aws-cloudformation-security

AWS CloudFormation Security Infrastructure

Overview

Create production-ready security infrastructure using AWS CloudFormation templates. This skill covers KMS encryption, Secrets Manager, IAM security with least privilege, VPC security configurations, ACM certificates, parameter security, secure outputs, cross-stack references, CloudWatch Logs encryption, defense in depth strategies, and security best practices.

When to Use

• Implementing KMS encryption at rest and in transit
• Managing secrets with Secrets Manager and automatic rotation
• Applying IAM least privilege policies and permission boundaries
• Securing VPC with security groups, NACLs, and VPC endpoints
• Managing TLS/SSL certificates with ACM
• Encrypting CloudWatch Logs and S3 buckets
• Creating secure cross-stack references and outputs

Instructions

Follow these steps to create security infrastructure with CloudFormation:

1. Define KMS Encryption Keys

Create customer-managed keys for encryption:

Resources:
  EncryptionKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Customer-managed key for data encryption
      KeyPolicy:
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:GenerateDataKey
            Resource: "*"
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action:
              - kms:*
            Resource: "*"

  KeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub "${AWS::StackName}/encryption-key"
      TargetKeyId: !Ref EncryptionKey

Validate: aws kms get-key-policy --key-id <key-id> --output text

2. Manage Secrets with Secrets Manager

Store and retrieve sensitive data securely:

Resources:
  DatabaseSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub "${AWS::StackName}/database"
      Description: Database credentials
      SecretString: !Sub |
        {
          "username": "admin",
          "password": "${DatabasePassword}",
          "engine": "mysql",
          "host": "${DatabaseEndpoint}",
          "port": 3306
        }
      KmsKeyId: !Ref EncryptionKey

  SecretRotationSchedule:
    Type: AWS::SecretsManager::RotationSchedule
    Properties:
      SecretId: !Ref DatabaseSecret
      RotationLambdaARN: !Ref RotationLambda.Arn
      RotationRules:
        AutomaticallyAfterDays: 30