Security Baseline

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "TrailRoleiam",
          "To": "CloudTrailcloudtrail",
          "Label": "role"
        },
        {
          "From": "KMSkms",
          "To": "CloudTrailcloudtrail",
          "Label": "encrypt"
        },
        {
          "From": "CloudTrailcloudtrail",
          "To": "AuditLogBuckets3",
          "Label": "logs"
        },
        {
          "From": "CloudWatchcloudwatch",
          "To": "SecurityAlertssns",
          "Label": "alarm"
        },
        {
          "From": "SecretsManagersecretsmanager",
          "To": "KMSkms",
          "Label": "encrypt"
        }
      ]
    }
  },
  "Resources": {
    "WAFwaf": {
      "Type": "AWS::WAFv2::WebACL",
      "Properties": {
        "Name": "saa-security-web-acl",
        "Scope": "REGIONAL",
        "DefaultAction": {
          "Allow": {}
        },
        "VisibilityConfig": {
          "CloudWatchMetricsEnabled": true,
          "MetricName": "SaaSecurityWebACL",
          "SampledRequestsEnabled": true
        },
        "Description": "Regional WAF protecting API endpoints."
      }
    },
    "KMSkms": {
      "Type": "AWS::KMS::Key",
      "Properties": {
        "Description": "Customer-managed key for data and log encryption.",
        "KeySpec": "SYMMETRIC_DEFAULT",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "EnableKeyRotation": true,
        "Enabled": true,
        "MultiRegion": false
      }
    },
    "SecretsManagersecretsmanager": {
      "Type": "AWS::SecretsManager::Secret",
      "Properties": {
        "Name": "saa/security/db-credentials",
        "Description": "Database credentials — auto-rotated and KMS-encrypted.",
        "KmsKeyId": "alias/saa-security-key",
        "GenerateSecretString": {
          "PasswordLength": 32,
          "ExcludeCharacters": "\"@/"
        }
      }
    },
    "TrailRoleiam": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "saa-security-trail-role",
        "Description": "CloudTrail service role for CloudWatch Logs delivery."
      }
    },
    "CloudTrailcloudtrail": {
      "Type": "AWS::CloudTrail::Trail",
      "DependsOn": [
        "TrailRoleiam"
      ],
      "Properties": {
        "TrailName": "saa-security-trail",
        "S3BucketName": "saa-security-cloudtrail-logs",
        "IsLogging": true,
        "IsMultiRegionTrail": true,
        "EnableLogFileValidation": true,
        "IncludeGlobalServiceEvents": true
      }
    },
    "AuditLogBuckets3": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": "saa-security-cloudtrail-logs",
        "VersioningConfiguration": {
          "Status": "Enabled"
        },
        "OwnershipControls": {
          "Rules": [
            {
              "ObjectOwnership": "BucketOwnerEnforced"
            }
          ]
        },
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-security-cloudtrail-logs"
          }
        ]
      }
    },
    "CloudWatchcloudwatch": {
      "Type": "AWS::CloudWatch::Alarm",
      "Properties": {
        "AlarmName": "saa-security-unauthorized-api",
        "AlarmDescription": "Alert on unauthorized API calls detected by CloudTrail.",
        "Namespace": "CloudTrailMetrics",
        "MetricName": "UnauthorizedAttemptCount",
        "Statistic": "Sum",
        "Period": 300,
        "EvaluationPeriods": 1,
        "Threshold": 1,
        "ComparisonOperator": "GreaterThanOrEqualToThreshold",
        "TreatMissingData": "notBreaching"
      }
    },
    "SecurityAlertssns": {
      "Type": "AWS::SNS::Topic",
      "Properties": {
        "TopicName": "saa-security-alerts",
        "DisplayName": "Security alerts"
      }
    }
  }
}