aws-cloudformation-security ยท diff
git:20260223.c6d4db1 to git:20260323.935227a
169 added, 1522 removed. Audit A to A.
---
name: aws-cloudformation-security
- description: Provides AWS CloudFormation patterns for infrastructure security, secrets management, encryption, and secure data handling. Use when creating secure CloudFormation templates with AWS Secrets Manager, KMS encryption, secure parameters, IAM policies, VPC security groups, TLS/SSL certificates, and encrypted traffic configurations. Covers template structure, parameter best practices, cross-stack references, and defense-in-depth strategies.
+ description: Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure cross-stack references. Use when implementing security best practices, encrypting data, managing secrets, applying least privilege IAM policies, securing VPC configurations, managing TLS/SSL certificates, and implementing defense in depth strategies.
allowed-tools: Read, Write, Bash
---
- # AWS CloudFormation Security
+ # AWS CloudFormation Security Infrastructure
## Overview
- Create secure AWS infrastructure using CloudFormation templates with security best practices. This skill covers encryption with AWS KMS, secrets management with Secrets Manager, secure parameters, IAM least privilege, security groups, TLS/SSL certificates, and defense-in-depth strategies.
+ Create production-ready security infrastructure using AWS CloudFormation templates. This skill covers KMS encryption, Secrets Manager, IAM security with least privilege, VPC security configurations, ACM certificates, parameter security, secure outputs, cross-stack references, CloudWatch Logs encryption, defense in depth strategies, and security best practices.
## When to Use
Use this skill when:
- - Creating CloudFormation templates with encryption at-rest and in-transit
- - Managing secrets and credentials with AWS Secrets Manager
- - Configuring AWS KMS for encryption keys
- - Implementing secure parameters with SSM Parameter Store
- - Creating IAM policies with least privilege
- - Configuring security groups and network security
- - Implementing secure cross-stack references
- - Configuring TLS/SSL for AWS services
- - Applying defense-in-depth for infrastructure
+ - Implementing AWS KMS for encryption at rest and in transit
+ - Managing secrets with AWS Secrets Manager
+ - Applying IAM least privilege policies and roles
+ - Securing VPC configurations with security groups and NACLs
+ - Managing TLS/SSL certificates with ACM
+ - Implementing secure parameter handling in CloudFormation
+ - Creating secure cross-stack references and outputs
+ - Encrypting CloudWatch Logs for compliance
+ - Implementing defense in depth strategies
+ - Applying security best practices across AWS resources
## Instructions
- Follow these steps to create secure CloudFormation infrastructure:
-
- 1. **Define Encryption Keys**: Create KMS keys for data encryption
- 2. **Set Up Secrets**: Use Secrets Manager for credentials and API keys
- 3. **Configure Secure Parameters**: Use SSM Parameter Store with encryption
- 4. **Implement IAM Policies**: Apply least privilege principles
- 5. **Create Security Groups**: Configure network access controls
- 6. **Set Up TLS Certificates**: Use ACM for SSL/TLS certificates
- 7. **Enable Encryption**: Configure encryption for storage and transit
- 8. **Implement Monitoring**: Enable CloudTrail and security logging
-
- For complete examples, see the [EXAMPLES.md](references/examples.md) file.
-
- ## Examples
-
- The following examples demonstrate common security patterns:
-
- ### Example 1: KMS Key for Encryption
-
- ```yaml
- KmsKey:
- Type: AWS::KMS::Key
- Properties:
- KeyPolicy:
- Version: "2012-10-17"
- Statement:
- - Effect: Allow
- Principal:
- AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
- Action: kms:*
- Resource: "*"
- - Effect: Allow
- Principal:
- Service: s3.amazonaws.com
- Action:
- - kms:Encrypt
- - kms:Decrypt
- Resource: "*"
-
- KmsAlias:
- Type: AWS::KMS::Alias
- Properties:
- AliasName: !Sub "alias/${AWS::StackName}-key"
- TargetKeyId: !Ref KmsKey
- ```
-
- ### Example 2: Secrets Manager Secret
-
- ```yaml
- DatabaseSecret:
- Type: AWS::SecretsManager::Secret
- Properties:
- Name: !Sub "${AWS::StackName}/database-credentials"
- Description: Database credentials for application
- SecretString: !Sub |
- {
- "username": "${DBUsername}",
- "password": "${DBPassword}",
- "host": "${DBInstance.Endpoint.Address}",
- "port": "${DBInstance.Endpoint.Port}"
- }
- ```
-
- ### Example 3: Secure Parameter
-
- ```yaml
- SecureParameter:
- Type: AWS::SSM::Parameter
- Properties:
- Name: !Sub "/${AWS::StackName}/api-key"
- Type: SecureString
- Value: !Ref ApiKeyValue
- Description: Secure API key for external service
- ```
-
- For complete production-ready examples, see [EXAMPLES.md](references/examples.md).
-
- ## CloudFormation Template Structure
-
- ### Base Template with Security Section
-
- ```yaml
- AWSTemplateFormatVersion: 2010-09-09
- Description: Secure infrastructure template with encryption and secrets management
-
- Metadata:
- AWS::CloudFormation::Interface:
- ParameterGroups:
- - Label:
- default: Encryption Settings
- Parameters:
- - EncryptionKeyArn
- - SecretsKmsKeyId
- - Label:
- default: Security Configuration
- Parameters:
- - SecurityLevel
- - EnableVPCPeering
-
- Parameters:
- Environment:
- Type: String
- Default: dev
- AllowedValues:
- - dev
- - staging
- - production
-
- EncryptionKeyArn:
- Type: AWS::KMS::Key::Arn
- Description: KMS key ARN for encryption
-
- SecretsKmsKeyId:
- Type: String
- Description: KMS key ID for secrets encryption
-
- Mappings:
- SecurityConfig:
- dev:
- EnableDetailedMonitoring: false
- RequireMultiAZ: false
- staging:
- EnableDetailedMonitoring: true
- RequireMultiAZ: false
- production:
- EnableDetailedMonitoring: true
- RequireMultiAZ: true
-
- Conditions:
- IsProduction: !Equals [!Ref Environment, production]
- EnableEnhancedMonitoring: !Equals [!Ref Environment, production]
-
- Resources:
- # Resources will be defined here
