b1a35783bb
- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1) - Merge Web + Software + Cloud → SNS Digital (planned) - SNS Support unchanged (planned) - Add infra/ folder with 16 FOSS-first buildable designs - Update all agent knowledge, division briefs, legal structure - Restructure businesses/ from 7 to 3 operating folders
71 lines
3.2 KiB
Markdown
71 lines
3.2 KiB
Markdown
# AWS Baseline Account — SNS Digital
|
|
|
|
**Entity:** SNS Digital · **Status:** Buildable now
|
|
|
|
## What it is
|
|
|
|
Minimal secure AWS account setup for internal use and future client work.
|
|
Uses only the managed services where FOSS alternatives add unacceptable ops burden.
|
|
|
|
## Services Used (and why)
|
|
|
|
| Service | Purpose | FOSS Alternative | Why AWS wins here |
|
|
|---------|---------|------------------|-------------------|
|
|
| Route53 | DNS hosting | PowerDNS / self-hosted | 100% uptime SLA, $0.50/zone, not worth self-hosting |
|
|
| S3 | Offsite backups, static assets | MinIO | Durability guarantee, lifecycle policies, no disk management |
|
|
| SES | Transactional email | Postfix | Deliverability, IP reputation, SPF/DKIM handled |
|
|
| IAM | Access control | N/A | Native to the platform |
|
|
| CloudWatch (basic) | Billing alerts only | N/A | Free tier, protects against cost surprises |
|
|
|
|
## Account Structure
|
|
|
|
```
|
|
SNS AWS Organization (future, when multi-client)
|
|
└── sns-ops (current — single account)
|
|
├── IAM User: sam (console + MFA, no programmatic keys on this user)
|
|
├── IAM Role: infra-deploy (Ansible/Terraform assumes this role)
|
|
├── IAM Role: backup-writer (PBS pushes to S3, write-only)
|
|
└── IAM Role: ses-sender (app email, send-only)
|
|
```
|
|
|
|
For now: single account `sns-ops`. Move to AWS Organizations when the first
|
|
client needs their own isolated account.
|
|
|
|
## Build Steps
|
|
|
|
1. **Account:** Create with dedicated email (aws@snsnetlabs.com or similar). Enable MFA.
|
|
2. **IAM:** Create `sam` user with console access + MFA. No access keys on this user.
|
|
3. **Roles:**
|
|
- `infra-deploy` — AdministratorAccess scoped to Terraform/Ansible (assume via CLI with MFA).
|
|
- `backup-writer` — S3 PutObject + PutObjectTagging on backup bucket only.
|
|
- `ses-sender` — ses:SendEmail + ses:SendRawEmail only.
|
|
4. **S3 backup bucket:**
|
|
```
|
|
Name: sns-backups-<account-id>
|
|
Versioning: enabled
|
|
Encryption: SSE-S3 (AES-256)
|
|
Lifecycle: transition to Glacier after 30 days, delete after 365
|
|
Bucket policy: deny all except backup-writer role + sam
|
|
```
|
|
5. **Route53:** Create hosted zone for `snsnetlabs.com` (or production domain).
|
|
Point registrar NS records here.
|
|
6. **SES:** Verify domain, request production access, configure DKIM + SPF.
|
|
7. **Billing alert:** CloudWatch alarm at $10, $25, $50 thresholds → email.
|
|
|
|
## Security Posture
|
|
|
|
- **No root key usage.** Root account locked with MFA, used only for billing/org changes.
|
|
- **No long-lived access keys** on human users. Use `aws sso login` or assume-role with MFA.
|
|
- **S3:** Block public access (account-level setting). Bucket policies explicit deny by default.
|
|
- **CloudTrail:** Enable for API audit logging (free for management events).
|
|
- **GuardDuty:** Enable free tier for threat detection (30-day trial then ~$4/month).
|
|
|
|
## Upgrade Path
|
|
|
|
- **AWS Organizations + SCPs:** When you onboard the first client to their own account.
|
|
- **Terraform state in S3 + DynamoDB:** When IaC grows beyond a few resources.
|
|
- **Control Tower:** When you manage 5+ accounts and need guardrails at scale.
|
|
|
|
<!-- ponytail: Single account until first client needs isolation. Ceiling: IAM
|
|
complexity in a shared account. Upgrade: AWS Organizations + per-client accounts. -->
|