aws-cloudformation-security · git:20260323.935227a · 2026-03-23 · sha256 03c25c56a4926910
aws-cloudformation-security git:20260323.935227aA

Name: aws-cloudformation-security
Author: giuseppe-trisciuoglio
Immutable. This exact content is served forever at /api/v1/blob/03c25c56a4926910.
---
name: aws-cloudformation-security
description: Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure cross-stack references. Use when implementing security best practices, encrypting data, managing secrets, applying least privilege IAM policies, securing VPC configurations, managing TLS/SSL certificates, and implementing defense in depth strategies.
allowed-tools: Read, Write, Bash
---

# AWS CloudFormation Security Infrastructure

## Overview

Create production-ready security infrastructure using AWS CloudFormation templates. This skill covers KMS encryption, Secrets Manager, IAM security with least privilege, VPC security configurations, ACM certificates, parameter security, secure outputs, cross-stack references, CloudWatch Logs encryption, defense in depth strategies, and security best practices.

## When to Use

Use this skill when:
- Implementing AWS KMS for encryption at rest and in transit
- Managing secrets with AWS Secrets Manager
- Applying IAM least privilege policies and roles
- Securing VPC configurations with security groups and NACLs
- Managing TLS/SSL certificates with ACM
- Implementing secure parameter handling in CloudFormation
- Creating secure cross-stack references and outputs
- Encrypting CloudWatch Logs for compliance
- Implementing defense in depth strategies
- Applying security best practices across AWS resources

## Instructions

Follow these steps to create security infrastructure with CloudFormation:

### 1. Define KMS Encryption Keys

Create customer-managed keys for encryption:

```yaml
Resources:
  EncryptionKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Customer-managed key for data encryption
      KeyPolicy:
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:GenerateDataKey
            Resource: "*"
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action:
              - kms:*
            Resource: "*"

  KeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub "${AWS::StackName}/encryption-key"
      TargetKeyId: !Ref EncryptionKey
```

### 2. Manage Secrets with Secrets Manager

Store and retrieve sensitive data securely:

```yaml
Resources:
  DatabaseSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub "${AWS::StackName}/database"
      Description: Database credentials
      SecretString: !Sub |
        {
          "username": "admin",
          "password": "${DatabasePassword}",
          "engine": "mysql",
          "host": "${DatabaseEndpoint}",
          "port": 3306
        }
      KmsKeyId: !Ref EncryptionKey

  SecretRotationSchedule:
    Type: AWS::SecretsManager::RotationSchedule
    Properties:
      SecretId: !Ref DatabaseSecret
      RotationLambdaARN: !Ref RotationLambda.Arn
      RotationRules:
        AutomaticallyAfterDays: 30
```

### 3. Apply IAM Least Privilege

Create roles and policies with minimal required permissions:

```yaml
Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: SpecificPermissions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource: !Sub "${DataBucket.Arn}/*"
```

### 4. Secure VPC Configuration

Implement network security with security groups and NACLs:

```yaml
Resources:
  ApplicationSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Application security group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0

  ApplicationNACL:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref VPC

  NACLEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref ApplicationNACL
      RuleNumber: 100
      Protocol: "6"
      RuleAction: allow
      Egress: false
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: 443
        To: 443
```

### 5. Request ACM Certificates

Manage TLS/SSL certificates for secure communication:

```yaml
Resources:
  Certificate:
    Type: AWS::ACM::Certificate
    Properties:
      DomainName: !Ref DomainName
      SubjectAlternativeNames:
        - !Sub "www.${DomainName}"
        - !Sub "api.${DomainName}"
      DomainValidationOptions:
        - DomainName: !Ref DomainName
          ValidationDomain: !Ref DomainName
      Tags:
        - Key: Environment
          Value: !Ref Environment

  # DNS validation record
  DnsValidationRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName: !Ref HostedZone
      Name: !Sub "_${DomainName}."
      Type: CNAME
      TTL: 300
      ResourceRecords:
        - !Ref Certificate
```

