Configuration sécurisée des services cloud 2026

# s3-bucket-securise-reference.tf
# Bucket S3 avec tous les controles securite activement configures.
# Application : stockage sensible (PII, backups, logs d'audit).
 
resource "aws_s3_bucket" "secure_bucket" {
  bucket = "monorg-production-data-eu-west-3"
 
  tags = {
    Environment = "production"
    DataClass   = "sensitive"
    Owner       = "security-team"
  }
}
 
# Controle 1 : Block Public Access systematique
resource "aws_s3_bucket_public_access_block" "secure_bucket" {
  bucket                  = aws_s3_bucket.secure_bucket.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}
 
# Controle 2 : Chiffrement SSE-KMS avec CMK customer-managed
resource "aws_s3_bucket_server_side_encryption_configuration" "secure_bucket" {
  bucket = aws_s3_bucket.secure_bucket.id
 
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.bucket_cmk.arn
    }
    bucket_key_enabled = true
  }
}
 
# Controle 3 : Versioning pour recovery
resource "aws_s3_bucket_versioning" "secure_bucket" {
  bucket = aws_s3_bucket.secure_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}
 
# Controle 5 : Access logging vers bucket dedie
resource "aws_s3_bucket_logging" "secure_bucket" {
  bucket        = aws_s3_bucket.secure_bucket.id
  target_bucket = aws_s3_bucket.logs_bucket.id
  target_prefix = "s3-access-logs/monorg-production-data/"
}
 
# Controle 6 : Bucket policy refus explicite HTTP non-chiffre
resource "aws_s3_bucket_policy" "secure_bucket" {
  bucket = aws_s3_bucket.secure_bucket.id
 
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyInsecureTransport"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          aws_s3_bucket.secure_bucket.arn,
          "${aws_s3_bucket.secure_bucket.arn}/*"
        ]
        Condition = {
          Bool = {
            "aws:SecureTransport" = "false"
          }
        }
      }
    ]
  })
}
 
# Controle 7 : Object Lock pour immutabilite (compliance WORM)
# Note : doit etre active a la creation, pas activable apres
resource "aws_s3_bucket_object_lock_configuration" "secure_bucket" {
  bucket = aws_s3_bucket.secure_bucket.id
 
  rule {
    default_retention {
      mode = "COMPLIANCE"
      days = 2555  # 7 ans pour conformite RGPD/archivage
    }
  }
}

# rds-postgres-securise.tf
# Instance RDS PostgreSQL production avec defaults securises.
 
resource "aws_db_instance" "production_db" {
  identifier     = "monorg-prod-postgres"
  engine         = "postgres"
  engine_version = "16.4"
  instance_class = "db.r6g.large"
 
  allocated_storage     = 200
  max_allocated_storage = 1000
  storage_type          = "gp3"
 
  # Controle 1 : Encryption at rest OBLIGATOIRE a la creation
  storage_encrypted = true
  kms_key_id        = aws_kms_key.rds_cmk.arn
 
  # Controle 3 : Endpoint en subnet prive, pas public
  db_subnet_group_name   = aws_db_subnet_group.private.name
  publicly_accessible    = false
  vpc_security_group_ids = [aws_security_group.rds_allow_app.id]
 
  # Controle 4 : IAM authentication activee (moins de passwords)
  iam_database_authentication_enabled = true
 
  # Controle 5 : Master password dans Secrets Manager avec rotation
  manage_master_user_password = true
  master_user_secret_kms_key_id = aws_kms_key.rds_cmk.arn
 
  # Controle 6 : Backup 30 jours + PITR
  backup_retention_period   = 30
  backup_window             = "03:00-04:00"
  copy_tags_to_snapshot     = true
  delete_automated_backups  = false
  skip_final_snapshot       = false
 
  # Controle 7 : Multi-AZ pour resilience
  multi_az = true
 
  # Controle 8 : Logs exports vers CloudWatch
  enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]
 
  # Controle 9 : Performance Insights pour detection anomalies
  performance_insights_enabled          = true
  performance_insights_retention_period = 31
 
  # Controle 10 : Auto minor version upgrade
  auto_minor_version_upgrade = true
  deletion_protection        = true
 
  # Force SSL connections
  parameter_group_name = aws_db_parameter_group.force_ssl.name
 
  tags = {
    Environment = "production"
    DataClass   = "sensitive"
  }
}
 
resource "aws_db_parameter_group" "force_ssl" {
  family = "postgres16"
  name   = "monorg-postgres16-ssl-force"
 
  parameter {
    name  = "rds.force_ssl"
    value = "1"
  }
}

# verify-imdsv2-enforcement.sh
# Liste toutes les EC2 avec IMDSv1 encore autorise (risque).
 
aws ec2 describe-instances \
  --query 'Reservations[].Instances[?MetadataOptions.HttpTokens!=`required`].[InstanceId,State.Name,MetadataOptions.HttpTokens]' \
  --output table
 
# Pour basculer IMDSv2 enforced sur une instance existante (rolling)
aws ec2 modify-instance-metadata-options \
  --instance-id i-0abc1234567890def \
  --http-tokens required \
  --http-put-response-hop-limit 1
 
