aws-cloudformation-security

# AWS CloudFormation Security Infrastructure ## Overview Create production-ready security infrastructure using AWS CloudFormation templates. This skill covers KMS encryption, Secrets Manager, IAM security with least privilege, VPC security configurations, ACM certificates, parameter security, secure outputs, cross-stack references, CloudWatch Logs encryption, defense in depth strategies, and security best practices. ## When to Use - Implementing KMS encryption at rest and in transit - Managing secrets with Secrets Manager and automatic rotation - Applying IAM least privilege policies and permission boundaries - Securing VPC with security groups, NACLs, and VPC endpoints - Managing TLS/SSL certificates with ACM - Encrypting CloudWatch Logs and S3 buckets - Creating secure cross-stack references and outputs ## Instructions Follow these steps to create security infrastructure with CloudFormation: ### 1. Define KMS Encryption Keys Create customer-managed keys for encryption: ```yaml Resources: EncryptionKey: Type: AWS::KMS::Key Properties: Description: Customer-managed key for data encryption KeyPolicy: Statement: - Effect: Allow Principal: Service: lambda.amazonaws.com Action: - kms:Decrypt - kms:GenerateDataKey Resource: "*" - Effect: Allow Principal: AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root" Action:...