### 6. Implement Secure Parameters

Use SecureString for sensitive parameter values:

```yaml
Resources:
  DatabasePasswordParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/${AWS::StackName}/database/password"
      Type: SecureString
      Value: !Ref DatabasePassword
      Description: Database master password
      KmsKeyId: !Ref EncryptionKey

  # Reference in other resources
  DatabaseInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      MasterUsername: admin
      MasterUserPassword: !Ref DatabasePasswordParameter
```

### 7. Create Secure Outputs

Export only non-sensitive values from stacks:

```yaml
Outputs:
  # Safe to export
  KMSKeyArn:
    Description: KMS Key ARN for encryption
    Value: !GetAtt EncryptionKey.Arn
    Export:
      Name: !Sub "${AWS::StackName}-KMSKeyArn"

  SecretArn:
    Description: Secret ARN (not the secret value)
    Value: !Ref DatabaseSecret
    Export:
      Name: !Sub "${AWS::StackName}-SecretArn"

  # DO NOT export sensitive data
  # Incorrect:
  # SecretValue:
  #   Value: !GetAtt DatabaseSecret.SecretString
```

### 8. Encrypt CloudWatch Logs

Enable encryption for log groups:

```yaml
Resources:
  EncryptedLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/applications/${ApplicationName}"
      RetentionInDays: 30
      KmsKeyId: !Ref EncryptionKey
```

## Best Practices

### KMS Key Management

- Use separate keys for different data classifications
- Enable automatic key rotation annually
- Apply key policies limiting access to specific services
- Use customer-managed keys for compliance requirements
- Monitor key usage with CloudWatch metrics
- Back up key material outside AWS (for customer-managed keys)

### Secrets Management

- Rotate secrets automatically (every 30 days for databases)
- Use Secrets Manager for credentials, API keys, and certificates
- Apply least privilege access to secrets
- Enable CloudTrail logging for secret access
- Use IAM policies to control secret access
- Never store secrets in plain text or in code

### IAM Security

- Apply least privilege: grant only necessary permissions
- Use IAM roles for applications, not access keys
- Rotate IAM credentials regularly
- Enable MFA for root account and IAM users
- Use IAM Access Analyzer for permission auditing
- Implement permission boundaries for delegated administration

### Network Security

- Use security groups as primary network control
- Apply NACLs for subnet-level traffic control
- Implement defense in depth with multiple layers
- Use VPC endpoints for private AWS service access
- Enable VPC Flow Logs for network monitoring
- Restrict security group rules to specific CIDR ranges

### Certificate Management

- Use ACM for certificate lifecycle management
- Enable automatic certificate renewal
- Request certificates well before deployment deadlines
- Use DNS validation for faster certificate provisioning
- Monitor certificate expiration with CloudWatch alarms
- Implement certificate rotation for services

### Data Encryption

- Encrypt data at rest and in transit
- Use AWS-managed keys for standard encryption
- Use customer-managed keys for compliance requirements
- Enable SSL/TLS for all network communications
- Use S3 bucket policies for encrypted data access
- Implement encryption in transit with TLS 1.2+

## References

For detailed implementation guidance, see:

- **[constraints.md](references/constraints.md)** - Resource limits (security group rules, VPC limits, NACL rules), security constraints (default security groups, VPC peering, NACL stateless behavior), operational constraints (CIDR overlap, ENI limits, Elastic IP limits), network constraints (Transit Gateway, VPN, Direct Connect), cost considerations (NAT Gateway, traffic mirroring, flow logs, PrivateLink), and access control constraints (IAM vs resource policies, permission boundaries, session policies)

## Related Resources

- [AWS KMS Documentation](https://docs.aws.amazon.com/kms/)
- [AWS Secrets Manager Documentation](https://docs.aws.amazon.com/secretsmanager/)
- [AWS IAM Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/)
- [VPC Security Documentation](https://docs.aws.amazon.com/vpc/)
- [ACM Certificate Documentation](https://docs.aws.amazon.com/acm/)
- [CloudFormation Security Best Practices](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html)
- [AWS Security Hub Documentation](https://docs.aws.amazon.com/securityhub/)