-
- Outputs:
- SecurityConfigurationOutput:
- Description: Security configuration applied
- Value: !Ref Environment
- ```
+ Follow these steps to create security infrastructure with CloudFormation:
- ## AWS KMS - Encryption
+ ### 1. Define KMS Encryption Keys
- ### Complete KMS Key with Full Policy
+ Create customer-managed keys for encryption:
```yaml
Resources:
- # Master KMS Key for application
- ApplicationKmsKey:
+ EncryptionKey:
Type: AWS::KMS::Key
Properties:
- Description: "KMS Key for application encryption"
+ Description: Customer-managed key for data encryption
KeyPolicy:
- Version: "2012-10-17"
- Id: "application-key-policy"
Statement:
- # Allow key management to administrators
- - Sid: "EnableIAMPolicies"
- Effect: Allow
- Principal:
- AWS: !Sub "arn:aws:iam::${AWS::AccountId}:role/AdminRole"
- Action:
- - kms:Create*
- - kms:Describe*
- - kms:Enable*
- - kms:List*
- - kms:Put*
- - kms:Update*
- - kms:Revoke*
- - kms:Disable*
- - kms:Get*
- - kms:Delete*
- - kms:TagResource
- - kms:UntagResource
- Resource: "*"
- Condition:
- StringEquals:
- aws:PrincipalOrgID: !Ref OrganizationId
-
- # Allow encryption/decryption for application roles
- - Sid: "AllowCryptographicOperations"
- Effect: Allow
+ - Effect: Allow
Principal:
- AWS:
- - !Sub "arn:aws:iam::${AWS::AccountId}:role/LambdaExecutionRole"
- - !Sub "arn:aws:iam::${AWS::AccountId}:role/ECSTaskRole"
+ Service: lambda.amazonaws.com
Action:
- - kms:Encrypt
- kms:Decrypt
- - kms:GenerateDataKey*
- - kms:ReEncrypt*
+ - kms:GenerateDataKey
Resource: "*"
-
- # Allow key usage for specific services
- - Sid: "AllowKeyUsageForSpecificServices"
- Effect: Allow
+ - Effect: Allow
Principal:
- Service:
- - lambda.amazonaws.com
- - ecs.amazonaws.com
- - rds.amazonaws.com
+ AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
Action:
- - kms:Encrypt
- - kms:Decrypt
- - kms:GenerateDataKey*
+ - kms:*
Resource: "*"
- KeyUsage: ENCRYPT_DECRYPT
- EnableKeyRotation: true
- PendingWindowInDays: 30
-
- # Alias for the key
- ApplicationKmsKeyAlias:
+ KeyAlias:
Type: AWS::KMS::Alias
Properties:
- AliasName: !Sub "alias/application-${Environment}"
- TargetKeyId: !Ref ApplicationKmsKey
-
- # KMS Key for S3 bucket encryption
- S3KmsKey:
- Type: AWS::KMS::Key
- Properties:
- Description: "KMS Key for S3 bucket encryption"
- KeyPolicy:
- Version: "2012-10-17"
- Statement:
- - Sid: "AllowS3Encryption"
- Effect: Allow
- Principal:
- Service: s3.amazonaws.com
- Action:
- - kms:Encrypt
- - kms:Decrypt
- - kms:GenerateDataKey*
- Resource: "*"
- Condition:
- StringEquals:
- aws:SourceAccount: !Ref AWS::AccountId
-
- # KMS Key for RDS encryption
- RdsKmsKey:
- Type: AWS::KMS::Key
- Properties:
- Description: "KMS Key for RDS database encryption"
- KeyPolicy:
- Version: "2012-10-17"
- Statement:
- - Sid: "AllowRDSEncryption"
- Effect: Allow
- Principal:
- Service: rds.amazonaws.com
- Action:
- - kms:Encrypt
- - kms:Decrypt
- - kms:GenerateDataKey*
- Resource: "*"
- ```
-
- ### S3 Bucket with KMS Encryption
-
- ```yaml
- Resources:
- EncryptedS3Bucket:
- Type: AWS::S3::Bucket
- Properties:
- BucketName: !Sub "secure-bucket-${AWS::AccountId}-${AWS::Region}"
- PublicAccessBlockConfiguration:
- BlockPublicAcls: true
- BlockPublicPolicy: true
- IgnorePublicAcls: true
- RestrictPublicBuckets: true
-
- BucketEncryption:
- ServerSideEncryptionConfiguration:
- - ServerSideEncryptionByDefault:
- SSEAlgorithm: aws:kms
- KMSMasterKeyID: !Ref S3KmsKey
- BucketKeyEnabled: true
-
- VersioningConfiguration:
- Status: Enabled
-
- LifecycleConfiguration:
- Rules:
- - Id: ArchiveOldVersions
- Status: Enabled
- NoncurrentVersionExpiration:
- NoncurrentDays: 90
-
- Tags:
- - Key: Environment
- Value: !Ref Environment
- - Key: Encrypted
- Value: "true"
+ AliasName: !Sub "${AWS::StackName}/encryption-key"
+ TargetKeyId: !Ref EncryptionKey
```
- ## AWS Secrets Manager
+ ### 2. Manage Secrets with Secrets Manager
- ### Secrets Manager with Automatic Rotation
+ Store and retrieve sensitive data securely:
```yaml
Resources:
- # Database credentials secret
DatabaseSecret:
Type: AWS::SecretsManager::Secret
Properties:
- Name: !Sub "${AWS::StackName}/database/credentials"
- Description: "Database credentials with automatic rotation"
+ Name: !Sub "${AWS::StackName}/database"
+ Description: Database credentials
SecretString: !Sub |
{
- "username": "${DBUsername}",
- "password": "${DBPassword}",
- "host": "${DBHost}",
- "port": "${DBPort}",
- "dbname": "${DBName}",
- "engine": "postgresql"
+ "username": "admin",
+ "password": "${DatabasePassword}",
+ "engine": "mysql",
+ "host": "${DatabaseEndpoint}",
+ "port": 3306
}
- KmsKeyId: !Ref SecretsKmsKeyId
+ KmsKeyId: !Ref EncryptionKey
- # Enable automatic rotation
+ SecretRotationSchedule:
+ Type: AWS::SecretsManager::RotationSchedule
+ Properties:
+ SecretId: !Ref DatabaseSecret
+ RotationLambdaARN: !Ref RotationLambda.Arn
RotationRules:
AutomaticallyAfterDays: 30
-
- # Rotation Lambda configuration
- RotationLambdaARN: !GetAtt SecretRotationFunction.Arn
-
- Tags:
- - Key: Environment
- Value: !Ref Environment
- - Key: ManagedBy
- Value: CloudFormation
- - Key: RotationEnabled
- Value: "true"
-
- # Secret with resource-based policy
- ApiSecret:
- Type: AWS::SecretsManager::Secret
- Properties:
- Name: !Sub "${AWS::StackName}/api/keys"
- Description: "API keys for external service authentication"
- SecretString: !Sub |
- {
- "api_key": "${ExternalApiKey}",
- "api_secret": "${ExternalApiSecret}",
- "endpoint": "https://api.example.com"
- }
- KmsKeyId: !Ref SecretsKmsKeyId
-
- # Resource-based policy for access control
- ResourcePolicy:
- Version: "2012-10-17"
- Statement:
- - Sid: "AllowLambdaAccess"
- Effect: Allow
- Principal:
- AWS: !Sub "arn:aws:iam::${AWS::AccountId}:role/LambdaExecutionRole"
- Action:
- - secretsmanager:GetSecretValue
- - secretsmanager:DescribeSecret
- Resource: "*"
- Condition:
- StringEquals:
- aws:ResourceTag/Environment: !Ref Environment
-
- - Sid: "DenyUnencryptedAccess"
- Effect: Deny
- Principal: "*"
- Action:
- - secretsmanager:GetSecretValue
- Resource: "*"
- Condition:
- StringEquals:
- kms:ViaService: !Sub "secretsmanager.${AWS::Region}.amazonaws.com"
- StringNotEquals:
- kms:EncryptContext: !Sub "secretsmanager:${AWS::StackName}"
-
- # Secret with cross-account access
- SharedSecret:
- Type: AWS::SecretsManager::Secret
- Properties:
- Name: !Sub "${AWS::StackName}/shared/credentials"
- Description: "Secret shared across accounts"
- SecretString: !Sub |
- {
- "shared_key": "${SharedKey}",
- "shared_value": "${SharedValue}"
- }
- KmsKeyId: !Ref SecretsKmsKeyId
-
- # Cross-account access policy
- ResourcePolicy:
- Version: "2012-10-17"
- Statement:
- - Sid: "AllowCrossAccountRead"
- Effect: Allow
- Principal:
- AWS:
- - !Sub "arn:aws:iam::${ProductionAccountId}:role/SharedSecretReader"
- Action:
- - secretsmanager:GetSecretValue
- - secretsmanager:DescribeSecret
- Resource: "*"
```
- ### SSM Parameter Store with SecureString
-
- ```yaml
- Parameters:
- # SSM Parameter for database connection
- DBCredentialsParam:
- Type: AWS::SSM::Parameter::Value<SecureString>
- NoEcho: true
- Description: Database credentials from SSM Parameter Store
- Value: !Sub "/${Environment}/database/credentials"
-
- # SSM Parameter with specific path
- ApiKeyParam:
- Type: AWS::SSM::Parameter::Value<SecureString>
- NoEcho: true
- Description: API key for external service
- Value: !Sub "/${Environment}/external-api/key"
-
- Resources:
- # Lambda function using SSM parameters
- SecureLambdaFunction:
- Type: AWS::Lambda::Function
- Properties:
- FunctionName: !Sub "${AWS::StackName}-secure-function"
- Runtime: python3.11
- Handler: handler.handler
- Code:
- S3Bucket: !Ref CodeBucket
- S3Key: lambda/secure-function.zip
- Role: !GetAtt LambdaExecutionRole.Arn
- Environment:
- Variables:
- DB_CREDENTIALS_SSM_PATH: !Sub "/${Environment}/database/credentials"
- API_KEY_SSM_PATH: !Sub "/${Environment}/external-api/key"
- ```
-
- ## IAM Security - Least Privilege
+ ### 3. Apply IAM Least Privilege
- ### IAM Role with Granular Policies
+ Create roles and policies with minimal required permissions:
```yaml
Resources:
- # Lambda Execution Role with minimal permissions
- LambdaExecutionRole:
+ ExecutionRole:
Type: AWS::IAM::Role
Properties:
- RoleName: !Sub "${AWS::StackName}-lambda-role"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: lambda.amazonaws.com
Action: sts:AssumeRole
- Condition:
- StringEquals:
- aws:SourceAccount: !Ref AWS::AccountId
- lambda:SourceFunctionArn: !Ref SecureLambdaFunctionArn
-
- # Permissions boundary for enhanced security
- PermissionsBoundary: !Ref PermissionsBoundaryPolicy
-
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
-
Policies:
- # Policy for specific secrets access
- - PolicyName: SecretsAccessPolicy
- PolicyDocument:
- Version: "2012-10-17"
- Statement:
- - Effect: Allow
- Action:
- - secretsmanager:GetSecretValue
- - secretsmanager:DescribeSecret
- Resource: !Ref DatabaseSecretArn
- Condition:
- StringEquals:
- secretsmanager:SecretTarget: !Sub "${DatabaseSecretArn}:${DatabaseSecret}"
-
- - Effect: Allow
- Action:
- - secretsmanager:GetSecretValue
- Resource: !Ref ApiSecretArn
-
- # Policy for specific S3 access
- - PolicyName: S3AccessPolicy
+ - PolicyName: SpecificPermissions
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- s3:GetObject
- - s3:PutObject
- Resource:
- - !Sub "${DataBucket.Arn}/*"
- - !Sub "${DataBucket.Arn}"
- Condition:
- StringEquals:
- s3:ResourceAccount: !Ref AWS::AccountId
-
- - Effect: Deny
- Action:
- - s3:DeleteObject*
- Resource:
- - !Sub "${DataBucket.Arn}/*"
- Condition:
- Bool:
- aws:MultiFactorAuthPresent: true
-
- # Policy for CloudWatch Logs
- - PolicyName: CloudWatchLogsPolicy
- PolicyDocument:
- Version: "2012-10-17"
- Statement:
- - Effect: Allow
- Action:
- - logs:CreateLogGroup
- - logs:CreateLogStream
- - logs:PutLogEvents
- Resource: !Sub "${LogGroup.Arn}:*"
-
- Tags:
- - Key: Environment
- Value: !Ref Environment
- - Key: LeastPrivilege
- Value: "true"
-
- # Permissions Boundary Policy
- PermissionsBoundaryPolicy:
- Type: AWS::IAM::ManagedPolicy
- Properties:
- Description: "Permissions boundary for Lambda execution role"
- PolicyDocument:
- Version: "2012-10-17"
- Statement:
- - Sid: "DenyAccessToAllExceptSpecified"
- Effect: Deny
- Action:
- - "*"
- Resource: "*"
- Condition:
- StringNotEqualsIfExists:
- aws:RequestedRegion:
- - !Ref AWS::Region
- ArnNotEqualsIfExists:
- aws:SourceArn: !Ref AllowedResourceArns
- ```
-
- ### IAM Policy for Cross-Account Access
-
- ```yaml
- Resources:
- # Role for cross-account access
- CrossAccountRole:
- Type: AWS::IAM::Role
- Properties:
- RoleName: !Sub "${AWS::StackName}-cross-account-role"
- AssumeRolePolicyDocument:
- Version: "2012-10-17"
- Statement:
- - Effect: Allow
- Principal:
- AWS:
- - !Sub "arn:aws:iam::${ProductionAccountId}:root"
- - !Sub "arn:aws:iam::${StagingAccountId}:role/CrossAccountAccessRole"
- Action: sts:AssumeRole
- Condition:
- StringEquals:
- aws:PrincipalAccount: !Ref ProductionAccountId
- Bool:
- aws:MultiFactorAuthPresent: true
-
- Policies:
- - PolicyName: CrossAccountReadOnlyPolicy
- PolicyDocument:
- Version: "2012-10-17"
- Statement:
- - Effect: Allow
- Action:
- - s3:GetObject*
- - s3:List*
- Resource:
- - !Sub "${SharedBucket.Arn}"
- - !Sub "${SharedBucket.Arn}/*"
-
- - Effect: Allow
- Action:
- - dynamodb:Query
- - dynamodb:Scan
- - dynamodb:GetItem
- Resource:
- - !Sub "${SharedTable.Arn}"
- - !Sub "${SharedTable.Arn}/index/*"
-
- - Effect: Deny
- Action:
- - s3:DeleteObject*
- - s3:PutObject*
- Resource:
- - !Sub "${SharedBucket.Arn}/*"
+ Resource: !Sub "${DataBucket.Arn}/*"
```
- ## VPC Security
+ ### 4. Secure VPC Configuration
- ### Security Groups with Restrictive Rules
+ Implement network security with security groups and NACLs:
```yaml
Resources:
- # Security Group for application
ApplicationSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
- GroupName: !Sub "${AWS::StackName}-app-sg"
- GroupDescription: "Security group for application tier"
- VpcId: !Ref VPCId
- Tags:
- - Key: Name
