Security advisor Access kept narrow, and the hardening kept in code.

Four parts of security work.

Reviews, hardening plans and the Terraform that makes them real, changed through review like everything else.

1. Accounts and access

   Everyone and everything gets only the access it needs.

   Separate accounts per environment, people signing in through IAM Identity Center and CI reaching AWS through OIDC federation, so no pipeline holds a stored key. IAM roles are cut to least privilege, secrets sit in Secrets Manager and SSM Parameter Store, and KMS holds the keys. Coding agents get read-only cloud access, in containers that hold no credentials.

   Accounts and access skills

2. Network and edge

   Only what has to be reachable is reachable.

   Private networks with VPC endpoints and site-to-site VPN, and VPC flow logs to see what crossed them. In front of a public site: CloudFront with origin access control, WAF, ACM certificates that renew on their own, security headers such as Content-Security-Policy and HSTS, and S3 public access blocks with bucket policies. Mail from the domain is authenticated with SPF, DKIM and DMARC.

   Networking and edge skills

3. Code and supply chain

   Secrets and weak dependencies stopped before they merge.

   gitleaks, Semgrep and Trivy on every change, Checkov on the Terraform, and Dependabot with dependency auditing for the libraries. Hooks refuse a secret before it is pushed, and branch protection, rulesets and required status checks make the checks impossible to skip.

   Code quality and security skills

4. Recovery

   A broken or compromised account is rebuilt from the repository.

   The environment is in Terraform, so recovery starts from code rather than from memory, with AWS Backup for the data. Every risky change carries a rollback plan, and when something does break, triage starts from the logs, the metrics and the latest changes.

   Recovery skills