Provides AWS CloudFormation patterns for security infrastructure: KMS encryption, Secrets Manager, IAM least privilege, VPC security, ACM certificates, parameter security, and cross-stack references. Use for AWS security best practices.
From developer-kit-awsnpx claudepluginhub giuseppe-trisciuoglio/developer-kit --plugin developer-kit-awsThis skill is limited to using the following tools:
references/constraints.mdreferences/examples.mdreferences/reference.mdGuides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Migrates code, prompts, and API calls from Claude Sonnet 4.0/4.5 or Opus 4.1 to Opus 4.5, updating model strings on Anthropic, AWS, GCP, Azure platforms.
Optimizes cloud costs on AWS, Azure, GCP via rightsizing, tagging strategies, reserved instances, spot usage, and spending analysis. Use for expense reduction and governance.
Create production-ready security infrastructure using AWS CloudFormation templates. This skill covers KMS encryption, Secrets Manager, IAM security with least privilege, VPC security configurations, ACM certificates, parameter security, secure outputs, cross-stack references, CloudWatch Logs encryption, defense in depth strategies, and security best practices.
Follow these steps to create security infrastructure with CloudFormation:
Create customer-managed keys for encryption:
Resources:
EncryptionKey:
Type: AWS::KMS::Key
Properties:
Description: Customer-managed key for data encryption
KeyPolicy:
Statement:
- Effect: Allow
Principal:
Service: lambda.amazonaws.com
Action:
- kms:Decrypt
- kms:GenerateDataKey
Resource: "*"
- Effect: Allow
Principal:
AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
Action:
- kms:*
Resource: "*"
KeyAlias:
Type: AWS::KMS::Alias
Properties:
AliasName: !Sub "${AWS::StackName}/encryption-key"
TargetKeyId: !Ref EncryptionKey
Validate: aws kms get-key-policy --key-id <key-id> --output text
Store and retrieve sensitive data securely:
Resources:
DatabaseSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: !Sub "${AWS::StackName}/database"
Description: Database credentials
SecretString: !Sub |
{
"username": "admin",
"password": "${DatabasePassword}",
"engine": "mysql",
"host": "${DatabaseEndpoint}",
"port": 3306
}
KmsKeyId: !Ref EncryptionKey
SecretRotationSchedule:
Type: AWS::SecretsManager::RotationSchedule
Properties:
SecretId: !Ref DatabaseSecret
RotationLambdaARN: !Ref RotationLambda.Arn
RotationRules:
AutomaticallyAfterDays: 30
Validate: aws secretsmanager describe-secret --secret-id <secret-name>
Create roles and policies with minimal required permissions:
Resources:
ExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: lambda.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
Policies:
- PolicyName: SpecificPermissions
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- s3:GetObject
Resource: !Sub "${DataBucket.Arn}/*"
Validate: aws iam simulate-principal-policy --policy-source-arn <role-arn> --action-names s3:GetObject --resource-arns <bucket-arn>
Implement network security with security groups and NACLs:
Resources:
ApplicationSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Application security group
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 443
ToPort: 443
SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
SecurityGroupEgress:
- IpProtocol: -1
CidrIp: 0.0.0.0/0
ApplicationNACL:
Type: AWS::EC2::NetworkAcl
Properties:
VpcId: !Ref VPC
NACLEntry:
Type: AWS::EC2::NetworkAclEntry
Properties:
NetworkAclId: !Ref ApplicationNACL
RuleNumber: 100
Protocol: "6"
RuleAction: allow
Egress: false
CidrBlock: 0.0.0.0/0
PortRange:
From: 443
To: 443
Validate: aws ec2 describe-security-groups --group-ids <sg-id> --query 'SecurityGroups[0].IpPermissions'
Manage TLS/SSL certificates for secure communication:
Resources:
Certificate:
Type: AWS::ACM::Certificate
Properties:
DomainName: !Ref DomainName
SubjectAlternativeNames:
- !Sub "www.${DomainName}"
- !Sub "api.${DomainName}"
DomainValidationOptions:
- DomainName: !Ref DomainName
ValidationDomain: !Ref DomainName
Tags:
- Key: Environment
Value: !Ref Environment
# DNS validation record
DnsValidationRecord:
Type: AWS::Route53::RecordSet
Properties:
HostedZoneName: !Ref HostedZone
Name: !Sub "_${DomainName}."
Type: CNAME
TTL: 300
ResourceRecords:
- !Ref Certificate
Validate: aws acm describe-certificate --certificate-arn <arn> --query 'Certificate.Status'
Use SecureString for sensitive parameter values:
Resources:
DatabasePasswordParameter:
Type: AWS::SSM::Parameter
Properties:
Name: !Sub "/${AWS::StackName}/database/password"
Type: SecureString
Value: !Ref DatabasePassword
Description: Database master password
KmsKeyId: !Ref EncryptionKey
# Reference in other resources
DatabaseInstance:
Type: AWS::RDS::DBInstance
Properties:
MasterUsername: admin
MasterUserPassword: !Ref DatabasePasswordParameter
Validate: aws ssm get-parameter --name <param-name> --with-decryption --query 'Parameter.Type'
Export only non-sensitive values from stacks:
Outputs:
# Safe to export
KMSKeyArn:
Description: KMS Key ARN for encryption
Value: !GetAtt EncryptionKey.Arn
Export:
Name: !Sub "${AWS::StackName}-KMSKeyArn"
SecretArn:
Description: Secret ARN (not the secret value)
Value: !Ref DatabaseSecret
Export:
Name: !Sub "${AWS::StackName}-SecretArn"
# DO NOT export sensitive data
# Incorrect:
# SecretValue:
# Value: !GetAtt DatabaseSecret.SecretString
Validate: aws cloudformation list-exports --query "Exports[?Name=='<stack-name>-KMSKeyArn']"
Enable encryption for log groups:
Resources:
EncryptedLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: !Sub "/aws/applications/${ApplicationName}"
RetentionInDays: 30
KmsKeyId: !Ref EncryptionKey
Validate: aws logs describe-log-groups --log-group-name-prefix <prefix> --query 'logGroups[0].kmsKeyId'
Resources:
# KMS Key with proper policy
AppKey:
Type: AWS::KMS::Key
Properties:
KeyPolicy:
Statement:
- Effect: Allow
Principal:
AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
Action: kms:*
Resource: "*"
- Effect: Allow
Principal:
Service: lambda.amazonaws.com
Action:
- kms:Decrypt
- kms:GenerateDataKey
Resource: "*"
# Secrets Manager with rotation
DbSecret:
Type: AWS::SecretsManager::Secret
Properties:
SecretString: !Sub '{"password":"${DbPassword}"}'
KmsKeyId: !Ref AppKey
RotationRules:
AutomaticallyAfterDays: 30
Resources:
LambdaRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: lambda.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: AccessPolicy
PolicyDocument:
Statement:
- Effect: Allow
Action: s3:GetObject
Resource: !Sub "${Bucket.Arn}/*"
For comprehensive examples with VPC security groups, ACM certificates, and complete encrypted infrastructure stacks, see examples.md.
For detailed constraints including cost considerations and quota management, see constraints.md.
For detailed implementation guidance, see: