// terraform-aws-security-baseline

Executive Summary

This module establishes a production-grade security baseline for AWS accounts. It enables and configures eight core security services: GuardDuty for threat detection (S3, EKS, malware), Security Hub for centralized findings with CIS and FSBP standards, AWS Config for resource compliance, CloudTrail for API audit logging with KMS encryption and CloudWatch integration, Macie for sensitive data discovery, IAM Access Analyzer for external access detection, Detective for investigation, and IAM password policy enforcement. All services are toggleable and every resource follows consistent naming and tagging.

Overview

Architecture Diagram

Component Breakdown

Data Flow

All security services feed findings into Security Hub for centralized visibility. CloudTrail logs are encrypted with KMS and stored in both CloudWatch and S3. Config compliance results feed into Security Hub standards checks.

Security Controls

Industry Adaptation

Production Readiness Checklist

• Create dedicated S3 buckets for Config and CloudTrail delivery before applying
• Enable all security services (defaults are true except Detective)
• Set access_analyzer_type = "ORGANIZATION" for org-wide analysis
• Enable cloudtrail_enable_insights for anomaly detection
• Review Security Hub findings weekly and remediate critical items
• Deploy iam-baseline sub-module for break-glass user and audit roles
• Deploy scp-baseline for service control policy guardrails
• Enable Detective for investigation capabilities
• Configure SNS notifications for Config changes
• Set up CloudWatch alarms for CIS metric filters

Configuration Reference

Required Variables

Key Optional Variables

Deployment

module "security_baseline" {
  source = "kogunlowo123/security-baseline/aws"

  name_prefix               = "myapp"
  config_delivery_s3_bucket = "myapp-config-bucket"
  cloudtrail_s3_bucket_name = "myapp-cloudtrail-bucket"

  tags = {
    Project   = "security-baseline"
    ManagedBy = "terraform"
  }
}

Links