AWS Production Security Gate ​
Production go-live on AWS is gated on the controls below. The gate has two parts: AWS-platform must-haves (mostly fin-infra/aws/ Terraform) and cross-cutting application blockers (blitz / blitz-ui) that would otherwise ship the same risks into production.
Rule: no item below may be 🔴 at go-live. Each maps to a finding in the findings register and a tracking issue. Owner: Sekhar Prakash (Security & Infrastructure).
Part A — Application blockers (must fix before prod) ​
These exist in staging today and are independent of AWS. They are the highest-priority items overall.
| Gate item | Why it blocks go-live | Finding |
|---|---|---|
| Bind request tenant to JWT claim + add RLS backstop | Cross-tenant data access is currently possible with one header | F-01 |
| Enforce RBAC server-side on all finance endpoints | Any authenticated user can post/delete journals, approve payments | F-02 |
| Parameterize all raw SQL | Injection against tenant DB | F-03 |
| Lock down CORS (no wildcard + credentials) + CSRF | Cross-site authenticated requests to finance APIs | F-04 |
| Stop accepting client-set identity/audit fields | Impersonation + audit-trail falsification across all modules | F-25 |
Allowlist /filter WHERE fields | BOLA — enumerate any user's data via filter | F-26 |
| MFA for admin/approver roles | No second factor on privileged financial actions | F-23 |
Part B — AWS platform must-haves (Day-1) ​
| Gate item | Control | Finding |
|---|---|---|
| Detection baseline | CloudTrail (multi-region + log-file validation), GuardDuty, Security Hub, VPC Flow Logs | F-11 |
| Edge protection | AWS WAF (managed + rate rules) on ALB/CloudFront; Shield (Advanced optional) | F-11 — 🟡 WAF now provisioned |
| ALB + ACM cert, HTTPS-only, HTTP→HTTPS redirect — done (Phase 3) | ||
| IAM least privilege | Remove wildcard resources (kms:Decrypt *, ECS *, CloudFront *, PassRole arn:*); scope to prod account/ARNs | F-12 |
| Encryption (CMK) | Customer-managed KMS keys + rotation for RDS, S3 (Restricted), Secrets Manager | F-18 |
| RDS hardening | Private, encrypted, PITR, Multi-AZ, deletion protection (mostly ✓ designed) | F-18 |
| S3 hardening | Block public (✓), versioning (✓), TLS-only bucket policy, server access logs | F-18 |
| Secrets | Secrets Manager + rotation; never .env in repos, secrets in Terraform state, or secrets in images | F-21, F-22 |
| Container security | Image scanning in CI (fail on critical/high); non-root; read-only rootfs; dropped capabilities; digest pinning | F-20 |
| Identity | AWS Identity Center / SSO + enforced MFA; no IAM users except break-glass | F-22 |
| CI/CD | Terraform plan approval gate before apply; HA NAT (2 AZs) | F-22 |
Part C — Strongly recommended before GA (not hard blockers) ​
- Tamper-evidence on financial records + uniform audit trail (F-15)
- Verify server-side approval/state-transition enforcement (F-16)
- SPF/DKIM/DMARC + attachment scanning + email-workflow rate limits (F-17)
- Security IR + breach-notification plan (Domain 12); documented RPO/RTO + restore drill (Domain 13)
- Pre-production penetration test + vulnerability disclosure policy (F-24, fin-infra#39) — independent validation of the P0s before the first production tenant
- LLM data-handling posture: prompt sanitization, PII redaction, per-tool agent RBAC, provider DPA (F-14)
Sign-off ​
Go-live security sign-off requires: Part A all 🟢, Part B all 🟢, Part C reviewed with any open items risk-accepted (with expiry) by the security owner (Sekhar Prakash). See the findings register for current status of each item.