Cloud security templates
Cloud security setups you can copy, run, and check.
Most security work in cloud and infrastructure comes down to the same twenty or so setups. Audit logs that cannot be deleted. SSH that only takes keys. Somewhere safe to keep secrets. This site holds a working template for each one, in Terraform, Ansible, or Argo CD depending on where it runs, with a check at the end that proves it did the job.
Plain explanations with diagrams and real output, written for someone who has never opened one of these files. About twenty minutes end to end.
Each one names the problem, what you need first, the part that catches people, and a command that proves the result.
Templates you can use today
5 of the 15 results listed here have working code. Each comes in a short version to try and a longer version to keep.
Send cloud audit logs to storage that refuses deletes for a set number of days.
Turn off password logins and root logins, and check the config before restarting so you cannot lock yourself out.
Forward system logs to a collector so they outlive the machine that wrote them.
The first Application, which then manages every other application from Git.
Runtime alerts installed by the same pipeline that ships the workloads, so they cannot fall behind.
What is finished and what is not
Every result, every platform, every level. Planned work is listed so the gaps are easy to see.
Ready every check passed on the main branch Draft code exists, checks have not all passed Planned no code yet
| Template | Terraform | Ansible | Argo CD | ||||
|---|---|---|---|---|---|---|---|
| AWS | Azure | Google Cloud | Oracle Cloud | Linux | Windows | Kubernetes | |
| Audit logs nobody can deleteaudit-log-immutable | T0T1T2 | T0T1T2 | T0T1T2 | T0T1T2 | |||
| Lock SSH down to keys onlyssh-hardening | T0T1T2 | T0T1T2 | |||||
| Send host logs off the machinehost-log-shipping | T0T1T2 | T0T1T2 | |||||
| Block the changes you never wantguardrail-baseline | T0T1T2 | T0T1T2 | T0T1T2 | T0T1T2 | |||
| Check every resource against your rules, all the timecompliance-evaluation | T0T1T2 | T0T1T2 | T0T1T2 | T0T1T2 | |||
| Get cloud logs into your SIEMsiem-ingest | T0T1T2 | T0T1T2 | T0T1T2 | T0T1T2 | |||
| Emergency access that works when login is brokenbreakglass-identity | T0T1T2 | T0T1T2 | T0T1T2 | T0T1T2 | |||
| Shell access without opening a portbrokered-shell-access | T0T1T2 | T0T1T2 | T0T1T2 | T0T1T2 | |||
| Somewhere to keep secrets that rotates themsecrets-backend | T0T1T2 | T0T1T2 | T0T1T2 | T0T1T2 | |||
| Encryption keys you control and can switch offkey-baseline | T0T1T2 | T0T1T2 | T0T1T2 | T0T1T2 | |||
| Keep network records long enough to be usefulnetwork-flow-logs | T0T1T2 | T0T1T2 | T0T1T2 | T0T1T2 | |||
| Point Argo CD at a repositorygitops-bootstrap | T0T1T2 | ||||||
| See what containers are doing while they runk8s-runtime-security | T0T1T2 | ||||||
| An analysis machine that cannot reach productionforensic-workstation | T0T1T2 | T0T1T2 | |||||
| A safe place to keep Terraform statestate-backend | T0T1T2 | T0T1T2 | T0T1T2 | ||||
0 ready, 12 draft, 129 planned, out of 141 combinations of template, platform, and level. An empty cell means that platform does not apply.
Why the checks matter
Infrastructure code copied from the internet usually fails in one of two ways. It was written for an older version of the provider, or it never worked and nobody said so. Every template here runs through automatic checks on every change and again once a week, because providers change underneath code that nobody touched. What the checks look for.