- Value: !Sub "${AWS::StackName}-app-sg"
- - Key: Environment
- Value: !Ref Environment
-
- # Inbound rules - only necessary traffic
+ GroupDescription: Application security group
+ VpcId: !Ref VPC
SecurityGroupIngress:
- # HTTP from ALB
- IpProtocol: tcp
- FromPort: 80
- ToPort: 80
- SourceSecurityGroupId: !Ref ALBSecurityGroup
- Description: "HTTP from ALB"
-
- # HTTPS from ALB
- - IpProtocol: tcp
FromPort: 443
ToPort: 443
- SourceSecurityGroupId: !Ref ALBSecurityGroup
- Description: "HTTPS from ALB"
-
- # SSH from bastion only (if needed)
- - IpProtocol: tcp
- FromPort: 22
- ToPort: 22
- SourceSecurityGroupId: !Ref BastionSecurityGroup
- Description: "SSH access from bastion"
-
- # Custom TCP for internal services
- - IpProtocol: tcp
- FromPort: 8080
- ToPort: 8080
- SourceSecurityGroupId: !Ref InternalSecurityGroup
- Description: "Internal service communication"
-
- # Outbound rules - limited
- SecurityGroupEgress:
- # HTTPS outbound for API calls
- - IpProtocol: tcp
- FromPort: 443
- ToPort: 443
- CidrIp: 0.0.0.0/0
- Description: "HTTPS outbound"
-
- # DNS outbound
- - IpProtocol: udp
- FromPort: 53
- ToPort: 53
- CidrIp: 10.0.0.0/16
- Description: "DNS outbound for VPC"
-
- # Security Group for database
- DatabaseSecurityGroup:
- Type: AWS::EC2::SecurityGroup
- Properties:
- GroupName: !Sub "${AWS::StackName}-db-sg"
- GroupDescription: "Security group for database tier"
- VpcId: !Ref VPCId
- Tags:
- - Key: Name
- Value: !Sub "${AWS::StackName}-db-sg"
-
- # Inbound - only from application security group
- SecurityGroupIngress:
- - IpProtocol: tcp
- FromPort: 5432
- ToPort: 5432
- SourceSecurityGroupId: !Ref ApplicationSecurityGroup
- Description: "PostgreSQL from application tier"
-
- # Outbound - minimum required
+ SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
SecurityGroupEgress:
- - IpProtocol: tcp
- FromPort: 443
- ToPort: 443
+ - IpProtocol: -1
CidrIp: 0.0.0.0/0
- Description: "HTTPS for updates and patches"
- # Security Group for ALB
- ALBSecurityGroup:
- Type: AWS::EC2::SecurityGroup
+ ApplicationNACL:
+ Type: AWS::EC2::NetworkAcl
Properties:
- GroupName: !Sub "${AWS::StackName}-alb-sg"
- GroupDescription: "Security group for ALB"
- VpcId: !Ref VPCId
-
- SecurityGroupIngress:
- # HTTP from internet
- - IpProtocol: tcp
- FromPort: 80
- ToPort: 80
- CidrIp: 0.0.0.0/0
- Description: "HTTP from internet"
-
- # HTTPS from internet
- - IpProtocol: tcp
- FromPort: 443
- ToPort: 443
- CidrIp: 0.0.0.0/0
- Description: "HTTPS from internet"
-
- SecurityGroupEgress:
- - IpProtocol: tcp
- FromPort: 80
- ToPort: 80
- SourceSecurityGroupId: !Ref ApplicationSecurityGroup
- Description: "Forward to application"
+ VpcId: !Ref VPC
- # VPC Endpoint for Secrets Manager
- SecretsManagerVPCEndpoint:
- Type: AWS::EC2::VPCEndpoint
+ NACLEntry:
+ Type: AWS::EC2::NetworkAclEntry
Properties:
- VpcId: !Ref VPCId
- ServiceName: !Sub "com.amazonaws.${AWS::Region}.secretsmanager"
- VpcEndpointType: Interface
- Subnets:
- - !Ref PrivateSubnet1
- - !Ref PrivateSubnet2
- SecurityGroups:
- - !Ref ApplicationSecurityGroup
- PrivateDnsEnabled: true
+ NetworkAclId: !Ref ApplicationNACL
+ RuleNumber: 100
+ Protocol: "6"
+ RuleAction: allow
+ Egress: false
+ CidrBlock: 0.0.0.0/0
+ PortRange:
+ From: 443
+ To: 443
```
- ## TLS/SSL Certificates with ACM
+ ### 5. Request ACM Certificates
- ### Certificate Manager for API Gateway
+ Manage TLS/SSL certificates for secure communication:
```yaml
Resources:
- # SSL Certificate for domain
- SSLCertificate:
- Type: AWS::CertificateManager::Certificate
+ Certificate:
+ Type: AWS::ACM::Certificate
Properties:
DomainName: !Ref DomainName
SubjectAlternativeNames:
- - !Sub "*.${DomainName}"
- - !Ref AdditionalDomainName
-
- ValidationMethod: DNS
-
+ - !Sub "www.${DomainName}"
+ - !Sub "api.${DomainName}"
DomainValidationOptions:
- DomainName: !Ref DomainName
- Route53HostedZoneId: !Ref HostedZoneId
-
- Options:
- CertificateTransparencyLoggingPreference: ENABLED
-
+ ValidationDomain: !Ref DomainName
Tags:
- Key: Environment
Value: !Ref Environment
- - Key: ManagedBy
- Value: CloudFormation
- # Certificate for regional API Gateway
- RegionalCertificate:
- Type: AWS::CertificateManager::Certificate
- Properties:
- DomainName: !Sub "${Environment}.${DomainName}"
- ValidationMethod: DNS
- DomainValidationOptions:
- - DomainName: !Sub "${Environment}.${DomainName}"
- Route53HostedZoneId: !Ref HostedZoneId
-
- # API Gateway with TLS 1.2+
- SecureApiGateway:
- Type: AWS::ApiGateway::RestApi
- Properties:
- Name: !Sub "${AWS::StackName}-secure-api"
- Description: "Secure REST API with TLS enforcement"
- EndpointConfiguration:
- Types:
- - REGIONAL
- MinimumCompressionSize: 1024
-
- # Policy to enforce HTTPS
- Policy:
- Version: "2012-10-17"
- Statement:
- - Effect: Deny
- Principal: "*"
- Action: execute-api:Invoke
- Resource: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${SecureApiGateway}/*"
- Condition:
- Bool:
- aws:SecureTransport: "false"
-
- # Custom Domain per API Gateway
- ApiGatewayDomain:
- Type: AWS::ApiGateway::DomainName
- Properties:
- DomainName: !Sub "api.${DomainName}"
- RegionalCertificateArn: !Ref RegionalCertificate
- EndpointConfiguration:
- Types:
- - REGIONAL
-
- # Route 53 record per dominio API
- ApiGatewayDNSRecord:
+ # DNS validation record
+ DnsValidationRecord:
Type: AWS::Route53::RecordSet
Properties:
- Name: !Sub "api.${DomainName}."
- Type: A
- AliasTarget:
- DNSName: !GetAtt ApiGatewayRegionalHostname.RegionalHostname
- HostedZoneId: !GetAtt ApiGatewayRegionalHostname.RegionalHostedZoneId
- EvaluateTargetHealth: false
- HostedZoneId: !Ref HostedZoneId
-
- # Lambda Function URL con AuthType AWS_IAM
- SecureLambdaUrl:
- Type: AWS::Lambda::Url
- Properties:
- AuthType: AWS_IAM
- TargetFunctionArn: !GetAtt SecureLambdaFunction.Arn
- Cors:
- AllowCredentials: true
- AllowHeaders:
- - Authorization
- - Content-Type
- AllowMethods:
- - GET
- - POST
- AllowOrigins:
- - !Ref AllowedOrigin
- MaxAge: 86400
- InvokeMode: BUFFERED
+ HostedZoneName: !Ref HostedZone
+ Name: !Sub "_${DomainName}."
