fsi-foundation-governance-base

Files (86)

• SKILL.md
• SKILL_ja.md
• cdk-nag-test.template.ts · assets/
• afc-servicecatalog-productlist.png · assets/images/
• afc-setup-result.png · assets/images/
• .gitignore · assets/resources/bleafsi-shared-constructs/v1.0.0/
• cdk.json · assets/resources/bleafsi-shared-constructs/v1.0.0/
• Bucket.png · assets/resources/bleafsi-shared-constructs/v1.0.0/doc-image/
• PrivateVpc.png · assets/resources/bleafsi-shared-constructs/v1.0.0/doc-image/
• PublicVpc.png · assets/resources/bleafsi-shared-constructs/v1.0.0/doc-image/
• doc-readme.md · assets/resources/bleafsi-shared-constructs/v1.0.0/
• .nojekyll · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/
• README.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/
• Bucket.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/classes/
• Ecr.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/classes/
• IamRole.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/classes/
• KmsKey.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/classes/
• PrivateVpc.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/classes/
• PublicVpc.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/classes/
• Waf.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/classes/
• VpcEndpointTypeName.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/enums/
• BucketProps.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/interfaces/
• EcrProps.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/interfaces/
• IamRoleProps.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/interfaces/
• KmsKeyProps.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/interfaces/
• VpcProps.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/interfaces/
• WafProps.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/interfaces/
• Bucket.png · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/media/
• PrivateVpc.png · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/media/
• PublicVpc.png · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/media/
• modules.md · assets/resources/bleafsi-shared-constructs/v1.0.0/doc/
• bleafsi-ecr.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/lib/
• bleafsi-iam-role.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/lib/
• bleafsi-kms-key.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/lib/
• bleafsi-s3-bucket.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/lib/
• bleafsi-vpc.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/lib/
• bleafsi-waf.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/lib/
• index.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/lib/
• package.json · assets/resources/bleafsi-shared-constructs/v1.0.0/
• bleafsi-shared-constructs-test-app.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/test/
• bleafsi-shared-constructs.test.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/test/
• ecr-stack.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/test/
• iam-role-stack.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/test/
• kms-key-stack.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/test/
• s3-stack.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/test/
• vpc-stack.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/test/
• waf-stack.ts · assets/resources/bleafsi-shared-constructs/v1.0.0/test/
• tsconfig.json · assets/resources/bleafsi-shared-constructs/v1.0.0/
• typedoc.json · assets/resources/bleafsi-shared-constructs/v1.0.0/
• .gitignore · assets/sample-cdk/base-ct-guest/
• SECURITY_NOTICE.md · assets/sample-cdk/base-ct-guest/
• bleafsi-base-ct-guest.ts · assets/sample-cdk/base-ct-guest/bin/
• parameter.ts · assets/sample-cdk/base-ct-guest/bin/
• cdk.json · assets/sample-cdk/base-ct-guest/
• jest.config.js · assets/sample-cdk/base-ct-guest/
• bleafsi-base-ct-guest-stack.ts · assets/sample-cdk/base-ct-guest/lib/
• cloudtrail-dataevent.ts · assets/sample-cdk/base-ct-guest/lib/
• cloudtrail-trail.ts · assets/sample-cdk/base-ct-guest/lib/
• iam-sample.ts · assets/sample-cdk/base-ct-guest/lib/
• security-alarm.ts · assets/sample-cdk/base-ct-guest/lib/
• …and 26 more

SKILL.md (first lines)

# FSI Governance Base (ガバナンスベース)

## Workload Overview

The Governance Base is the shared, foundational layer of BLEA for FSI (Baseline
Environment on AWS for Financial Services Institute). It establishes a secure baseline
across a multi-account AWS environment so that every other FSI workload (core-banking,
customer-channel, open-api, market-data, analytics-platform, etc.) is deployed on top of
consistent, FISC-aligned governance.

It is built on top of AWS Control Tower and AWS Organizations and provides, across all
accounts in the organization:

- **Multi-account governance** — AWS Control Tower manages the landing zone (management,
  Audit, and Log Archive accounts plus guest accounts). Security services that Control
  Tower does not cover are bulk-enabled at the AWS Organizations level so that newly
  created accounts inherit them automatically.
- **Guardrails (Control Tower コントロール)** — preventive and detective controls
  (implemented internally with SCPs and AWS Config rules) selected against FISC
  安全対策基準 第11版 実務基準.
- **Centralized logging (ログ集約)** — CloudTrail management-event logs and AWS Config
  configuration history are aggregated into the Log Archive account; a dedicated
  aggregation S3 bucket is provisioned there for CloudTrail S3 data-event logs.
- **Security detection & notification** — Security Hub, GuardDuty, Config, CloudTrail and
  IAM Access Analyzer enablement, plus CloudWatch metric-filter alarms and EventBridge
  rules that deliver security alerts by email through SNS, and Config auto-remediation.
- **IAM baseline** — sample IAM policies/roles/groups for four administrator roles.

The Governance Base is deployed with two CDK samples: `base-ct-guest` (per guest account
baseline, primary + optional secondary/Osaka region) and `base-ct-logging` (the Log
Archive account aggregation bucket). It targets an AWS Control Tower environment but can
also be reproduced in a single-account / non-Control-Tower environment.

