Cloud Security and WAF Automation

AWS WAF with managed and rate-based rules managed in Terraform, GuardDuty and Security Hub findings routed to responders, secrets rotation, and policy-as-code checks on infrastructure changes.

Problem

Security controls configured by hand drift, risky infrastructure changes reach production unreviewed, and findings from detective services pile up unread.

Solution

Every control in Terraform; every infrastructure change checked against policy before merge; WAF rules rolled out in count mode and promoted to block from evidence; findings routed by severity to a place where someone acts on them.

• AWS WAF
• GuardDuty
• Security Hub
• EventBridge
• SNS + KMS
• CloudWatch
• Policy as code (Python)
• SARIF
• Terraform

• WAF module with a per-rule count/block switch, so every new rule ships in count mode first.
• A log summary script shows which count-mode rules would have blocked, which client IPs and how often — the evidence for flipping a rule to block.
• Policy checker over the Terraform plan JSON: public S3 buckets, SSH/RDP open to the internet, wildcard IAM, unencrypted RDS, CloudTrail without log validation, public ALBs without WAF.
• Exceptions need an owner, a reason and an expiry date; expired exceptions stop applying and are reported.
• SARIF output feeds GitHub code scanning; only the upload job gets the security-events permission.
• 99 unit tests over every rule, exceptions, SARIF structure, exit codes and the log summary; Terraform for both modules and an example validates.

• Authorization and cookie headers redacted from WAF logs.
• GuardDuty findings page at severity 7+ and ticket at 4–6.9; Security Hub critical pages and high tickets, excluding GuardDuty-sourced findings so nothing alerts twice.
• SNS topics encrypted with a customer-managed key whose policy allows EventBridge to publish.

• Count mode first prevents a new rule from blocking legitimate traffic.
• A false positive is handled by overriding the single rule to count rather than disabling the whole managed group.

• WAF bills per web ACL, per rule and per million requests, and some managed rule groups add fees — enable only those that fit the application (figures in the cost doc are illustrative).
• GuardDuty is volume-based and Security Hub bills per check; both are cheap relative to an incident but worth tracking in large organizations.

No quantified results are published for this project. Figures from client work are confidential, and this portfolio only shows numbers that can be verified or reproduced.

• Detective controls without routing are just storage costs.
• In a real organization Checkov or OPA would likely replace the stdlib checker; it is stdlib here to stay dependency-free and show the rule logic.
• Known gaps, stated in the README: no scope-down statements, no DLQ on EventBridge targets, IPv4-only IP sets, and nothing has run in a real AWS account.