AWS Go-Live Gate — Options Assessment

Owner	Classification	Version	Effective	Next review	Status
Sekhar Prakash	Internal	1.1	2026-09-05	2026-11-27	Active

Purpose. For each open Part B item in the AWS Production Security Gate, this page assesses the AWS-native service options available to close it — with trade-offs, cost, and the relevant control/standard citation. It is an options analysis, not a register: finding detail, severity, and status remain authoritative in the findings register and the gate itself; this page is referenced from there and does not restate them.

Scope and method

Covers the four Part B gate items still open as of gate v1.2 (F-11, F-12, F-18, F-21/F-22) plus the WAF/Shield half of F-11. For each, AWS-native options are compared against AWS Well-Architected (Security Pillar), the AWS Security Reference Architecture, CIS AWS Foundations Benchmark, and AWS Foundational Security Best Practices (Security Hub control IDs cited where one exists. Grounded against the applied Terraform in fin-infra/aws/ as of 2026-09-05, not assumed from the gate text alone.

Two gaps surfaced during this assessment that are not yet findings — see New findings. A further twelve AWS topics were researched and found not to correspond to any gate item or tracked finding — see Researched, not gated below for the one-line summary, or the AWS Service Reference for full option/trade-off detail on each, plus Amazon Cognito (not currently in use).

F-11 — Detection baseline

Option	Closes	Trade-off	Cost
CloudTrail — one org trail, Log Archive account	Management-event audit trail (AWS SRA: centralize in Log Archive, not per-account trails)	Free first copy/region. Scope data events to app_data only — never free, and account-wide data events dwarf management-event cost at fintech S3 volume	$0 mgmt events + S3 storage
AWS Config (periodic mode)	Not named in the gate text, but is Security Hub's evaluation engine underneath — most Security Hub controls do not fire without it	Periodic/daily recording scoped to security-relevant resource types (IAM, S3, SGs, RDS, KMS) rather than "all" bounds volume and cost	$0.012/item (periodic) vs $0.003 (continuous, higher volume at churn)
Security Hub CSPM (CIS + FSBP standards)	The scoring half of the detection baseline	Depends on Config recording (above) for most controls	~$3.75/mo per 1 EC2-equivalent resource unit
VPC Flow Logs → S3	Named directly in F-11; no destination specified in the gate text	S3 destination ≈48% cheaper than CloudWatch Logs for identical volume ($0.273/GB effective vs $0.53/GB); reserve CloudWatch only where live alarming on flow patterns is needed	~$0.27/GB to S3

GuardDuty is already provisioned (gate status). CloudTrail, Config, and Security Hub remain the open items; Config is a silent prerequisite the gate text does not name.

Standards: CIS AWS Foundations Benchmark v5.0.0 §3.1 (CloudTrail.1) · Security Hub FSBP GuardDuty.1 / Config.1.

Edge protection (F-11, WAF & Shield)

Option	Fits	Trade-off	Cost
ATP managed rule set	Directly relevant to F-41 (no brute-force protection on /auth/login) — checks login attempts against AWS's stolen-credential database, aggregates by IP + session	Response-inspection half (failure-rate tracking) only works on CloudFront, not ALB — a real limitation since blitz-api is ALB-only today	$10/mo + $1,000/M requests (0–2M), falling to $50/M beyond 30M
Rate-based rule, JA3/JA4 aggregation key	Usable directly on ALB today; keys on TLS fingerprint instead of source IP — catches credential-stuffing botnets that rotate IPs but reuse the same client stack	Cheaper than ATP at low-to-moderate volume; reasonable first line before ATP's per-request tiers	2 + 30 WCU per custom key
Shield Standard (already on)	Automatic, free — covers common L3/L4 volumetric attacks on the ALB and the NAT Gateway's EIP	No L7 coverage, no cost-protection credits, no SRT access	$0
Shield Advanced	Adds L7 detection, cost protection, 24/7 SRT	$3,000/mo, 1-year commitment; not warranted at current traffic/threat profile	$3,000/mo

Assessment: a rate-based rule keyed on JA3/JA4 is the near-term action — cheap, closes F-41's gap at the edge as defense-in-depth alongside whatever elysia-rate-limit work lands in blitz. ATP (CloudFront dependency) and Shield Advanced (cost, no current trigger) are not warranted yet.

F-12 — IAM scopes too broad

Confirmed live in fin-infra/aws/modules/iam/main.tf's ecs_execution_secrets policy: kms:Decrypt on Resource: "*".

Option	What it does	Trade-off	Cost
Scope kms:Decrypt to CMK ARNs	Direct fix — replace Resource: "*" with the specific RDS/S3/Secrets CMK ARNs the task needs	None	$0
IAM Access Analyzer — policy validation	~100 best-practice checks including broad-resource warnings, run at write-time via console/CLI/API	Detection only; needs CI wiring to enforce	$0
Policy generation from CloudTrail	Analyzes 90 days of real usage for a role, generates a scoped-down policy reflecting actual actions used	Needs usage history to exist first	$0
Unused-access analyzer	Continuous flagging of granted-but-unused services/actions — catches drift after the initial fix	Billed per role/user/month; detection only, no auto-remediation	Per-principal/mo

Assessment: the direct fix is free and should land regardless of tooling choice. Layer policy validation into the Terraform CI path so this class of finding cannot recur silently, per fin-infra's existing "prefer a check that detects the whole class" principle.

F-18 — CMKs, RDS & S3 hardening

S3 — TLS-only policy & encryption. No bucket policy currently exists in modules/s3 at all.

Option	Fits	Trade-off	Cost
aws:SecureTransport deny	Closes the gate's "TLS-only policy" item directly (FSBP S3.5)	Static policy statement; no legitimate client uses plain HTTP	$0
Switch default encryption to SSE-KMS	Both buckets are SSE-S3 (AES256) today, not the KMS CMK the module already provisions — the CMK exists with a service-principal grant ready, referenced nowhere	Must precede any "deny non-KMS PUT" policy — doing the policy first breaks uploads	~$1/mo CMK, already paid
CloudTrail data events, scoped to app_data	Closes the gate's "access logs" item — AWS's own guidance names this, not server access logging, as the audit-grade option with identity attribution	Paid per event, no free tier; scope to the one sensitive bucket	$0.10/100k events

RDS — private, CMK-encrypted, rds.force_ssl on, Multi-AZ + deletion protection on production (mostly correct already). Two gaps found:

Gap	Fix	Trade-off	Cost
Master password held in Terraform state	RDS-native managed rotation (manage_master_user_password = true) — RDS owns the secret, rotates every 7 days, no Lambda to maintain	Migrating an existing instance is a two-step Terraform operation with known provider friction; state does not retroactively scrub old plaintext versions — prove out on preprod first	$0 extra
RDS IAM database authentication off	Short-lived SigV4 tokens instead of a static password	Marginal benefit here — pooled connection pattern is well under the 200 cps ceiling where IAM auth's real advantage appears; Secrets Manager rotation gets most of the same benefit with less app-side plumbing	$0, + RDS Proxy if pooling gets tight

Standards: FSBP S3.5 (TLS-only) · FSBP S3.17 (KMS-required) · RDS.10 (IAM auth) — Security Hub CSPM.

F-21 / F-22 — Secrets, Identity Center, CI/CD

Secrets: Secrets Manager vs SSM Parameter Store. Secrets Manager is already the correct tool in use — 9 platform-wide secrets, none per-tenant, no sprawl risk today. Parameter Store Standard (free) is the right fit only for non-rotating config, which this repo does not currently need; Parameter Store has no native rotation, and AWS's own ECS guidance steers rotation needs to Secrets Manager. No change recommended.

Identity — closing the interim access pattern. Identity Center's Terraform destination state already exists in full (global/identity-center/main.tf — permission sets and group assignments defined); the only outstanding work is the Zoho SAML metadata exchange itself. This is the single highest-leverage closure item across the whole gate, since nothing else needs building. Two gaps in the interim sekhar-console bridge are worth closing on the same timeline: no MFA enforcement visible in IaC (verify whether this is console-only drift), and its assume-role trust is wildcarded across arn:aws:iam::*:role/OrganizationAccountAccessRole rather than pinned to the two known account IDs.

New findings, not yet registered

Two gaps surfaced from reading the applied Terraform directly, not from a code review — neither has a finding ID yet.

• ECS security group opens ports 0–65535, not the actual service ports. The ecs security group's ingress rule (from_port = 0, to_port = 65535, scoped to the ALB SG and itself) lets the ALB — and any ECS task — reach any port on any container, not just each service's real 10001–10017/9999 listener. Not open to 0.0.0.0/0, so it fails on breadth-of-port rather than breadth-of-source. Free, one-line Terraform fix: narrow to the specific per-service ports already enumerated in services.tf. Maps to Security Hub EC2.18.
• GitHub Actions OIDC trust is org-wide, not repo-scoped. The finaisse-github-actions role's trust condition is repo:finaisse-org/*:* — any repo under the org, any branch, any workflow. The role holds iam:PassRole for ECS and secretsmanager:GetSecretValue on all finaisse/* secrets, so a scratch/test repo added later under the same org inherits deploy-level trust with zero extra configuration. Scope sub to the specific deploying repos, and prefer GitHub Environments over branch names for anything touching production.

