sam/sns-network-solutions
1
0
Fork 0
Code Issues 31 Pull Requests 5 Actions Packages Projects Releases Wiki Activity
3e1e0963c5
sns-network-solutions/infra/sns-digital/aws-baseline.md
Samuel James b1a35783bb Consolidate 7 divisions to 3: Networking, Digital, Support 
- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1)
- Merge Web + Software + Cloud → SNS Digital (planned)
- SNS Support unchanged (planned)
- Add infra/ folder with 16 FOSS-first buildable designs
- Update all agent knowledge, division briefs, legal structure
- Restructure businesses/ from 7 to 3 operating folders
2026-07-18 13:08:23 -05:00

3.2 KiB
Raw Blame History

AWS Baseline Account — SNS Digital

Entity: SNS Digital · Status: Buildable now

What it is

Minimal secure AWS account setup for internal use and future client work. Uses only the managed services where FOSS alternatives add unacceptable ops burden.

Services Used (and why)

Service Purpose FOSS Alternative Why AWS wins here
Route53 DNS hosting PowerDNS / self-hosted 100% uptime SLA, $0.50/zone, not worth self-hosting
S3 Offsite backups, static assets MinIO Durability guarantee, lifecycle policies, no disk management
SES Transactional email Postfix Deliverability, IP reputation, SPF/DKIM handled
IAM Access control N/A Native to the platform
CloudWatch (basic) Billing alerts only N/A Free tier, protects against cost surprises

Account Structure

SNS AWS Organization (future, when multi-client)
└── sns-ops (current — single account)
    ├── IAM User: sam (console + MFA, no programmatic keys on this user)
    ├── IAM Role: infra-deploy (Ansible/Terraform assumes this role)
    ├── IAM Role: backup-writer (PBS pushes to S3, write-only)
    └── IAM Role: ses-sender (app email, send-only)

For now: single account sns-ops. Move to AWS Organizations when the first client needs their own isolated account.

Build Steps

  1. Account: Create with dedicated email (aws@snsnetlabs.com or similar). Enable MFA.
  2. IAM: Create sam user with console access + MFA. No access keys on this user.
  3. Roles:
    • infra-deploy — AdministratorAccess scoped to Terraform/Ansible (assume via CLI with MFA).
    • backup-writer — S3 PutObject + PutObjectTagging on backup bucket only.
    • ses-sender — ses:SendEmail + ses:SendRawEmail only.
  4. S3 backup bucket: 
    Name: sns-backups-<account-id>
Versioning: enabled
Encryption: SSE-S3 (AES-256)
Lifecycle: transition to Glacier after 30 days, delete after 365
Bucket policy: deny all except backup-writer role + sam
  5. Route53: Create hosted zone for snsnetlabs.com (or production domain). Point registrar NS records here.
  6. SES: Verify domain, request production access, configure DKIM + SPF.
  7. Billing alert: CloudWatch alarm at $10, $25, $50 thresholds → email.

Security Posture

  • No root key usage. Root account locked with MFA, used only for billing/org changes.
  • No long-lived access keys on human users. Use aws sso login or assume-role with MFA.
  • S3: Block public access (account-level setting). Bucket policies explicit deny by default.
  • CloudTrail: Enable for API audit logging (free for management events).
  • GuardDuty: Enable free tier for threat detection (30-day trial then ~$4/month).

Upgrade Path

  • AWS Organizations + SCPs: When you onboard the first client to their own account.
  • Terraform state in S3 + DynamoDB: When IaC grows beyond a few resources.
  • Control Tower: When you manage 5+ accounts and need guardrails at scale.