AWS Production Security Gate
| Owner | Classification | Version | Effective | Next review | Status |
|---|---|---|---|---|---|
| Sekhar Prakash | Internal | 1.3 | 2026-09-05 | 2026-11-27 | Active |
Production go-live on AWS is gated on the controls below. The gate has two parts: AWS-platform must-haves (mostly fin-infra/aws/ Terraform) and cross-cutting application blockers (blitz / blitz-ui) that would otherwise ship the same risks into production.
Rule: no item below may be 🔴 at go-live. Each maps to a finding in the findings register and a tracking issue. Owner: Sekhar Prakash (Security & Infrastructure).
AWS-native service options and trade-offs for each open Part B item are assessed in AWS Go-Live Gate — Options Assessment.
Part A — Application blockers (must fix before prod)
STATUS IS OWNED BY THE FINDINGS REGISTER
The Status column here is a view, not a source. Authoritative finding status lives in the Findings Register — if the two disagree, the register wins and this page is stale. Three rows on this page were found asserting statuses the register had already closed (2026-09-15), including a false claim that cross-tenant access was live. Re-check against the register before using this page for a go/no-go decision.
These exist in staging today and are independent of AWS. They are the highest-priority items overall.
| Gate item | Status | Blocking findings | Owner | Target |
|---|---|---|---|---|
tenantbinding.ts); RLS backstop still outstanding | 🟡 binding resolved 2026-09-04; RLS backstop open | Eng | RLS: pre-prod | |
requirePermission now enforces (403 default) + catalogue/grants seeded | ✅ resolved 2026-08-06 | — | done | |
| Parameterize all raw SQL — injection against tenant DB | 🟡 recon.filter.ts raw-SQL passthrough) | F-42 | Eng | pre-prod |
| Lock down CORS (no wildcard + credentials) + CSRF — cross-site authenticated requests to finance APIs | 🔴 Open | F-04 | Eng | pre-prod |
| Stop accepting client-set identity/audit fields — impersonation + audit-trail falsification across all modules | 🟡 55 routes on the 2026-09-22 list fixed/disproved (blitz#1563); runtime scan 2026-09-23: 39 Tier-1 routes + 2 approvals with no trusted actor still open (lint:security R1 = 41) | F-25 | Eng | pre-prod |
Tenant-scope Temporal workflow visibility — cross-tenant read + terminate once any tenant role gets system:workflow:* | 🟡 risk-accepted 2026-08-09 — verified not currently exploitable (no tenant role holds system:workflow:*); becomes live the moment one does | F-38 | Eng | before granting that permission |
Allowlist /filter WHERE fields — BOLA — enumerate any user's data via filter | 🔴 Open | F-26 | Eng | pre-prod |
| MFA for admin/approver roles — no second factor on privileged financial actions | 🔴 Open | F-23 | Eng | pre-prod |
Part B — AWS platform must-haves (Day-1)
| Gate item | Status | Blocking findings | Owner | Target |
|---|---|---|---|---|
| Detection baseline — CloudTrail (multi-region + log-file validation), GuardDuty, Security Hub, VPC Flow Logs | 🔴 Open | F-11 | Sekhar | AWS go-live |
| Edge protection — AWS WAF (managed + rate rules) on ALB/CloudFront; Shield (Advanced optional) | 🟡 WAF now provisioned | F-11 | Sekhar | AWS go-live |
| ✅ resolved 2026-07-10 | — | done | ||
IAM least privilege — remove wildcard resources (kms:Decrypt *, ECS *, CloudFront *, PassRole arn:*); scope to prod account/ARNs | 🔴 Open | F-12 | Sekhar | AWS go-live |
| Encryption (CMK) — customer-managed KMS keys + rotation for RDS, S3 (Restricted), Secrets Manager | 🔴 Open | F-18 | Sekhar | AWS go-live |
| RDS hardening — private, encrypted, PITR, Multi-AZ, deletion protection (mostly ✓ designed) | 🟡 mostly ✓ designed | F-18 | Sekhar | AWS go-live |
| S3 hardening — block public (✓), versioning (✓), TLS-only bucket policy, server access logs | 🟡 block public + versioning ✓ | F-18 | Sekhar | AWS go-live |
Secrets — Secrets Manager + rotation; never .env in repos, secrets in Terraform state, or secrets in images | 🔴 Open | F-21, F-22 | Sekhar | AWS go-live |
| Container security — image scanning in CI (fail on critical/high); non-root; read-only rootfs; dropped capabilities; digest pinning | 🔴 Open | F-20 | Sekhar | AWS go-live |
| Identity — AWS Identity Center / SSO + enforced MFA; no IAM users except break-glass | 🔴 Open | F-22 | Sekhar | AWS go-live |
CI/CD — Terraform plan approval gate before apply; HA NAT (2 AZs) | 🔴 Open | F-22 | Sekhar | AWS go-live |
Part C — Strongly recommended before GA (not hard blockers)
- Tamper-evidence on financial records + uniform audit trail (F-15)
- Verify server-side approval/state-transition enforcement (F-16)
- SPF/DKIM/DMARC + attachment scanning + email-workflow rate limits (F-17)
- Security IR + breach-notification plan (Domain 12); documented RPO/RTO + restore drill (Domain 13)
- Pre-production penetration test + vulnerability disclosure policy (F-24, fin-infra#39) — independent validation of the P0s before the first production tenant
- LLM data-handling posture: prompt sanitization, PII redaction, per-tool agent RBAC, provider DPA (F-14)
Sign-off
Go-live security sign-off requires: Part A all 🟢, Part B all 🟢, Part C reviewed with any open items risk-accepted (with expiry) by the security owner (Sekhar Prakash). See the findings register for current status of each item.
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | 2026-06-24 | Sekhar Prakash | Go-live security gate defined (Parts A/B/C). |
| 1.1 | 2026-07-10 | Sekhar Prakash | F-13 (ALB/TLS) resolved; gate items updated. |
| 1.2 | 2026-08-28 | Sekhar Prakash | Enriched Part A/B gate tables to Gate item · Status · Blocking findings · Owner · Target (owner/target added; status/detail and findings preserved). |
| 1.3 | 2026-09-05 | Sekhar Prakash | Linked the options assessment for Part B's open items. |
Finaisse Internal — Confidential. Not for external distribution.