Terraform Module: AWS Secure Baseline

This Terraform module helps you set up your AWS account with a configuration baseline that is reasonably secure. Most of the configurations are based on the CIS Amazon Web Services Foundations v1.4.0 and the AWS Foundational Security Best Practices v1.0.0. For details on compliance, refer to the Benchmark Compliance section to see which items from various benchmarks are included.

Identity and Access Management Set up an IAM Password Policy to manage user access. Create an IAM role that allows contacting AWS support for incident handling. Enable AWS Config rules to audit the status of the root account. Activate IAM Access Analyzer in each region to assess permissions. Configure the S3 account-level Public Access Block settings. Logging & Monitoring Enable CloudTrail across all regions and direct events to CloudWatch Logs for monitoring. Object-level logging for all S3 buckets is enabled by default to track access and changes. CloudTrail Insights event logging is enabled by default to detect unusual activity. CloudTrail logs are encrypted using AWS Key Management Service for security. All logs are stored in an S3 bucket with access logging enabled to track who accesses them. Logs are automatically archived into Amazon Glacier after a specified period (default is 90 days). Set up CloudWatch alarms to alert you when critical changes occur in your AWS account. Enable AWS Config to monitor and enforce compliance with AWS security best practices.