  │ CloudTrail   │   │   │
│  │  │  Keys  │  │  │  │ + SGs  │  │  │  │ (all regions)│   │   │
│  │  ├────────┤  │  │  ├────────┤  │  │  ├──────────────┤   │   │
│  │  │  S3    │  │  │  │ Flow   │  │  │  │ AWS Config   │   │   │
│  │  │Default │  │  │  │ Logs   │  │  │  │ (rules)      │   │   │
│  │  ├────────┤  │  │  ├────────┤  │  │  ├──────────────┤   │   │
│  │  │  EBS   │  │  │  │ NACLs  │  │  │  │ GuardDuty    │   │   │
│  │  │Default │  │  │  │        │  │  │  │              │   │   │
│  │  └────────┘  │  │  └────────┘  │  │  ├──────────────┤   │   │
│  └──────────────┘  └──────────────┘  │  │ SecurityHub  │   │   │
│                                       │  │ (aggregate)  │   │   │
│                                       │  └──────┬───────┘   │   │
│                                       └─────────┼───────────┘   │
│                                                  │               │
│                                           ┌──────▼───────┐      │
│                                           │  SNS Alerts  │      │
│                                           │  → Email     │      │
│                                           │  → PagerDuty │      │
│                                           └──────────────┘      │
└─────────────────────────────────────────────────────────────────┘