Securing the DevSecOps pipeline on AWS
Shift-left gates that stop known-bad from ever reaching your AWS account — secrets, code, dependencies, Terraform, images.
This group is about closing gaps before an account exists in a bad state, and keeping it that way. IAM policy evaluation order is the mental model underneath every AccessDenied and every guardrail you'll write. A CPS 234-aligned landing zone with Control Tower bakes those guardrails in as Terraform from account zero, instead of retrofitting them once accounts already exist.
The remaining five lessons are fixes for the findings that show up first and most often in a real scan: root without MFA or with active access keys, public S3 buckets, security groups open to the world on SSH/RDP, unencrypted S3, EBS and RDS, and CloudTrail missing multi-region coverage or log validation. Each maps to a specific CIS benchmark item and Security Hub control ID, with the one-time setting or remediation that clears it for good.
Read in order, this is the shape of a pipeline that stops known-bad from reaching an account, plus the cleanup for accounts that already have it.
Lessons
- IAM Policy Evaluation Logic — the diagram AWS should have made"Why is this denied when I clearly allowed it?" The answer is the IAM evaluation order — six layers, and an explicit deny beats a hundred allows. Here's the mental model that ends the AccessDenied guessing.
- Building a CPS 234-Compliant Landing Zone with Control TowerA CPS 234-aligned AWS foundation isn't a checklist you apply later — it's a baseline you bake in from account zero. Here's the security-baseline + guardrails approach, as Terraform.
- Fix: Root Account Without MFA and With Access KeysThe root user with no MFA, or with active access keys, is a top finding and a genuine crown-jewels risk. Here's the exact remediation and how to prove it stays fixed.
- Fix: Public S3 Buckets Flagged by Prowler / Security HubPublic S3 access is the most common high-severity finding in any first scan. Here's the exact fix — account-wide and per-bucket — plus how to handle buckets that are public on purpose.
- Fix: Security Groups Open to 0.0.0.0/0 on SSH/RDPA security group allowing the whole internet to reach port 22 or 3389 is the highest-blast-radius finding most environments have. Here's how to find them all and close them properly.
- Fix: Unencrypted S3, EBS and RDS (Encryption at Rest)Encryption-at-rest findings come in bulk and are easy to clear with account defaults — so they should never be the thing that's still red at audit. Here's the one-time fix per service.
- Fix: CloudTrail Not Multi-Region or Missing Log File ValidationIf CloudTrail isn't multi-region with log file validation on, you have a blind spot and no proof your logs are untampered. Both are direct audit findings. Here's the fix.
Common questions
- Is tfsec still the right Terraform scanner?
- No. tfsec is deprecated and merged into Trivy, and Terrascan was archived in November 2025. Use Checkov or `trivy config`.