## Best Practices and Key Components

### Best Practices

- MUST: Set up AWS Control Tower first; several governance features are configured
  automatically by Control Tower when the landing zone is established.
- MUST: Enable AWS Security Hub, Amazon GuardDuty and IAM Access Analyzer for the whole
  AWS Organization, delegating administration to the Audit account, so that every new
  account inherits them automatically.
- MUST: Deploy the Log Archive account governance base (`base-ct-logging`) before enabling
  CloudTrail S3 data-event capture, because the aggregation S3 bucket it creates is the
  destination for those logs.
- MUST: Enable the additional Control Tower guardrails recommended for FISC on the target
  OUs from the Control Tower management account (marked "◯" in the FISC mapping).
- MUST: Ensure the deployment `account` value in `parameter.ts` matches the account of the
  AWS CLI profile used, so a workload is never deployed to the wrong account.
- MUST: Block Amazon S3 public access at the account level for each guest account after
  deployment.
- MUST NOT: Create the `AWSControlTowerBlueprintAccess` IAM role for Control Tower AFC
  under any role other than `AWSControlTowerExecution` in the Service Catalog hub account
  — SCPs will otherwise cause the operation to fail.
- SHOULD: Use AWS IAM Identity Center (formerly AWS SSO) for authentication in a Control
  Tower environment rather than long-lived credentials, and enforce MFA on every sign-in.
- SHOULD: Enable CloudTrail S3 data-event recording for buckets that hold user data, to
  meet FISC 実務基準 expectations (optional, off by default).
- SHOULD: Remediate CRITICAL / HIGH Security Hub findings that remain after deployment;
  the baseline does not resolve all of them automatically.
- SHOULD: Specify the `account` field explicitly for Staging and Production environments
  in `parameter.ts`.
- PREFER: Provision the guest-account governance base automatically at account-creation
  time via Control Tower Account Factory Customization (AFC) using a Service Catalog
  blueprint, over manual per-account CDK deployment, when onboarding many accounts.
- MAY: Deploy the guest governance base to the Osaka region (ap-northeast-3) as a
  secondary region for a multi-region configuration; omit `secondary.region` if not used.
- MAY: Enable additional operational baselines manually (Systems Manager Quick Setup,
  Trusted Advisor reports, Amazon Macie) per requirements.
- WILL: Control Tower Landing Zone v3.0 aggregates CloudTrail logs into the management
  account's CloudWatch Logs and stops creating a per-guest-account log group, which
  requires the `base-ct-guest` source to be adjusted for some environments.
- WILL: Because BLEA for FSI creates its own guest-account CloudTrail trail for alerting,
  CloudTrail trails may be recorded in duplicate (the Control Tower organization-level
  trail and the BLEA for FSI guest-account trail).
- WILL: Auto-remediation of the default security group (Config rule
  `VPC_DEFAULT_SECURITY_GROUP_CLOSED`) is not deployed in the Osaka region because the
  SSM document `AWSConfigRemediation-RemoveVPCDefaultSecurityGroupRules` is unavailable
  there.
- MUST: Apply cdk-nag's AwsSolutionsChecks (via Aspects) to every CDK stack built from this skill, and gate CI (jest etc.) on zero unsuppressed AwsSolutions-* findings; suppress exceptions only with an explicit reason via NagSuppressions (see references/cdk-nag.md).

### Key Components

#### base-ct-logging Stack (Log Archive account)

- **Component Overview**: Deployed to the Control Tower Log Archive account. Creates the
  aggregation S3 bucket (`BLEAFSI-LogBase`, name `bleafsi-logbase-shared-log-<account>`)
  used to store CloudTrail S3 data-event logs and Osaka-region Config data, with a
  1825-day (5-year) lifecycle expiration, a policy denying `s3:DeleteObject`, and delivery
  permissions for `cloudtrail.amazonaws.com` and `config.amazonaws.com`. The bucket name
  is emitted as a CloudFormation output.
- **Assumed AWS Services**: Amazon S3, AWS IAM, AWS CloudFormation (via AWS CDK).

#### CloudTrail Trail (base-ct-guest)

- **Component Overview**: Creates a guest-account CloudTrail trail so that account-local
  alerting works even after Control Tower LZ v3.0. Provisions a trail-log S3 bucket
  (180-day lifecycle), a KMS CMK for CloudTrail-log encryption, and a CloudWatch Logs log
  group (3-month retention) with file validation and global service events enabled. This
  block can be swapped for referencing the existing `aws-controltower/CloudTrailLogs` log
  group, depending on the Landing Zone version.
- **Assumed AWS Services**: AWS CloudTrail, Amazon S3, AWS KMS, Amazon CloudWatch Logs.

#### Security Alarm (base-ct-guest)

- **Component Overview**: Defines security alerts delivered by email through an SNS topic.
  Uses four CloudWatch Logs metric-filter alarms over the CloudTrail log group (IAM policy
  change, multiple unauthorized/failed attempts, new access-key creation, root-user
  activity) and seven EventBridge rules (Config rule compliance change, AWS Health events,
  Security Group changes, Network ACL changes, CloudTrail configuration changes, Security
  Hub CRITICAL/HIGH findings, GuardDuty findings of severity 4 and above). The SNS topic
  enforces publish-over-SSL only.
- **Assumed AWS Services**: Amazon CloudWatch (alarms & Logs), Amazon EventBridge, Amazon
  SNS, AWS IAM.

#### Security Auto-Remediation (base-ct-guest)

- **Component Overview**: Creates the AWS Config managed rule
  `VPC_DEFAULT_SECURITY_GROUP_CLOSED` (rule name `bb-default-security-group-closed`) and an

From aws-samples/sample-fsi-reference-architecture-jp, MIT-0.

More from aws-samples/sample-fsi-reference-architecture-jp