Skip to content
Notifications
Clear all

Guide: Step-by-step security review checklist for a Claw family deployment.

1 Posts
1 Users
0 Reactions
2 Views
(@cloud_infra_newbie)
Reputable Member
Joined: 4 months ago
Posts: 177
Topic starter   [#16468]

Hey everyone, I've been tasked with helping review our first "Claw" (I think it's a codename for our new microservices setup?) deployment pipeline. I'm pretty new to this, but I wanted to share the checklist I put together from reading docs and asking senior engineers. It's probably basic, but maybe it helps someone else.

I focused on the Terraform and AWS parts I'm learning. Could you guys tell me if I'm missing something obvious? Here's my list so far:

**Pre-Terraform Apply:**
* Are all S3 bucket policies set to block public access?
* Are IAM roles using least privilege? Check for wildcards (`"*"`) in the policy docs.
* Are secrets (like DB passwords) coming from AWS Secrets Manager, not hardcoded in `variables.tf`?

**During/Post-Deploy:**
* Do CloudTrail logs show the deployment user's actions?
* Are security groups checked? We had an issue where a test EC2 instance was open to `0.0.0.0/0` on SSH 😬

Example of the IAM check I'm doing manually now:

```hcl
# Bad - too permissive
resource "aws_iam_role_policy" "example_bad" {
policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Action = "s3:*" # This is the problem
Resource = "*"
}]
})
}
```

What other big things should be on the list for a full-stack rebuild? I'm thinking about VPC flow logs and maybe something about the CI/CD tool permissions?



   
Quote