+ Type: CNAME
+ TTL: 300
+ ResourceRecords:
+ - !Ref Certificate
```
- ## Parameter Security Best Practices
+ ### 6. Implement Secure Parameters
- ### AWS-Specific Parameter Types with Validation
+ Use SecureString for sensitive parameter values:
```yaml
- Parameters:
- # AWS-specific types for automatic validation
- VPCId:
- Type: AWS::EC2::VPC::Id
- Description: VPC ID for deployment
-
- SubnetIds:
- Type: List<AWS::EC2::Subnet::Id>
- Description: Subnet IDs for private subnets
-
- SecurityGroupIds:
- Type: List<AWS::EC2::SecurityGroup::Id>
- Description: Security group IDs
-
- DatabaseInstanceIdentifier:
- Type: AWS::RDS::DBInstance::Identifier
- Description: RDS instance identifier
-
- KMSKeyArn:
- Type: AWS::KMS::Key::Arn
- Description: KMS key ARN for encryption
-
- SecretArn:
- Type: AWS::SecretsManager::Secret::Arn
- Description: Secrets Manager secret ARN
-
- LambdaFunctionArn:
- Type: AWS::Lambda::Function::Arn
- Description: Lambda function ARN
-
- # SSM Parameter with secure string
- DatabasePassword:
- Type: AWS::SSM::Parameter::Value<SecureString>
- NoEcho: true
- Description: Database password from SSM
-
- # Custom parameters with constraints
- DBUsername:
- Type: String
- Description: Database username
- Default: appuser
- MinLength: 1
- MaxLength: 63
- AllowedPattern: "[a-zA-Z][a-zA-Z0-9_]*"
- ConstraintDescription: Must start with letter, alphanumeric and underscores only
-
- DBPort:
- Type: Number
- Description: Database port
- Default: 5432
- MinValue: 1024
- MaxValue: 65535
-
- MaxConnections:
- Type: Number
- Description: Maximum database connections
- Default: 100
- MinValue: 10
- MaxValue: 65535
+ Resources:
+ DatabasePasswordParameter:
+ Type: AWS::SSM::Parameter
+ Properties:
+ Name: !Sub "/${AWS::StackName}/database/password"
+ Type: SecureString
+ Value: !Ref DatabasePassword
+ Description: Database master password
+ KmsKeyId: !Ref EncryptionKey
- EnvironmentName:
- Type: String
- Description: Deployment environment
- Default: dev
- AllowedValues:
- - dev
- - staging
- - production
- ConstraintDescription: Must be dev, staging, or production
+ # Reference in other resources
+ DatabaseInstance:
+ Type: AWS::RDS::DBInstance
+ Properties:
+ MasterUsername: admin
+ MasterUserPassword: !Ref DatabasePasswordParameter
```
- ## Outputs and Secure Cross-Stack References
+ ### 7. Create Secure Outputs
- ### Export with Naming Convention
+ Export only non-sensitive values from stacks:
```yaml
Outputs:
- # Export for cross-stack references
- VPCIdExport:
- Description: VPC ID for network stack
- Value: !Ref VPC
- Export:
- Name: !Sub "${AWS::StackName}-VPCId"
-
- ApplicationSecurityGroupIdExport:
- Description: Application security group ID
- Value: !Ref ApplicationSecurityGroup
- Export:
- Name: !Sub "${AWS::StackName}-AppSecurityGroupId"
-
- DatabaseSecurityGroupIdExport:
- Description: Database security group ID
- Value: !Ref DatabaseSecurityGroup
- Export:
- Name: !Sub "${AWS::StackName}-DBSecurityGroupId"
-
- KMSKeyArnExport:
- Description: KMS key ARN for encryption
- Value: !GetAtt ApplicationKmsKey.Arn
+ # Safe to export
+ KMSKeyArn:
+ Description: KMS Key ARN for encryption
+ Value: !GetAtt EncryptionKey.Arn
Export:
Name: !Sub "${AWS::StackName}-KMSKeyArn"
- DatabaseSecretArnExport:
- Description: Database secret ARN
+ SecretArn:
+ Description: Secret ARN (not the secret value)
Value: !Ref DatabaseSecret
Export:
- Name: !Sub "${AWS::StackName}-DatabaseSecretArn"
-
- SSLCertificateArnExport:
- Description: SSL certificate ARN
- Value: !Ref SSLCertificate
- Export:
- Name: !Sub "${AWS::StackName}-SSLCertificateArn"
- ```
-
- ### Import from Network Stack
-
- ```yaml
- Parameters:
- NetworkStackName:
- Type: String
- Description: Name of the network stack
-
- Resources:
- # Import values from network stack
- VPCId:
- Type: AWS::EC2::VPC
- Properties:
- CidrBlock: !Select [0, !Split [",", !ImportValue !Sub "${NetworkStackName}-VPCcidrs"]]
+ Name: !Sub "${AWS::StackName}-SecretArn"
- ApplicationSecurityGroup:
- Type: AWS::EC2::SecurityGroup
- Properties:
- GroupName: !Sub "${AWS::StackName}-app-sg"
- VpcId: !ImportValue !Sub "${NetworkStackName}-VPCId"
- SecurityGroupIngress:
- - IpProtocol: tcp
- FromPort: 80
- ToPort: 80
- SourceSecurityGroupId: !ImportValue !Sub "${NetworkStackName}-ALBSecurityGroupId"
+ # DO NOT export sensitive data
+ # Incorrect:
+ # SecretValue:
+ # Value: !GetAtt DatabaseSecret.SecretString
```
- ## CloudWatch Logs Encryption
+ ### 8. Encrypt CloudWatch Logs
- ### Log Group with KMS Encryption
+ Enable encryption for log groups:
```yaml
Resources:
- # Encrypted CloudWatch Log Group
EncryptedLogGroup:
Type: AWS::Logs::LogGroup
Properties:
- LogGroupName: !Sub "/aws/lambda/${AWS::StackName}-function"
+ LogGroupName: !Sub "/aws/applications/${ApplicationName}"
RetentionInDays: 30
- KmsKeyId: !Ref ApplicationKmsKey
-
- # Data protection policy
- LogGroupClass: STANDARD
-
- Tags:
- - Key: Environment
- Value: !Ref Environment
- - Key: Encrypted
- Value: "true"
-
- # Metric Filter for security events
- SecurityEventMetricFilter:
- Type: AWS::Logs::MetricFilter
- Properties:
- LogGroupName: !Ref EncryptedLogGroup
- FilterPattern: '[ERROR, WARNING, "Access Denied", "Unauthorized"]'
- MetricTransformations:
- - MetricValue: "1"
- MetricNamespace: !Sub "${AWS::StackName}/Security"
- MetricName: SecurityEvents
-
- # Alarm for security errors
- SecurityAlarm:
- Type: AWS::CloudWatch::Alarm
- Properties:
- AlarmName: !Sub "${AWS::StackName}-security-errors"
- AlarmDescription: Alert on security-related errors
- MetricName: SecurityEvents
- Namespace: !Sub "${AWS::StackName}/Security"
- Statistic: Sum
- Period: 60
- EvaluationPeriods: 5
- Threshold: 1
- ComparisonOperator: GreaterThanThreshold
- AlarmActions:
- - !Ref SecurityAlertTopic
-
- # SNS Topic for security alerts
- SecurityAlertTopic:
- Type: AWS::SNS::Topic
- Properties:
- TopicName: !Sub "${AWS::StackName}-security-alerts"
