Hey everyone, I've been tasked with helping review our first "Claw" (I think it's a codename for our new microservices setup?) deployment pipeline. I'm pretty new to this, but I wanted to share the checklist I put together from reading docs and asking senior engineers. It's probably basic, but maybe it helps someone else.
I focused on the Terraform and AWS parts I'm learning. Could you guys tell me if I'm missing something obvious? Here's my list so far:
**Pre-Terraform Apply:**
* Are all S3 bucket policies set to block public access?
* Are IAM roles using least privilege? Check for wildcards (`"*"`) in the policy docs.
* Are secrets (like DB passwords) coming from AWS Secrets Manager, not hardcoded in `variables.tf`?
**During/Post-Deploy:**
* Do CloudTrail logs show the deployment user's actions?
* Are security groups checked? We had an issue where a test EC2 instance was open to `0.0.0.0/0` on SSH 😬
Example of the IAM check I'm doing manually now:
```hcl
# Bad - too permissive
resource "aws_iam_role_policy" "example_bad" {
policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Action = "s3:*" # This is the problem
Resource = "*"
}]
})
}
```
What other big things should be on the list for a full-stack rebuild? I'm thinking about VPC flow logs and maybe something about the CI/CD tool permissions?