aws-cloudformation-security

Name: aws-cloudformation-security
Author: giuseppe-trisciuoglio

72installs36forks

How to install aws-cloudformation-security?

giuseppe-trisciuoglio/developer-kit/aws-cloudformation-security

$npx -y skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security

Installs into the current project.

Summary

Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure cross-stack references. Use when implementing security best practices, encrypting data

Files · 1

View on GitHub

SKILL.md

1	# AWS CloudFormation Security Infrastructure
2
3	## Overview
4
5	Create production-ready security infrastructure using AWS CloudFormation templates. This skill covers KMS encryption, Secrets Manager, IAM security with least privilege, VPC security configurations, ACM certificates, parameter security, secure outputs, cross-stack references, CloudWatch Logs encryption, defense in depth strategies, and security best practices.
6
7	## When to Use
8
9	- Implementing KMS encryption at rest and in transit
10	- Managing secrets with Secrets Manager and automatic rotation
11	- Applying IAM least privilege policies and permission boundaries
12	- Securing VPC with security groups, NACLs, and VPC endpoints
13	- Managing TLS/SSL certificates with ACM
14	- Encrypting CloudWatch Logs and S3 buckets
15	- Creating secure cross-stack references and outputs
16
17	## Instructions
18
19	Follow these steps to create security infrastructure with CloudFormation:
20
21	### 1. Define KMS Encryption Keys
22
23	Create customer-managed keys for encryption:
24
25	```yaml
26	Resources:
27	EncryptionKey:
28	Type: AWS::KMS::Key
29	Properties:
30	Description: Customer-managed key for data encryption
31	KeyPolicy:
32	Statement:
33	- Effect: Allow
34	Principal:
35	Service: lambda.amazonaws.com
36	Action:
37	- kms:Decrypt
38	- kms:GenerateDataKey
39	Resource: "*"
40	- Effect: Allow
41	Principal:
42	AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
43	Action:
44	- kms:*
45	Resource: "*"
46
47	KeyAlias:
48	Type: AWS::KMS::Alias
49	Properties:
50	AliasName: !Sub "${AWS::StackName}/encryption-key"
51	TargetKeyId: !Ref EncryptionKey
52	```
53
54	Validate: `aws kms get-key-policy --key-id <key-id> --output text`
55
56	### 2. Manage Secrets with Secrets Manager
57
58	Store and retrieve sensitive data securely:
59
60	```yaml
61	Resources:
62	DatabaseSecret:
63	Type: AWS::SecretsManager::Secret
64	Properties:
65	Name: !Sub "${AWS::StackName}/database"
66	Description: Database credentials
67	SecretString: !Sub \|
68	{
69	"username": "admin",
70	"password": "${DatabasePassword}",
71	"engine": "mysql",
72	"host": "${DatabaseEndpoint}",
73	"port": 3306
74	}
75	KmsKeyId: !Ref EncryptionKey
76
77	SecretRotationSchedule:
78	Type: AWS::SecretsManager::RotationSchedule
79	Properties:
80	SecretId: !Ref DatabaseSecret
81	RotationLambdaARN: !Ref RotationLambda.Arn
82	RotationRules:
83	AutomaticallyAfterDays: 30
84	```
85
86	Validate: `aws secretsmanager describe-secret --secret-id <secret-name>`
87
88	### 3. Apply IAM Least Privilege
89
90	Create roles and policies with minimal required permissions:
91
92	```yaml
93	Resources:
94	ExecutionRole:
95	Type: AWS::IAM::Role
96	Properties:
97	AssumeRolePolicyDocument:
98	Version: "2012-10-17"
99	Statement:
100	- Effect: Allow
101	Principal:
102	Service: lambda.amazonaws.com
103	Action: sts:AssumeRole
104	ManagedPolicyArns:
105	- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
106	Policies:
107	- PolicyName: SpecificPermissions
108	PolicyDocument:
109	Version: "2012-10-17"
110	Statement:
111	- Effect: Allow
112	Action:
113	- s3:GetObject
114	Resource: !Sub "${DataBucket.Arn}/*"
115	```
116
117	Validate: `aws iam simulate-principal-policy --policy-source-arn <role-arn> --action-names s3:GetObject --resource-arns <bucket-arn>`
118
119	### 4. Secure VPC Configuration
120
121	Implement network security with security groups and NACLs:
122
123	```yaml
124	Resources:
125	ApplicationSecurityGroup:
126	Type: AWS::EC2::SecurityGroup
127	Properties:
128	GroupDescription: Application security group
129	VpcId: !Ref VPC
130	SecurityGroupIngress:
131	- IpProtocol: tcp
132	FromPort: 443
133	ToPort: 443
134	SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
135	SecurityGroupEgress:
136	- IpProtocol: -1
137	CidrIp: 0.0.0.0/0
138
139	ApplicationNACL:
140	Type: AWS::EC2::NetworkAcl
141	Properties:
142	VpcId: !Ref VPC
143
144	NACLEntry:
145	Type: AWS::EC2::NetworkAclEntry
146	Properties:
147	NetworkAclId: !Ref ApplicationNACL
148	RuleNumber: 100
149	Protocol: "6"
150	RuleAction: allow
151	Egress: false
152	CidrBlock: 0.0.0.0/0
153	PortRange:
154	From: 443
155	To: 443
156	```
157
158	Validate: `aws ec2 describe-security-groups --group-ids <sg-id> --query 'Se

