aws-security-architecture

The full skill.

Original instructions from the publisher’s SKILL.md

# AWS Security Architecture Skill

## Purpose

This skill provides AWS security architecture guidance for the CIA platform deployment, covering VPC network security, IAM least-privilege policies, KMS encryption, CloudTrail auditing, and GuardDuty threat detection. It aligns with Hack23 ISMS and AWS Well-Architected Security Pillar.

## When to Use This Skill

Apply this skill when:
- ✅ Designing or modifying AWS infrastructure (CloudFormation)
- ✅ Configuring IAM roles, policies, or permissions
- ✅ Setting up encryption with KMS for data at rest
- ✅ Configuring VPC networking, security groups, or NACLs
- ✅ Enabling audit logging with CloudTrail
- ✅ Setting up threat detection with GuardDuty
- ✅ Reviewing cia-dist-cloudformation templates

Do NOT use for:
- ❌ Application-level security (use secure-code-review skill)
- ❌ CI/CD pipeline security (use github-actions-workflows skill)
- ❌ Data classification decisions (use data-protection skill)

## AWS Security Architecture Overview

```
CIA Platform AWS Architecture
│
├─ VPC (10.0.0.0/16)
│  ├─ Public Subnet (10.0.1.0/24)
│  │  ├─ ALB (Application Load Balancer)
│  │  └─ NAT Gateway
│  │
│  ├─ Private Subnet - App (10.0.2.0/24)
│  │  └─ EC2 / ECS (CIA Application)
│  │
│  └─ Private Subnet - Data (10.0.3.0/24)
│     └─ RDS PostgreSQL (encrypted)
│
├─ Security Services
│  ├─ AWS WAF (on ALB)
│  ├─ AWS Shield (DDoS protection)
│  ├─ GuardDuty (threat detection)
│  ├─ CloudTrail (audit logging)
│  └─ AWS Config (compliance monitoring)
│
└─ Key Management
   └─ KMS (Customer Managed Keys)
      ├─ RDS encryption key
      ├─ S3 encryption key
      └─ Secrets Manager key
```

## VPC Security

### Security Group Rules

```yaml
# Application Security Group - Least Privilege
ApplicationSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: CIA Application Server
    VpcId: !Ref VPC
    SecurityGroupIngress:
      # Only allow traffic from ALB
      - IpProtocol: tcp
        FromPort: 8080
        ToPort: 8080
        SourceSecurityGroupId: !Ref ALBSecurityGroup
    SecurityGroupEgress:
      # PostgreSQL to database only
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        DestinationSecurityGroupId: !Ref DatabaseSecurityGroup
      # HTTPS for external API calls
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0

# Database Security Group
DatabaseSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: CIA PostgreSQL Database
    VpcId: !Ref VPC
    SecurityGroupIngress:
      # Only from application servers
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        SourceSecurityGroupId: !Ref ApplicationSecurityGroup
    SecurityGroupEgress: []  # No outbound access needed
```

### Network ACLs

```
NACL Rules (defense in depth):
├─ Allow inbound HTTPS (443) from internet to public subnet
├─ Allow inbound 8080 from public to private app subnet
├─ Allow inbound 5432 from app subnet to data subnet
├─ Deny all other inbound traffic
└─ Allow ephemeral ports for return traffic
```

## IAM Least Privilege

### Application IAM Role

```yaml
# EC2/ECS Task Role - Minimum permissions
CIAApplicationRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: cia-application-role
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: cia-app-policy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            # Read secrets from Secrets Manager
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                - !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:cia/*'
            # Write CloudWatch logs
            - Effect: Allow
              Action:
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource:
                - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/cia/*'
            # KMS decrypt for database credentials
            - Effect: Allow
              Action:
                - kms:Decrypt
              Resource:
                - !GetAtt CIAEncryptionKey.Arn
```

### IAM Anti-Patterns

```yaml
# ❌ INSECURE: Overly permissive policy
- Effect: Allow
  Action: '*'
  Resource: '*'

# ❌ INSECURE: Wildcard on sensitive services
- Effect: Allow
  Action: 's3:*'
  Resource: '*'

# ✅ SECURE: Specific actions on specific resources
- Effect: Allow
  Action:
    - s3:GetObject
    - s3:PutObject
  Resource:
    - !Sub 'arn:aws:s3:::cia-data-bucket/*'
```

