AWS Security Architecture

CIA Platform AWS Architecture
│
├─ VPC (10.0.0.0/16)
│  ├─ Public Subnet (10.0.1.0/24)
│  │  ├─ ALB (Application Load Balancer)
│  │  └─ NAT Gateway
│  │
│  ├─ Private Subnet - App (10.0.2.0/24)
│  │  └─ EC2 / ECS (CIA Application)
│  │
│  └─ Private Subnet - Data (10.0.3.0/24)
│     └─ RDS PostgreSQL (encrypted)
│
├─ Security Services
│  ├─ AWS WAF (on ALB)
│  ├─ AWS Shield (DDoS protection)
│  ├─ GuardDuty (threat detection)
│  ├─ CloudTrail (audit logging)
│  └─ AWS Config (compliance monitoring)
│
└─ Key Management
   └─ KMS (Customer Managed Keys)
      ├─ RDS encryption key
      ├─ S3 encryption key
      └─ Secrets Manager key

# Application Security Group - Least Privilege
ApplicationSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: CIA Application Server
    VpcId: !Ref VPC
    SecurityGroupIngress:
      # Only allow traffic from ALB
      - IpProtocol: tcp
        FromPort: 8080
        ToPort: 8080
        SourceSecurityGroupId: !Ref ALBSecurityGroup
    SecurityGroupEgress:
      # PostgreSQL to database only
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        DestinationSecurityGroupId: !Ref DatabaseSecurityGroup
      # HTTPS for external API calls
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0

# Database Security Group
DatabaseSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: CIA PostgreSQL Database
    VpcId: !Ref VPC
    SecurityGroupIngress:
      # Only from application servers
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        SourceSecurityGroupId: !Ref ApplicationSecurityGroup
    SecurityGroupEgress: []  # No outbound access needed

NACL Rules (defense in depth):
├─ Allow inbound HTTPS (443) from internet to public subnet
├─ Allow inbound 8080 from public to private app subnet
├─ Allow inbound 5432 from app subnet to data subnet
├─ Deny all other inbound traffic
└─ Allow ephemeral ports for return traffic

# EC2/ECS Task Role - Minimum permissions
CIAApplicationRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: cia-application-role
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: cia-app-policy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            # Read secrets from Secrets Manager
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                - !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:cia/*'
            # Write CloudWatch logs
            - Effect: Allow
              Action:
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource:
                - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/cia/*'
            # KMS decrypt for database credentials
            - Effect: Allow
              Action:
                - kms:Decrypt
              Resource:
                - !GetAtt CIAEncryptionKey.Arn

# ❌ INSECURE: Overly permissive policy
- Effect: Allow
  Action: '*'
  Resource: '*'

# ❌ INSECURE: Wildcard on sensitive services
- Effect: Allow
  Action: 's3:*'
  Resource: '*'

# ✅ SECURE: Specific actions on specific resources
- Effect: Allow
  Action:
    - s3:GetObject
    - s3:PutObject
  Resource:
    - !Sub 'arn:aws:s3:::cia-data-bucket/*'

CIAEncryptionKey:
  Type: AWS::KMS::Key
  Properties:
    Description: CIA Platform encryption key
    Enabled: true
    EnableKeyRotation: true  # Annual automatic rotation
    KeyPolicy:
      Version: '2012-10-17'
      Statement:
        - Sid: AllowKeyAdministration
          Effect: Allow
          Principal:
            AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:role/admin'
          Action:
            - kms:Create*
            - kms:Describe*
            - kms:Enable*
            - kms:List*
            - kms:Put*
            - kms:Update*
            - kms:Revoke*
            - kms:Disable*
            - kms:Get*
            - kms:Delete*
            - kms:ScheduleKeyDeletion
          Resource: '*'
        - Sid: AllowApplicationUse
          Effect: Allow
          Principal:
            AWS: !GetAtt CIAApplicationRole.Arn
          Action:
            - kms:Decrypt
            - kms:GenerateDataKey
          Resource: '*'

CIACloudTrail:
  Type: AWS::CloudTrail::Trail
  Properties:
    TrailName: cia-audit-trail
    IsLogging: true
    IsMultiRegionTrail: true
    EnableLogFileValidation: true  # Tamper detection
    IncludeGlobalServiceEvents: true
    S3BucketName: !Ref AuditLogBucket
    CloudWatchLogsLogGroupArn: !GetAtt AuditLogGroup.Arn
    EventSelectors:
      - ReadWriteType: All
        IncludeManagementEvents: true
        DataResources:
          - Type: AWS::S3::Object
            Values: ['arn:aws:s3:::cia-data-bucket/']

GuardDuty Detection Categories:
├─ Reconnaissance: Port scanning, API enumeration
├─ Instance Compromise: Cryptocurrency mining, C&C communication
├─ Account Compromise: Unusual API calls, disabled logging
├─ S3 Compromise: Public bucket access, unusual data transfer
└─ RDS Protection: Unusual login attempts, suspicious queries

CloudFormation Security Review:
□ No hardcoded secrets or credentials
□ IAM roles follow least privilege
□ Security groups restrict inbound/outbound
□ RDS encryption enabled (KMS CMK)
□ S3 buckets private, encrypted, versioned
□ CloudTrail enabled with log validation
□ VPC flow logs enabled
□ ALB uses TLS 1.2+ only
□ Auto-scaling configured for availability
□ Backup retention configured (RDS, S3)
□ Tags applied for cost and security tracking