# AWS Baseline Account — SNS Digital

**Entity:** SNS Digital · **Status:** Buildable now

## What it is

Minimal secure AWS account setup for internal use and future client work.
Uses only the managed services where FOSS alternatives add unacceptable ops burden.

## Services Used (and why)

| Service | Purpose | FOSS Alternative | Why AWS wins here |
|---------|---------|------------------|-------------------|
| Route53 | DNS hosting | PowerDNS / self-hosted | 100% uptime SLA, $0.50/zone, not worth self-hosting |
| S3 | Offsite backups, static assets | MinIO | Durability guarantee, lifecycle policies, no disk management |
| SES | Transactional email | Postfix | Deliverability, IP reputation, SPF/DKIM handled |
| IAM | Access control | N/A | Native to the platform |
| CloudWatch (basic) | Billing alerts only | N/A | Free tier, protects against cost surprises |

## Account Structure

```
SNS AWS Organization (future, when multi-client)
└── sns-ops (current — single account)
    ├── IAM User: sam (console + MFA, no programmatic keys on this user)
    ├── IAM Role: infra-deploy (Ansible/Terraform assumes this role)
    ├── IAM Role: backup-writer (PBS pushes to S3, write-only)
    └── IAM Role: ses-sender (app email, send-only)
```

For now: single account `sns-ops`. Move to AWS Organizations when the first
client needs their own isolated account.

## Build Steps

1. **Account:** Create with dedicated email (aws@snsnetlabs.com or similar). Enable MFA.
2. **IAM:** Create `sam` user with console access + MFA. No access keys on this user.
3. **Roles:**
   - `infra-deploy` — AdministratorAccess scoped to Terraform/Ansible (assume via CLI with MFA).
   - `backup-writer` — S3 PutObject + PutObjectTagging on backup bucket only.
   - `ses-sender` — ses:SendEmail + ses:SendRawEmail only.
4. **S3 backup bucket:**
   ```
   Name: sns-backups-<account-id>
   Versioning: enabled
   Encryption: SSE-S3 (AES-256)
   Lifecycle: transition to Glacier after 30 days, delete after 365
   Bucket policy: deny all except backup-writer role + sam
   ```
5. **Route53:** Create hosted zone for `snsnetlabs.com` (or production domain).
   Point registrar NS records here.
6. **SES:** Verify domain, request production access, configure DKIM + SPF.
7. **Billing alert:** CloudWatch alarm at $10, $25, $50 thresholds → email.

## Security Posture

- **No root key usage.** Root account locked with MFA, used only for billing/org changes.
- **No long-lived access keys** on human users. Use `aws sso login` or assume-role with MFA.
- **S3:** Block public access (account-level setting). Bucket policies explicit deny by default.
- **CloudTrail:** Enable for API audit logging (free for management events).
- **GuardDuty:** Enable free tier for threat detection (30-day trial then ~$4/month).

## Upgrade Path

- **AWS Organizations + SCPs:** When you onboard the first client to their own account.
- **Terraform state in S3 + DynamoDB:** When IaC grows beyond a few resources.
- **Control Tower:** When you manage 5+ accounts and need guardrails at scale.

<!-- ponytail: Single account until first client needs isolation. Ceiling: IAM
     complexity in a shared account. Upgrade: AWS Organizations + per-client accounts. -->