## KMS Encryption

### Key Configuration

```yaml
CIAEncryptionKey:
  Type: AWS::KMS::Key
  Properties:
    Description: CIA Platform encryption key
    Enabled: true
    EnableKeyRotation: true  # Annual automatic rotation
    KeyPolicy:
      Version: '2012-10-17'
      Statement:
        - Sid: AllowKeyAdministration
          Effect: Allow
          Principal:
            AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:role/admin'
          Action:
            - kms:Create*
            - kms:Describe*
            - kms:Enable*
            - kms:List*
            - kms:Put*
            - kms:Update*
            - kms:Revoke*
            - kms:Disable*
            - kms:Get*
            - kms:Delete*
            - kms:ScheduleKeyDeletion
          Resource: '*'
        - Sid: AllowApplicationUse
          Effect: Allow
          Principal:
            AWS: !GetAtt CIAApplicationRole.Arn
          Action:
            - kms:Decrypt
            - kms:GenerateDataKey
          Resource: '*'
```

### Encryption Scope

| Resource | Encryption | Key Type |
|----------|-----------|----------|
| RDS PostgreSQL | At rest + in transit | KMS CMK |
| S3 buckets | SSE-KMS | KMS CMK |
| EBS volumes | At rest | KMS CMK |
| Secrets Manager | At rest | KMS CMK |
| CloudWatch Logs | At rest | AWS managed |
| ALB (TLS) | In transit | ACM certificate |

## CloudTrail Audit Logging

```yaml
CIACloudTrail:
  Type: AWS::CloudTrail::Trail
  Properties:
    TrailName: cia-audit-trail
    IsLogging: true
    IsMultiRegionTrail: true
    EnableLogFileValidation: true  # Tamper detection
    IncludeGlobalServiceEvents: true
    S3BucketName: !Ref AuditLogBucket
    CloudWatchLogsLogGroupArn: !GetAtt AuditLogGroup.Arn
    EventSelectors:
      - ReadWriteType: All
        IncludeManagementEvents: true
        DataResources:
          - Type: AWS::S3::Object
            Values: ['arn:aws:s3:::cia-data-bucket/']
```

## GuardDuty Threat Detection

### Enabled Findings

```
GuardDuty Detection Categories:
├─ Reconnaissance: Port scanning, API enumeration
├─ Instance Compromise: Cryptocurrency mining, C&C communication
├─ Account Compromise: Unusual API calls, disabled logging
├─ S3 Compromise: Public bucket access, unusual data transfer
└─ RDS Protection: Unusual login attempts, suspicious queries
```

### Alert Response

| Severity | Response Time | Action |
|----------|-------------|--------|
| Critical | < 1 hour | Immediate investigation, isolate resource |
| High | < 4 hours | Investigate, assess impact |
| Medium | < 24 hours | Review, plan remediation |
| Low | < 1 week | Log, trend analysis |

## Security Checklist for CloudFormation

```
CloudFormation Security Review:
□ No hardcoded secrets or credentials
□ IAM roles follow least privilege
□ Security groups restrict inbound/outbound
□ RDS encryption enabled (KMS CMK)
□ S3 buckets private, encrypted, versioned
□ CloudTrail enabled with log validation
□ VPC flow logs enabled
□ ALB uses TLS 1.2+ only
□ Auto-scaling configured for availability
□ Backup retention configured (RDS, S3)
□ Tags applied for cost and security tracking
```

## ISMS Alignment

| Control | Requirement | AWS Implementation |
|---------|------------|-------------------|
| ISO 27001 A.8.1 | User endpoint devices | Security groups, NACLs |
| ISO 27001 A.8.9 | Configuration management | AWS Config rules |
| ISO 27001 A.8.15 | Logging | CloudTrail, CloudWatch |
| ISO 27001 A.8.20 | Network security | VPC, WAF, Shield |
| ISO 27001 A.8.24 | Cryptography | KMS, ACM, TLS |
| NIST CSF DE.CM | Continuous monitoring | GuardDuty, Config |
| CIS Control 3 | Data protection | KMS encryption |
| CIS Control 8 | Audit log management | CloudTrail |

## References

- [AWS Well-Architected Security Pillar](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/)
- [AWS CloudFormation Security Best Practices](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/security-best-practices.html)
- [CIS AWS Benchmark](https://www.cisecurity.org/benchmark/amazon_web_services)
- [Hack23 ISMS Infrastructure Security](https://github.com/Hack23/ISMS-PUBLIC)