# Pour enforcer via account default (nouvelles instances)
aws ec2 modify-instance-metadata-defaults \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --instance-metadata-tags enabled

# anti-patterns-iam-cloud-2026.yml
# Top 10 anti-patterns IAM detectes systematiquement en audit Prowler/ScoutSuite.
 
anti_pattern_1:
  nom: "Policy avec Action: \"*\" et Resource: \"*\""
  impact: "Sur-privilege total, pivot trivial post-compromise"
  remedy: "Scoper Action a la liste explicite, Resource aux ARN precis"
 
anti_pattern_2:
  nom: "Access keys longue duree sans rotation"
  impact: "Credential qui traine, leak GitHub = crypto mining sous 60s"
  remedy: "IAM Identity Center + STS + rotation < 90 jours"
 
anti_pattern_3:
  nom: "Users IAM humains au lieu de federation SSO"
  impact: "Multiplication des identites, audit impossible"
  remedy: "IAM Identity Center (ex-AWS SSO), Entra ID, Workforce Identity"
 
anti_pattern_4:
  nom: "Permission boundaries non utilisees sur roles admin"
  impact: "Privilege escalation via creation de role over-privileged"
  remedy: "Permission boundary obligatoire sur delegation IAM"
 
anti_pattern_5:
  nom: "MFA non forcee"
  impact: "Credential stuffing / phishing triviaux"
  remedy: "SCP MFARequired sur toute operation sensible"
 
anti_pattern_6:
  nom: "Roles service assumables par n'importe quel compte"
  impact: "Cross-account takeover"
  remedy: "Trust policy restrictive avec external-id"
 
anti_pattern_7:
  nom: "Service accounts GCP avec keys JSON exportees"
  impact: "Credential en clair, leak = compromission totale"
  remedy: "Workload Identity Federation (cross-cloud) ou IAM Identity"
 
anti_pattern_8:
  nom: "Azure subscription Owner sur groupe large"
  impact: "Owner = delete subscription, transfert billing"
  remedy: "Contributor max, Owner reserve a 1-2 breakglass"
 
anti_pattern_9:
  nom: "Absence de monitoring IAM changes"
  impact: "Backdoor persistante non detectee"
  remedy: "CloudTrail + EventBridge alerts sur IAM policy change"
 
anti_pattern_10:
  nom: "Pas d'Access Analyzer actif"
  impact: "Ressources accessibles externes non identifiees"
  remedy: "IAM Access Analyzer + external-access findings reviews hebdo"

# audit-cloud-prowler.sh
# Audit initial complet d'un compte AWS avec Prowler.
# Duree typique : 10-30 minutes selon nombre de ressources.
 
# Installation
pip install prowler
 
# Audit AWS complet avec CIS v3.0
prowler aws \
  --compliance cis_3.0_aws \
  --output-formats html json-ocsf \
  --output-directory ./audit-$(date +%Y%m%d)
 
# Audit Azure avec CIS v3.0
prowler azure \
  --compliance cis_3.0_azure \
  --subscription-id 11111111-2222-3333-4444-555555555555
 
# Audit GCP avec CIS v2.1
prowler gcp \
  --compliance cis_2.1_gcp \
  --project-ids my-production-project
 
# Audit Kubernetes
prowler kubernetes --kubeconfig-file ~/.kube/config
 
# Rapport HTML dans ./audit-<date>/prowler-output-<timestamp>.html
# Triage : filtrer par severite HIGH + CRITICAL d'abord

# .gitlab-ci.yml extrait - pipeline IaC securise
# Valide chaque PR Terraform avec scan multi-outils avant apply.
 
stages:
  - validate
  - security
  - plan
  - apply
 
terraform-validate:
  stage: validate
  image: hashicorp/terraform:1.10.3
  script:
    - terraform fmt -check -recursive
    - terraform init -backend=false
    - terraform validate
 
tfsec:
  stage: security
  image: aquasec/tfsec-ci:v1.28.12
  script:
    - tfsec --soft-fail --format sarif --out tfsec.sarif .
    - tfsec --minimum-severity HIGH .
  artifacts:
    reports:
      sast: tfsec.sarif
 
checkov:
  stage: security
  image: bridgecrew/checkov:3.2.401
  script:
    - checkov --directory .
        --framework terraform
        --output json
        --output-file-path checkov.json
        --hard-fail-on HIGH,CRITICAL
 
opa-policy-validate:
  stage: security
  image: openpolicyagent/conftest:v0.60.0
  script:
    - conftest test terraform/ --policy policies/
 
terraform-plan:
  stage: plan
  image: hashicorp/terraform:1.10.3
  script:
    - terraform init
    - terraform plan -out=tfplan
  artifacts:
    paths:
      - tfplan
    expire_in: 7 days
  only:
    - merge_requests
 
terraform-apply:
  stage: apply
  image: hashicorp/terraform:1.10.3
  script:
    - terraform apply -auto-approve tfplan
  only:
    - main
  when: manual