Skip to content

Commit e63e7d0

Browse files
ostermanosterman
authored
Merge branch 'master' into osterman/fix-version-selector
2 parents 7d6449e + 0b2c212 commit e63e7d0

21 files changed

Lines changed: 3695 additions & 270 deletions

‎blog/2025-12-18-security-compliance-components.mdx‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
title: "Comprehensive Security and Compliance Components for AWS Organizations"
3+
slug: security-compliance-components
4+
authors: [cloudposse]
5+
tags: [security, compliance, aws, components, guardduty, security-hub, inspector, macie]
6+
date: 2025-12-18
7+
---
8+
9+
import Intro from '@site/src/components/Intro';
10+
import Steps from '@site/src/components/Steps';
11+
12+
<Intro>
13+
We're excited to announce comprehensive documentation for our suite of security and compliance Terraform components.
14+
These components enable you to deploy AWS security services across your entire AWS Organization using the delegated
15+
administrator pattern, providing centralized security monitoring and compliance assessment.
16+
</Intro>
17+
18+
Hello SweetOps!
19+
20+
Security and compliance are critical for any organization running workloads on AWS.
21+
Whether you're pursuing SOC2, HIPAA, PCI DSS, FedRAMP, or CIS benchmarks, you need comprehensive visibility into threats,
22+
vulnerabilities, and configuration drift across all your accounts.
23+
24+
We've updated and documented our security and compliance components to make deploying these services straightforward and
25+
maintainable at scale.
26+
27+
## What's Included
28+
29+
Our security and compliance framework includes 9 Terraform components:
30+
31+
| Component | Purpose |
32+
|-----------|---------|
33+
| [AWS Config](/layers/security-and-compliance/aws-config/) | Configuration compliance and resource inventory |
34+
| [AWS CloudTrail](/layers/security-and-compliance/aws-cloudtrail/) | API activity logging and audit trail |
35+
| [AWS GuardDuty](/layers/security-and-compliance/aws-guardduty/) | Intelligent threat detection |
36+
| [AWS Security Hub](/layers/security-and-compliance/aws-security-hub/) | Centralized security findings aggregation |
37+
| [AWS Inspector 2](/layers/security-and-compliance/aws-inspector2/) | Automated vulnerability scanning |
38+
| [Amazon Macie](/layers/security-and-compliance/aws-macie/) | Sensitive data discovery in S3 |
39+
| [IAM Access Analyzer](/layers/security-and-compliance/aws-access-analyzer/) | External and unused access detection |
40+
| [AWS Shield](/layers/security-and-compliance/aws-shield/) | DDoS protection |
41+
| [AWS Audit Manager](/layers/security-and-compliance/aws-audit-manager/) | Compliance evidence collection |
42+
43+
## Key Architecture Decisions
44+
45+
Our approach uses the **delegated administrator** pattern, centralizing security management while maintaining proper separation of concerns:
46+
47+
<Steps>
48+
- **Security Account**: Acts as the delegated administrator for threat detection and security monitoring services
49+
- **Audit Account**: Stores immutable logs (CloudTrail) and configuration snapshots (Config)
50+
- **Root Account**: Delegates administration but doesn't manage day-to-day security operations
51+
- **Member Accounts**: Automatically enrolled and monitored by the security account
52+
</Steps>
53+
54+
## Deployment Models
55+
56+
Different AWS services require different deployment approaches. We've documented each pattern:
57+
58+
### 3-Step Delegated Administrator
59+
Used by GuardDuty, Security Hub, and Macie:
60+
1. Deploy to security account (creates the service)
61+
2. Deploy to root account (delegates administration)
62+
3. Deploy org settings to security account (configures organization-wide settings)
63+
64+
### 2-Step Delegated Administrator
65+
Used by Inspector and Access Analyzer:
66+
1. Deploy to root account (delegates administration)
67+
2. Deploy org settings to security account
68+
69+
### Per-Account Deployment
70+
Used by Config and CloudTrail, with central aggregation in security/audit accounts.
71+
72+
### Per-Resource Deployment
73+
Used by Shield Advanced for protecting specific resources like ALBs, CloudFront distributions, and Route53 hosted zones.
74+
75+
## Compliance Framework Support
76+
77+
These components support multiple compliance frameworks out of the box:
78+
79+
- **CIS AWS Foundations Benchmark** (v1.4, v1.5)
80+
- **AWS Foundational Security Best Practices**
81+
- **PCI DSS** (Payment Card Industry)
82+
- **HIPAA** (Healthcare)
83+
- **SOC 2** (Service Organization Control)
84+
- **NIST 800-53** (Federal)
85+
- **FedRAMP** (Federal Risk and Authorization)
86+
- **CMMC** (Cybersecurity Maturity Model Certification)
87+
88+
## Getting Started
89+
90+
We've created comprehensive documentation to help you deploy these components:
91+
92+
1. **[Security and Compliance Overview](/layers/security-and-compliance/)** - Architecture and component descriptions
93+
2. **[Setup Guide](/layers/security-and-compliance/setup/)** - Step-by-step deployment instructions
94+
3. **[FAQ](/layers/security-and-compliance/faq/)** - Common issues and troubleshooting
95+
96+
Each component also has its own detailed documentation page with stack configurations, deployment commands, and key variables.
97+
98+
## Component Repositories
99+
100+
All components are available in the [`cloudposse-terraform-components`](https://github.com/cloudposse-terraform-components) GitHub organization:
101+
102+
- [aws-config](https://github.com/cloudposse-terraform-components/aws-config)
103+
- [aws-cloudtrail](https://github.com/cloudposse-terraform-components/aws-cloudtrail)
104+
- [aws-guardduty](https://github.com/cloudposse-terraform-components/aws-guardduty)
105+
- [aws-security-hub](https://github.com/cloudposse-terraform-components/aws-security-hub)
106+
- [aws-inspector2](https://github.com/cloudposse-terraform-components/aws-inspector2)
107+
- [aws-macie](https://github.com/cloudposse-terraform-components/aws-macie)
108+
- [aws-access-analyzer](https://github.com/cloudposse-terraform-components/aws-access-analyzer)
109+
- [aws-shield](https://github.com/cloudposse-terraform-components/aws-shield)
110+
- [aws-audit-manager](https://github.com/cloudposse-terraform-components/aws-audit-manager)
111+
112+
## What's Next
113+
114+
We're continuing to improve our security and compliance components:
115+
116+
- Additional conformance pack templates for common compliance frameworks
117+
- Enhanced integration between services
118+
- More automated remediation patterns via EventBridge
119+
- Expanded documentation for GovCloud deployments
120+
121+
:::tip Need Help?
122+
If you have questions about deploying security and compliance components, reach out in the [SweetOps Slack](https://cloudposse.com/slack)
123+
or check our [FAQ](/layers/security-and-compliance/faq/) for common issues.
124+
:::
125+
126+
We'd love to hear your feedback on these components. Let us know what compliance frameworks you're targeting and how we
127+
can make these components work better for your organization!

‎blog/authors.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,10 @@ Benbentwo:
2323
title: Cloud Posse
2424
url: https://github.com/Benbentwo
2525
image_url: https://github.com/Benbentwo.png
26-
# TODO add your name here
26+
aknysh:
27+
name: Andriy Knysh
28+
title: Principal Architect @ Cloud Posse
29+
url: https://github.com/aknysh
30+
image_url: https://github.com/aknysh.png
31+
32+
# TODO add your name here

‎docs/layers/security-and-compliance/aws-access-analyzer.mdx‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
---
2+
title: AWS IAM Access Analyzer
3+
sidebar_label: AWS Access Analyzer
4+
sidebar_position: 9
5+
description: "Identify external access to resources and unused IAM permissions"
6+
---
7+
import Intro from '@site/src/components/Intro';
8+
import KeyPoints from '@site/src/components/KeyPoints';
9+
import Note from '@site/src/components/Note';
10+
11+
<Intro>
12+
AWS IAM Access Analyzer identifies resources shared with external entities and detects unused IAM permissions,
13+
enabling you to implement least-privilege access and identify unintended access to your resources.
14+
</Intro>
15+
16+
## Overview
17+
18+
Access Analyzer provides:
19+
20+
- **External Access Analysis**: Identifies resources shared with external principals outside your organization
21+
- **Unused Access Analysis**: Detects unused IAM roles, users, and permissions
22+
- **Policy Validation**: Validates IAM policies against best practices
23+
- **Policy Generation**: Generates least-privilege policies based on CloudTrail activity
24+
- **Multi-account Coverage**: Organization-wide analysis from a central account
25+
26+
## Analyzer Types
27+
28+
This component creates two types of organization-wide analyzers:
29+
30+
| Analyzer Type | Purpose | Findings |
31+
|---------------|---------|----------|
32+
| `ORGANIZATION` | External access analysis | Public access, cross-account access, cross-organization access |
33+
| `ORGANIZATION_UNUSED_ACCESS` | Unused access analysis | Unused roles, users, permissions (configurable threshold) |
34+
35+
## Supported Resources
36+
37+
External access analyzer monitors:
38+
39+
- Amazon S3 buckets and access points
40+
- IAM roles and policies
41+
- AWS KMS keys
42+
- AWS Lambda functions and layers
43+
- Amazon SQS queues
44+
- AWS Secrets Manager secrets
45+
- Amazon SNS topics
46+
- Amazon EBS volume snapshots
47+
- Amazon RDS DB snapshots
48+
- Amazon ECR repositories
49+
- Amazon EFS file systems
50+
51+
## Architecture
52+
53+
```mermaid
54+
flowchart LR
55+
subgraph root["Root Account"]
56+
step1["STEP 1: Delegate"]
57+
end
58+
59+
subgraph security["Security Account"]
60+
step2["STEP 2: Create Analyzers"]
61+
dashboard["Access Analyzer Dashboard"]
62+
end
63+
64+
subgraph members["Member Accounts"]
65+
member["Auto-analyzed"]
66+
end
67+
68+
root -->|"Delegation"| security
69+
members -->|"Findings"| dashboard
70+
```
71+
72+
## Deployment
73+
74+
Access Analyzer uses a **2-step delegated administrator** deployment model.
75+
76+
### Step 1: Deploy to Organization Management Account
77+
78+
<Note title="Root Access Required">
79+
This step requires root account access (such as with the `managers` profile).
80+
</Note>
81+
82+
```yaml
83+
# core-gbl-root
84+
components:
85+
terraform:
86+
aws-access-analyzer/root:
87+
metadata:
88+
component: aws-access-analyzer
89+
backend:
90+
s3:
91+
role_arn: null
92+
vars:
93+
enabled: true
94+
delegated_administrator_account_name: core-security
95+
organizations_delegated_administrator_enabled: true
96+