- ```
-
- ## Defense in Depth
-
- ### Stack with Multiple Security Layers
-
- ```yaml
- AWSTemplateFormatVersion: 2010-09-09
- Description: Defense in depth security architecture
-
- Resources:
- # Layer 1: Network Security - Security Groups
- WebTierSecurityGroup:
- Type: AWS::EC2::SecurityGroup
- Properties:
- GroupDescription: "Web tier security group"
- VpcId: !Ref VPCId
- SecurityGroupIngress:
- - IpProtocol: tcp
- FromPort: 443
- ToPort: 443
- CidrIp: 0.0.0.0/0
- Description: "HTTPS from internet"
-
- AppTierSecurityGroup:
- Type: AWS::EC2::SecurityGroup
- Properties:
- GroupDescription: "App tier security group"
- VpcId: !Ref VPCId
- SecurityGroupIngress:
- - IpProtocol: tcp
- FromPort: 8080
- ToPort: 8080
- SourceSecurityGroupId: !Ref WebTierSecurityGroup
-
- # Layer 2: Encryption - KMS
- DataEncryptionKey:
- Type: AWS::KMS::Key
- Properties:
- Description: "Data encryption key"
- KeyPolicy:
- Version: "2012-10-17"
- Statement:
- - Sid: "EnableIAMPoliciesForKeyManagement"
- Effect: Allow
- Principal:
- AWS: !Sub "arn:aws:iam::${AWS::AccountId}:role/AdminRole"
- Action: kms:*
- Resource: "*"
- - Sid: "AllowEncryptionOperations"
- Effect: Allow
- Principal:
- AWS: !Sub "arn:aws:iam::${AWS::AccountId}:role/AppRole"
- Action:
- - kms:Encrypt
- - kms:Decrypt
- Resource: "*"
-
- # Layer 3: Secrets Management
- ApplicationSecret:
- Type: AWS::SecretsManager::Secret
- Properties:
- Name: !Sub "${AWS::StackName}/application/credentials"
- SecretString: "{}"
- KmsKeyId: !Ref DataEncryptionKey
-
- # Layer 4: IAM Least Privilege
- ApplicationRole:
- Type: AWS::IAM::Role
- Properties:
- RoleName: !Sub "${AWS::StackName}-app-role"
- AssumeRolePolicyDocument:
- Version: "2012-10-17"
- Statement:
- - Effect: Allow
- Principal:
- Service: ecs.amazonaws.com
- Action: sts:AssumeRole
- Policies:
- - PolicyName: MinimalSecretsAccess
- PolicyDocument:
- Version: "2012-10-17"
- Statement:
- - Effect: Allow
- Action:
- - secretsmanager:GetSecretValue
- Resource: !Ref ApplicationSecret
-
- # Layer 5: Logging and Monitoring
- AuditLogGroup:
- Type: AWS::Logs::LogGroup
- Properties:
- LogGroupName: !Sub "/aws/${AWS::StackName}/audit"
- RetentionInDays: 365
- KmsKeyId: !Ref DataEncryptionKey
-
- # Layer 6: WAF for API protection
- WebACL:
- Type: AWS::WAFv2::WebACL
- Properties:
- Name: !Sub "${AWS::StackName}-waf"
- Scope: REGIONAL
- DefaultAction:
- Allow:
- CustomRequestHandling:
- InsertHeaders:
- - Name: X-Frame-Options
- Value: DENY
- Rules:
- - Name: BlockSQLInjection
- Priority: 1
- Statement:
- SqliMatchStatement:
- FieldToMatch:
- Body:
- OversizeHandling: CONTINUE
- SensitivityLevel: HIGH
- Action:
- Block:
- CustomResponse:
- ResponseCode: 403
- ResponseBody: "Request blocked due to SQL injection"
- VisibilityConfig:
- SampledRequestsEnabled: true
- CloudWatchMetricsEnabled: true
- MetricName: BlockSQLInjection
-
- - Name: BlockXSS
- Priority: 2
- Statement:
- XssMatchStatement:
- FieldToMatch:
- QueryString:
- OversizeHandling: CONTINUE
- Action:
- Block:
- VisibilityConfig:
- SampledRequestsEnabled: true
- CloudWatchMetricsEnabled: true
- MetricName: BlockXSS
-
- - Name: RateLimit
- Priority: 3
- Statement:
- RateBasedStatement:
- Limit: 2000
- EvaluationWindowSec: 60
- Action:
- Block:
- CustomResponse:
- ResponseCode: 429
- ResponseBody: "Too many requests"
- VisibilityConfig:
- SampledRequestsEnabled: true
- CloudWatchMetricsEnabled: true
- MetricName: RateLimit
-
- VisibilityConfig:
- CloudWatchMetricsEnabled: true
- MetricName: !Sub "${AWS::StackName}-WebACL"
- SampledRequestsEnabled: true
+ KmsKeyId: !Ref EncryptionKey
```
## Best Practices
- ### Encryption
- - Always use KMS with customer-managed keys for sensitive data
- - Enable automatic key rotation (max 365 days)
- - Use S3 bucket keys to reduce KMS costs
- - Encrypt CloudWatch Logs with KMS
- - Implement envelope encryption for large data
-
- ### Secrets Management
- - Use Secrets Manager for automatic rotation
- - Reference secrets via ARN, not hard-coded
- - Use resource-based policies for granular access
- - Implement encryption context for auditing
- - Limit access with IAM conditions
-
- ### IAM Security
- - Apply least privilege in all policies
- - Use permissions boundaries to limit escalation
- - Enable MFA for administrative roles
- - Implement condition keys for region/endpoint
- - Regular audit with IAM Access Analyzer
-
- ### Network Security
- - Security groups with minimal rules
- - Deny default outbound where possible
- - Use VPC endpoints for AWS services
- - Implement private subnets for backend tiers
- - Use Network ACLs as additional layer
-
- ### TLS/SSL
- - Use ACM for managed certificates
- - Enforce HTTPS with resource policies
- - Configure minimum TLS 1.2
- - Use HSTS headers
- - Renew certificates before expiration
-
- ### Monitoring
- - Enable CloudTrail for audit trail
- - Create metrics for security events
- - Configure alarms for suspicious activity
- - Appropriate log retention (min 90 days)
- - Use GuardDuty for threat detection
-
- ## Related Resources
-
- - [AWS KMS Documentation](https://docs.aws.amazon.com/kms/latest/developerguide/)
- - [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/)
- - [IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
- - [Security Groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
- - [AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html)
-
- ## Additional Files
-
- For complete details on resources and their properties, see:
- - [REFERENCE.md](references/reference.md) - Detailed reference guide for all CloudFormation security resources
- - [EXAMPLES.md](references/examples.md) - Complete production-ready examples for security scenarios
-
- ## CloudFormation Stack Management Best Practices
-
- ### Stack Policies
-
- Stack Policies prevent accidental updates to critical infrastructure resources. Use them to protect production resources from unintended modifications.