People who liked this also viewed

6 picks

Type

aws-cloudformation-security

72installs36forks

View on GitHub

How to install aws-cloudformation-security?

giuseppe-trisciuoglio/developer-kit/aws-cloudformation-security

$npx -y skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS CloudFormation Security Infrastructure
2
3	## Overview
4
5	Create production-ready security infrastructure using AWS CloudFormation templates. This skill covers KMS encryption, Secrets Manager, IAM security with least privilege, VPC security configurations, ACM certificates, parameter security, secure outputs, cross-stack references, CloudWatch Logs encryption, defense in depth strategies, and security best practices.
6
7	## When to Use
8
9	- Implementing KMS encryption at rest and in transit
10	- Managing secrets with Secrets Manager and automatic rotation
11	- Applying IAM least privilege policies and permission boundaries
12	- Securing VPC with security groups, NACLs, and VPC endpoints
13	- Managing TLS/SSL certificates with ACM
14	- Encrypting CloudWatch Logs and S3 buckets
15	- Creating secure cross-stack references and outputs
16
17	## Instructions
18
19	Follow these steps to create security infrastructure with CloudFormation:
20
21	### 1. Define KMS Encryption Keys
22
23	Create customer-managed keys for encryption:
24
25	```yaml
26	Resources:
27	EncryptionKey:
28	Type: AWS::KMS::Key
29	Properties:
30	Description: Customer-managed key for data encryption
31	KeyPolicy:
32	Statement:
33	- Effect: Allow
34	Principal:
35	Service: lambda.amazonaws.com
36	Action:
37	- kms:Decrypt
38	- kms:GenerateDataKey
39	Resource: "*"
40	- Effect: Allow
41	Principal:
42	AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
43	Action:
44	- kms:*
45	Resource: "*"
46
47	KeyAlias:
48	Type: AWS::KMS::Alias
49	Properties:
50	AliasName: !Sub "${AWS::StackName}/encryption-key"
51	TargetKeyId: !Ref EncryptionKey
52	```
53
54	Validate: `aws kms get-key-policy --key-id <key-id> --output text`
55
56	### 2. Manage Secrets with Secrets Manager
57
58	Store and retrieve sensitive data securely:
59
60	```yaml
61	Resources:
62	DatabaseSecret:
63	Type: AWS::SecretsManager::Secret
64	Properties:
65	Name: !Sub "${AWS::StackName}/database"
66	Description: Database credentials
67	SecretString: !Sub \|
68	{
69	"username": "admin",
70	"password": "${DatabasePassword}",
71	"engine": "mysql",
72	"host": "${DatabaseEndpoint}",
73	"port": 3306
74	}
75	KmsKeyId: !Ref EncryptionKey
76
77	SecretRotationSchedule:
78	Type: AWS::SecretsManager::RotationSchedule
79	Properties:
80	SecretId: !Ref DatabaseSecret
81	RotationLambdaARN: !Ref RotationLambda.Arn
82	RotationRules:
83	AutomaticallyAfterDays: 30
84	```
85
86	Validate: `aws secretsmanager describe-secret --secret-id <secret-name>`
87
88	### 3. Apply IAM Least Privilege
89
90	Create roles and policies with minimal required permissions:
91
92	```yaml
93	Resources:
94	ExecutionRole:
95	Type: AWS::IAM::Role
96	Properties:
97	AssumeRolePolicyDocument:
98	Version: "2012-10-17"
99	Statement:
100	- Effect: Allow
101	Principal:
102	Service: lambda.amazonaws.com
103	Action: sts:AssumeRole
104	ManagedPolicyArns:
105	- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
106	Policies:
107	- PolicyName: SpecificPermissions
108	PolicyDocument:
109	Version: "2012-10-17"
110	Statement:
111	- Effect: Allow
112	Action:
113	- s3:GetObject
114	Resource: !Sub "${DataBucket.Arn}/*"
115	```
116
117	Validate: `aws iam simulate-principal-policy --policy-source-arn <role-arn> --action-names s3:GetObject --resource-arns <bucket-arn>`
118
119	### 4. Secure VPC Configuration
120
121	Implement network security with security groups and NACLs:
122
123	```yaml
124	Resources:
125	ApplicationSecurityGroup:
126	Type: AWS::EC2::SecurityGroup
127	Properties:
128	GroupDescription: Application security group
129	VpcId: !Ref VPC
130	SecurityGroupIngress:
131	- IpProtocol: tcp
132	FromPort: 443
133	ToPort: 443
134	SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
135	SecurityGroupEgress:
136	- IpProtocol: -1
137	CidrIp: 0.0.0.0/0
138
139	ApplicationNACL:
140	Type: AWS::EC2::NetworkAcl
141	Properties:
142	VpcId: !Ref VPC
143
144	NACLEntry:
145	Type: AWS::EC2::NetworkAclEntry
146	Properties:
147	NetworkAclId: !Ref ApplicationNACL
148	RuleNumber: 100
149	Protocol: "6"
150	RuleAction: allow
151	Egress: false
152	CidrBlock: 0.0.0.0/0
153	PortRange:
154	From: 443
155	To: 443
156	```
157
158	Validate: `aws ec2 describe-security-groups --group-ids <sg-id> --query 'Se

People who liked this also viewed

6 picks

Type