Infrastructure policies for Terraform

Ensures CloudTrail records global service events for complete monitoring.

Ensures S3 buckets enforce public access blocks to prevent unintended exposure.

Ensures that CloudTrail log file validation is enabled to verify log integrity.

Ensures that CloudTrail logs are encrypted using a KMS key for data protection.

Facilitates near real-time monitoring and alerting on CloudTrail events.

Ensures that all VPC traffic is logged for auditing and threat detection.

Ensures CloudTrail is configured to record events in all regions for comprehensive logging.

Ensures that VPC subnetworks log flow data for auditing and compliance.

Ensures that network security group flow logs are enabled for auditing and compliance.

Prevents use of default VPCs to enforce custom network segmentation.

Captures audit trails by ensuring diagnostic logging is enabled on Azure resources.

Helps ensure data in transit is encrypted by restricting HTTP access.

Helps ensure secure credentials for Azure users via Azure AD password complexity.

Enforces annual rotation for AWS KMS Customer Managed Keys.

Ensures that AWS RDS instances are encrypted to safeguard stored personal data.

Blocks public traffic by disallowing 0.0.0.0/0 in Azure Network Security Group rules.

Prevents anonymous access to GCS data.

Blocks direct internet exposure for Azure SQL databases.

Ensures GCS data is encrypted at rest using KMS.

Ensures data at rest is encrypted by default on Azure Storage.

Prevents anonymous access to blob containers or file shares.

Ensures data at rest is protected on Azure VM disks.

Blocks direct internet exposure of Cloud SQL instances.

Provides visibility into configuration changes by recording all supported resources.

Prevents public exposure by disallowing 0.0.0.0/0 in GCP firewall ingress.

Helps ensure database instances are not directly exposed to the internet.

Ensures data at rest is protected on GCE persistent disks.

Prevents accidental exposure of S3 data to the internet.

Ensures data at rest is protected on EBS volumes.

Prevents unintended public exposure by disallowing 0.0.0.0/0 in security group ingress.

Ensures IAM users have sufficiently complex passwords.

Ensures S3 data is encrypted at rest.

Facilitates real-time monitoring and alerting on CloudTrail events.

Sending CloudTrail logs to CloudWatch is important because it makes it easier to monitor AWS API activity in real time and set up automated alerts. By streaming CloudTrail events into CloudWatch, you can quickly detect suspicious actions—like unexpected IAM user logins or resource deletions—and trigger alarms or automated responses.

Protects EBS volumes by requiring an encryption with a KMS key.