-
- ```yaml
- Resources:
- ProductionStackPolicy:
- Type: AWS::CloudFormation::Stack
- Properties:
- TemplateURL: !Sub "https://${BucketName}.s3.amazonaws.com/production-stack.yaml"
- StackPolicyBody:
- Version: "2012-10-17"
- Statement:
- - Effect: Allow
- Action: Update:*
- Principal: "*"
- Resource: "*"
- - Effect: Deny
- Action:
- - Update:Replace
- - Update:Delete
- Principal: "*"
- Resource:
- - LogicalResourceId/ProductionDatabase
- - LogicalResourceId/ProductionKmsKey
- Condition:
- StringEquals:
- aws:RequestedRegion:
- - us-east-1
- - us-west-2
-
- # Inline stack policy for sensitive resources
- SensitiveResourcesPolicy:
- Type: AWS::CloudFormation::StackPolicy
- Properties:
- PolicyDocument:
- Version: "2012-10-17"
- Statement:
- - Effect: Deny
- Action: Update:*
- Principal: "*"
- Resource: "*"
- Condition:
- StringEquals:
- aws:ResourceTag/Environment: production
- Not:
- StringEquals:
- aws:username: security-admin
- ```
-
- ### Termination Protection
-
- Enable termination protection to prevent accidental deletion of production stacks. This adds a safety layer for critical infrastructure.
-
- ```yaml
- Resources:
- # Production stack with termination protection
- ProductionDatabaseStack:
- Type: AWS::CloudFormation::Stack
- Properties:
- TemplateURL: !Sub "https://${BucketName}.s3.amazonaws.com/database.yaml"
- TerminationProtection: true
- Parameters:
- Environment: production
- InstanceClass: db.r6g.xlarge
- MultiAZ: true
-
- # Stack with conditional termination protection
- ApplicationStack:
- Type: AWS::CloudFormation::Stack
- Properties:
- TemplateURL: !Sub "https://${BucketName}.s3.amazonaws.com/application.yaml"
- TerminationProtection: !If [IsProduction, true, false]
- Parameters:
- Environment: !Ref Environment
- ```
-
- ### Drift Detection
-
- Detect configuration drift in your CloudFormation stacks to identify unauthorized or unexpected changes.
-
- ```yaml
- Resources:
- # Custom resource for drift detection
- DriftDetectionFunction:
- Type: AWS::Lambda::Function
- Properties:
- FunctionName: !Sub "${AWS::StackName}-drift-detector"
- Runtime: python3.11
- Handler: drift_detector.handler
- Role: !GetAtt DriftDetectionRole.Arn
- Code:
- S3Bucket: !Ref CodeBucket
- S3Key: lambda/drift-detector.zip
- Environment:
- Variables:
- STACK_NAME: !Ref StackName
- SNS_TOPIC_ARN: !Ref DriftAlertTopic
- Timeout: 300
-
- # Scheduled drift detection
- DriftDetectionSchedule:
- Type: AWS::Events::Rule
- Properties:
- Name: !Sub "${AWS::StackName}-drift-schedule"
- ScheduleExpression: rate(1 day)
- State: ENABLED
- Targets:
- - Arn: !GetAtt DriftDetectionFunction.Arn
- Id: DriftDetectionFunction
-
- # Permission for EventBridge to invoke Lambda
- DriftDetectionPermission:
- Type: AWS::Lambda::Permission
- Properties:
- FunctionName: !Ref DriftDetectionFunction
- Action: lambda:InvokeFunction
- Principal: events.amazonaws.com
- SourceArn: !GetAtt DriftDetectionSchedule.Arn
-
- # SNS topic for drift alerts
- DriftAlertTopic:
- Type: AWS::SNS::Topic
- Properties:
- TopicName: !Sub "${AWS::StackName}-drift-alerts"
- ```
-
- ### Drift Detection Python Handler
-
- ```python
- import boto3
- import json
-
- def handler(event, context):
- cloudformation = boto3.client('cloudformation')
- sns = boto3.client('sns')
-
- stack_name = event.get('STACK_NAME', 'my-production-stack')
- topic_arn = event.get('SNS_TOPIC_ARN')
-
- # Detect drift
- response = cloudformation.detect_stack_drift(StackName=stack_name)
-
- # Wait for drift detection to complete
- import time
- time.sleep(60)
-
- # Get drift status
- drift_status = cloudformation.describe_stack-drift-detection-status(
- StackName=stack_name,
- DetectionId=response['StackDriftDetectionId']
- )
-
- # Get resources with drift
- resources = []
- paginator = cloudformation.get_paginator('list_stack_resources')
- for page in paginator.paginate(StackName=stack_name):
- for resource in page['StackResourceSummaries']:
- if resource['DriftStatus'] != 'IN_SYNC':
- resources.append({
- 'LogicalId': resource['LogicalResourceId'],
- 'PhysicalId': resource['PhysicalResourceId'],
- 'DriftStatus': resource['DriftStatus'],
- 'Expected': resource.get('ExpectedResourceType'),
- 'Actual': resource.get('ActualResourceType')
- })
-
- # Send alert if drift detected
- if resources:
- message = f"Drift detected on stack {stack_name}:\n"
- for r in resources:
- message += f"- {r['LogicalId']}: {r['DriftStatus']}\n"
-
- sns.publish(
- TopicArn=topic_arn,
- Subject=f"CloudFormation Drift Alert: {stack_name}",
- Message=message
- )
-
- return {
- 'statusCode': 200,
- 'body': json.dumps({
- 'drift_status': drift_status['StackDriftStatus'],
- 'resources_with_drift': len(resources)
- })
- }
- ```
-
- ### Change Sets Usage
-
- Use Change Sets to preview and review changes before applying them to production stacks.
-
- ```yaml
- Resources:
- # Change set for stack update
- ChangeSet:
- Type: AWS::CloudFormation::Stack
- Properties:
- TemplateURL: !Sub "https://${BucketName}.s3.amazonaws.com/updated-template.yaml"
- ChangeSetName: !Sub "${AWS::StackName}-update-changeset"
- ChangeSetType: UPDATE
- Parameters:
- Environment: !Ref Environment
- InstanceType: !Ref NewInstanceType
- Capabilities:
- - CAPABILITY_IAM
- - CAPABILITY_NAMED_IAM
-
- # Nested change set for review
- ReviewChangeSet:
- Type: AWS::CloudFormation::Stack
- Properties:
- TemplateURL: !Sub "https://${BucketName}.s3.amazonaws.com/review-template.yaml"
- ChangeSetName: !Sub "${AWS::StackName}-review-changeset"
- ChangeSetType: UPDATE
- Parameters:
- Environment: !Ref Environment
- Tags:
- - Key: ChangeSetType
- Value: review
- - Key: CreatedBy
- Value: CloudFormation
- ```
-
- ### Change Set Generation Script
-
- ```bash
- #!/bin/bash
-
- # Create a change set for review
- aws cloudformation create-change-set \
- --stack-name my-production-stack \
- --change-set-name production-update-changeset \
- --template-url https://my-bucket.s3.amazonaws.com/updated-template.yaml \
- --parameters ParameterKey=Environment,ParameterValue=production \
- --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM
-
- # Wait for change set creation
- aws cloudformation wait change-set-create-complete \
- --stack-name my-production-stack \
- --change-set-name production-update-changeset
-
- # Describe change set to see what will change
- aws cloudformation describe-change-set \
- --stack-name my-production-stack \
- --change-set-name production-update-changeset
-
- # Execute change set if changes look good
- aws cloudformation execute-change-set \
- --stack-name my-production-stack \
- --change-set-name production-update-changeset
- ```
-
- ### Stack Update with Rollback Triggers
-
- ```yaml
- Resources:
- # Production stack with rollback configuration
- ProductionStack:
- Type: AWS::CloudFormation::Stack
- Properties:
- TemplateURL: !Sub "https://${BucketName}.s3.amazonaws.com/production.yaml"
- TimeoutInMinutes: 60
- RollbackConfiguration:
- RollbackTriggers:
- - Arn: !Sub "arn:aws:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:ProductionCPUHigh"
- Type: AWS::CloudWatch::Alarm
- - Arn: !Sub "arn:aws:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:ProductionLatencyHigh"
- Type: AWS::CloudWatch::Alarm
- MonitoringTimeInMinutes: 15
- NotificationARNs:
- - !Ref UpdateNotificationTopic
-
- # CloudWatch alarms for rollback
- ProductionCPUHigh:
- Type: AWS::CloudWatch::Alarm
- Properties:
- AlarmName: !Sub "${AWS::StackName}-CPU-High"
- AlarmDescription: Trigger rollback if CPU exceeds 80%
- MetricName: CPUUtilization
- Namespace: AWS/EC2
- Statistic: Average
- Period: 60
- EvaluationPeriods: 5
- Threshold: 80
- ComparisonOperator: GreaterThanThreshold
- AlarmActions:
- - !Ref UpdateNotificationTopic
-
- # SNS topic for notifications
- UpdateNotificationTopic:
- Type: AWS::SNS::Topic
- Properties:
- TopicName: !Sub "${AWS::StackName}-update-notifications"
- ```
-
- ### Best Practices for Stack Management
-
- 1. **Enable Termination Protection**
- - Always enable for production stacks
- - Use as a safety mechanism against accidental deletion
- - Requires manual disabling before deletion
-
- 2. **Use Stack Policies**
- - Protect critical resources from unintended updates
- - Use Deny statements for production databases, KMS keys, and IAM roles
- - Apply conditions based on region, user, or tags
-
- 3. **Implement Drift Detection**
- - Run drift detection regularly (daily for production)
- - Alert on any drift detection
- - Investigate and remediate drift immediately
-
- 4. **Use Change Sets**
- - Always use Change Sets for production updates
- - Review changes before execution
- - Use descriptive change set names
-
- 5. **Configure Rollback Triggers**
- - Set up CloudWatch alarms for critical metrics
- - Configure monitoring time to allow stabilization
- - Test rollback triggers in non-production first
+ ### KMS Key Management
- 6. **Implement Change Management**
- - Require approval for production changes
- - Use CodePipeline with manual approval gates
- - Document all changes in change log
+ - Use separate keys for different data classifications
+ - Enable automatic key rotation annually
+ - Apply key policies limiting access to specific services
+ - Use customer-managed keys for compliance requirements
+ - Monitor key usage with CloudWatch metrics
+ - Back up key material outside AWS (for customer-managed keys)
- 7. **Use Stack Sets for Multi-Account**
- - Deploy infrastructure consistently across accounts
- - Use StackSets for organization-wide policies
- - Implement drift detection at organization level
+ ### Secrets Management
- ## Constraints and Warnings
+ - Rotate secrets automatically (every 30 days for databases)
+ - Use Secrets Manager for credentials, API keys, and certificates
+ - Apply least privilege access to secrets
+ - Enable CloudTrail logging for secret access
+ - Use IAM policies to control secret access
+ - Never store secrets in plain text or in code
- ### Resource Limits
+ ### IAM Security
- - **Security Group Rules**: Maximum 60 inbound and 60 outbound rules per security group
- - **Security Groups**: Maximum 500 security groups per VPC
- - **NACL Rules**: Maximum 20 inbound and 20 outbound rules per NACL per subnet
- - **VPC Limits**: Maximum 5 VPCs per region (soft limit, can be increased)
+ - Apply least privilege: grant only necessary permissions
+ - Use IAM roles for applications, not access keys
+ - Rotate IAM credentials regularly
+ - Enable MFA for root account and IAM users
+ - Use IAM Access Analyzer for permission auditing
+ - Implement permission boundaries for delegated administration
- ### Security Constraints
+ ### Network Security
- - **Default Security Groups**: Default security groups cannot be deleted
- - **Security Group References**: Security group references cannot span VPC peering in some cases
- - **NACL Stateless**: NACLs are stateless; return traffic must be explicitly allowed
- - **Flow Logs**: VPC Flow Logs generate significant CloudWatch Logs costs
+ - Use security groups as primary network control
+ - Apply NACLs for subnet-level traffic control
+ - Implement defense in depth with multiple layers
+ - Use VPC endpoints for private AWS service access
+ - Enable VPC Flow Logs for network monitoring
+ - Restrict security group rules to specific CIDR ranges
- ### Operational Constraints
+ ### Certificate Management
- - **CIDR Overlap**: VPC CIDR blocks cannot overlap with peered VPCs or on-prem networks
- - **ENI Limits**: Each instance type has maximum ENI limits; affects scaling
- - **Elastic IP Limits**: Each account has limited number of Elastic IPs
- - **NAT Gateway Limits**: Each AZ can have only one NAT gateway per subnet
+ - Use ACM for certificate lifecycle management
+ - Enable automatic certificate renewal
+ - Request certificates well before deployment deadlines
+ - Use DNS validation for faster certificate provisioning
+ - Monitor certificate expiration with CloudWatch alarms
+ - Implement certificate rotation for services
- ### Network Constraints
+ ### Data Encryption
- - **Transit Gateway**: Transit Gateway attachments have per-AZ and per-account limits
- - **VPN Connections**: VPN connections have bandwidth limitations
- - **Direct Connect**: Direct Connect requires physical infrastructure and lead time
- - **PrivateLink**: VPC Endpoint services have availability constraints
+ - Encrypt data at rest and in transit
+ - Use AWS-managed keys for standard encryption
+ - Use customer-managed keys for compliance requirements
+ - Enable SSL/TLS for all network communications
+ - Use S3 bucket policies for encrypted data access
+ - Implement encryption in transit with TLS 1.2+
- ### Cost Considerations
+ ## References
- - **NAT Gateway**: NAT gateways incur hourly costs plus data processing costs
- - **Traffic Mirroring**: Traffic mirroring doubles data transfer costs
- - **Flow Logs**: Flow logs storage and analysis add significant costs
- - **PrivateLink**: Interface VPC endpoints incur hourly and data processing costs
+ For detailed implementation guidance, see:
- ### Access Control Constraints
+ - **[constraints.md](references/constraints.md)** - Resource limits (security group rules, VPC limits, NACL rules), security constraints (default security groups, VPC peering, NACL stateless behavior), operational constraints (CIDR overlap, ENI limits, Elastic IP limits), network constraints (Transit Gateway, VPN, Direct Connect), cost considerations (NAT Gateway, traffic mirroring, flow logs, PrivateLink), and access control constraints (IAM vs resource policies, permission boundaries, session policies)
- - **IAM vs Resource Policies**: Some services require both IAM and resource-based policies
- - **SCP Limits**: Service Control Policies have character limits and complexity constraints
- - **Permission Boundaries**: Permission boundaries do not limit service actions
- - **Session Policies**: Session policies cannot grant more permissions than IAM policies
+ ## Related Resources
- ## Additional Files
+ - [AWS KMS Documentation](https://docs.aws.amazon.com/kms/)
+ - [AWS Secrets Manager Documentation](https://docs.aws.amazon.com/secretsmanager/)
+ - [AWS IAM Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/)
+ - [VPC Security Documentation](https://docs.aws.amazon.com/vpc/)
+ - [ACM Certificate Documentation](https://docs.aws.amazon.com/acm/)
+ - [CloudFormation Security Best Practices](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html)
+ - [AWS Security Hub Documentation](https://docs.aws.amazon.com/securityhub/)