Security that ships as code, not slide decks

# Security baseline - delivered as code you own
module "security_baseline" {
  source  = "./modules/aws-security-baseline"

  environment = "production"
  region      = "eu-central-1"

  # Security controls - all enabled by default
  enable_guardduty     = true
  enable_security_hub  = true
  enable_config_rules  = true
  enable_cloudtrail    = true

  # Compliance mapping
  frameworks = ["CIS", "ISO27001", "NIS2"]
}

# You own this code. No vendor lock-in.
output "security_hub_arn" { value = module.security_baseline.hub_arn }

# Policy-as-code - enforce before deployment
package aws.security.baseline

import future.keywords.if
import future.keywords.in

# Block unencrypted storage
deny[msg] if {
  resource := input.planned_values.root_module.resources[_]
  resource.type == "aws_s3_bucket"
  not resource.values.server_side_encryption_configuration
  msg := sprintf("S3 bucket %s requires encryption", [resource.name])
}

# Block public access
deny[msg] if {
  resource := input.planned_values.root_module.resources[_]
  resource.type == "aws_security_group"
  rule := resource.values.ingress[_]
  rule.cidr_blocks[_] == "0.0.0.0/0"
  msg := "Security group allows unrestricted ingress"
}

# Shift-left: catch violations in CI/CD