Researched, not gated

Researched during this assessment; none correspond to a gate item or tracked finding. Deferred, not dismissed — full option/trade-off detail for each is in the AWS Service Reference.

Topic	Why deferred
AWS Config (as a named gate item)	Implicitly required by Security Hub, folded into F-11 above — not a separate action
Amazon Detective	Investigation tooling downstream of GuardDuty/Security Hub findings, not a compliance-gating control; defer until triage volume makes it painful
AWS Audit Manager	Closed to new customers since 2026-04-30 — moot regardless of priority. SOC 2/GDPR have no Config Conformance Pack equivalent; AWS's own FAQ points to third-party GRC tooling (Vanta/Drata) instead
S3 Object Lock (WORM)	One-way, bucket-creation-time decision; needs a compliance/legal read on retention regulation before adoption, not an infra call alone
Amazon Macie	Stronger fit for unstructured PII/credential leakage than structured financial documents; if adopted, run scheduled on new-object deltas rather than continuous full-corpus scans
KMS key admin/user separation	Currently root + service-principal only, no RBAC split; moot until SSE-KMS is actually adopted on the S3 buckets (see F-18)
Presigned URL tenant scoping	Fundamentally an application/IAM-design correctness issue — AWS provides ABAC/session-tag primitives to enforce it, but cannot retroactively fix a wrong prefix computed in application code
SCP baseline gaps	Current 6 SCPs cover region/IMDSv2/GuardDuty/CloudTrail/S3-encryption; nothing protects Config or Security Hub from tampering, and no SCP-level root-API restriction exists yet
AWS Network Firewall	Redundant for ingress — WAF already covers HTTP semantics better. Earns its ~$576/mo fixed cost only if egress domain-allowlisting becomes a real requirement; cheaper interim step is tightening the ecs SG's wide-open egress rule
VPC endpoints	S3 gateway endpoint is free and strictly beneficial — add unconditionally. Secrets Manager / CloudWatch Logs interface endpoints need a real traffic-volume check before their ~$15–30/mo each is justified
RDS pgAudit / Database Activity Streams	Already named in logging-coverage (not enabled). DAS does not apply — it is Aurora-only for PostgreSQL. pgAudit is the real option: free, one parameter-group change plus reboot
ElastiCache transit encryption	Not named in any tracked finding. Blocked by blitz's Redis client using redis:// — but AWS's Dec-2022 graduated migration (preferred → required) means this is no longer an infra rebuild, only a staged application-side config change

Actions and owners

Action	Finding	Owner	Priority
Scope kms:Decrypt (and other wildcard resources) to specific ARNs	F-12	Sekhar	Gate
Add aws:SecureTransport deny to both S3 bucket policies	F-18	Sekhar	Gate
Switch S3 default encryption from SSE-S3 to the existing KMS CMK	F-18	Sekhar	Gate
Enable CloudTrail (org trail), Config, Security Hub	F-11	Sekhar	Gate
Add a WAF rate-based rule keyed on JA3/JA4	F-11	Sekhar	Gate
Complete Zoho SAML metadata exchange for Identity Center	F-22	Sekhar	Gate
Pin sekhar-console's assume-role trust to the two known account IDs; verify MFA enforcement	F-22	Sekhar	Gate
Narrow the ecs security group's ingress port range to actual service ports	(new — see above)	Sekhar	Fix now, file finding
Scope the GitHub Actions OIDC trust policy sub claim to specific repos	(new — see above)	Sekhar	Fix now, file finding
Migrate RDS master password to manage_master_user_password	F-18	Sekhar	Post-gate

Related

• → AWS Service Reference (full detail on researched, non-gated topics) · AWS Production Gate · Findings Register

Revision history

Version	Date	Author	Change
1.0	2026-09-05	Sekhar Prakash	Initial options assessment for Part B (F-11, F-12, F-18, F-21/F-22), cross-referenced against the security register.
1.1	2026-09-05	Sekhar Prakash	Linked the new AWS Service Reference for full detail on researched, non-gated topics.

Finaisse Internal — Confidential. Not for external distribution.