Scribd
Upload
3 views1 page

Security As Code Baseline

The document outlines a security group configuration for a cloud infrastructure project named Cloud-Shield, aimed at enforcing N8 Security Standards. It specifies rules for allowing HTTPS traffic, restricting SSH access to a specific admin IP, and allowing all outbound traffic for updates. Additionally, it implicitly denies all other inbound traffic to enhance security.

Uploaded by

mandessimusimadavid
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
3 views1 page

Security As Code Baseline

The document outlines a security group configuration for a cloud infrastructure project named Cloud-Shield, aimed at enforcing N8 Security Standards. It specifies rules for allowing HTTPS traffic, restricting SSH access to a specific admin IP, and allowing all outbound traffic for updates. Additionally, it implicitly denies all other inbound traffic to enhance security.

Uploaded by

mandessimusimadavid
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

# PROJECT: Cloud-Shield Baseline​

# PURPOSE: Enforce N8 Security Standards on Cloud Infrastructure​


​
resource "aws_security_group" "hardened_web_server" {​
name = "web-server-hardened-sg"​
description = "Baseline security group for N8 compliant web servers"​
​
# Rule 1: Allow HTTPS (Port 443) from anywhere​
ingress {​
from_port = 443​
to_port = 443​
protocol = "tcp"​
cidr_blocks = ["[Link]/0"]​
description = "Allow encrypted web traffic"​
}​
​
# Rule 2: Restricted SSH (Port 22) - Only from Admin IP​
# RECRUITER NOTE: Never leave 22 open to [Link]/0​
ingress {​
from_port = 22​
to_port = 22​
protocol = "tcp"​
cidr_blocks = ["[Link]/32"] # Replace with Admin IP​
description = "Restricted Admin SSH access"​
}​
​
# Rule 3: Deny all other inbound (Implicit)​
​
# Rule 4: Restricted Egress (Outbound)​
egress {​
from_port = 0​
to_port = 0​
protocol = "-1"​
cidr_blocks = ["[Link]/0"]​
description = "Allow outbound for updates"​
}​
}​

You might also like