service_linked_role_enabled: true
97+
# Analyzers created in security account
98+
accessanalyzer_organization_enabled: false
99+
accessanalyzer_organization_unused_access_enabled: false
100+
```
101+
102+
```bash
103+
atmos terraform apply aws-access-analyzer/root -s core-gbl-root
104+
```
105+
106+
### Step 2: Deploy Organization Analyzers
107+
108+
```yaml
109+
# core-ue1-security
110+
components:
111+
terraform:
112+
aws-access-analyzer/org-settings:
113+
metadata:
114+
component: aws-access-analyzer
115+
vars:
116+
enabled: true
117+
delegated_administrator_account_name: core-security
118+
environment: ue1
119+
region: us-east-1
120+
# Create organization analyzers
121+
accessanalyzer_organization_enabled: true
122+
accessanalyzer_organization_unused_access_enabled: true
123+
unused_access_age: 30
124+
# Already delegated
125+
organizations_delegated_administrator_enabled: false
126+
```
127+
128+
```bash
129+
atmos terraform apply aws-access-analyzer/org-settings -s core-ue1-security
130+
```
131+
132+
## Multi-Region Deployment
133+
134+
Access Analyzer is a regional service. Deploy analyzers to each region:
135+
136+
```bash
137+
# Delegation (once, globally)
138+
atmos terraform apply aws-access-analyzer/root -s core-gbl-root
139+
140+
# Analyzers per region
141+
atmos terraform apply aws-access-analyzer/org-settings -s core-ue1-security
142+
atmos terraform apply aws-access-analyzer/org-settings -s core-uw2-security
143+
```
144+
145+
## Unused Access Configuration
146+
147+
Configure the threshold for unused access findings:
148+
149+
```yaml
150+
components:
151+
terraform:
152+
aws-access-analyzer/org-settings:
153+
vars:
154+
accessanalyzer_organization_unused_access_enabled: true
155+
# Days without use before generating findings (default: 30)
156+
unused_access_age: 30
157+
```
158+
159+
## Key Variables
160+
161+
| Variable | Description | Default |
162+
|----------|-------------|---------|
163+
| `organizations_delegated_administrator_enabled` | Enable delegation to security account | `false` |
164+
| `service_linked_role_enabled` | Create the service-linked role | `true` |
165+
| `accessanalyzer_organization_enabled` | Enable external access analyzer | `false` |
166+
| `accessanalyzer_organization_unused_access_enabled` | Enable unused access analyzer | `false` |
167+
| `unused_access_age` | Days without use before generating findings | `30` |
168+
169+
## Cost Considerations
170+
171+
- **External Access Analyzer**: No additional charge (included with AWS account)
172+
- **Unused Access Analyzer**: Charged per IAM role or user analyzed per month
173+
174+
## Security Hub Integration
175+
176+
Access Analyzer findings are automatically sent to Security Hub when both services are enabled.
177+
178+
## See Also
179+
180+
- [AWS Security Hub](/layers/security-and-compliance/aws-security-hub/) - Aggregates Access Analyzer findings
181+
- [AWS Config](/layers/security-and-compliance/aws-config/) - Monitors IAM policy configurations
182+
- [Setup Guide](/layers/security-and-compliance/setup/) - Complete deployment instructions
183+
184+
## References
185+
186+
- [AWS IAM Access Analyzer Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html)
187+
- [aws-access-analyzer Component](https://github.com/cloudposse-terraform-components/aws-access-analyzer)
188+
- [Access Analyzer Findings](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-findings.html)
189+
- [Unused Access Analysis](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-unused-access.html)

0 commit comments

Comments
 (0)