Log 01 · Season status
Reading /evidence/status.json…
One command each way: make demo staffs the tower, deploying
the full stack and generating fresh evidence in about 15 minutes; make teardown
strikes every daily-billing resource and leaves this page serving the final report. Between
windows the environment idles at ~$0, the same discipline the rest of the boardwalk runs on.
Log 02 · The watch
What deploys during a demo window
Terraform stands up the whole account-hardening reference in one apply:
Alongside the pipeline: a customer-managed KMS key with
automatic rotation sealing the audit trail, and an IAM permissions boundary
exhibit. That role's policy grants more than its boundary allows, and the report below proves
it neutered via iam:SimulatePrincipalPolicy. Standing orders hold: the watch may
read the record, never rewrite it.
Log 03 · The practice smoke
Light a practice smoke, watch the account catch it
A drill opens port 22 to the whole internet on a sandbox security group that is attached to nothing, in a VPC with no subnets and no way out. Nothing is ever exposed. What the drill exercises is the part that matters: two independent detectors racing to catch the change. An event-driven tripwire (EventBridge on the CloudTrail authorize event) fires a Lambda that revokes the rule automatically, and AWS Config's restricted-ssh inspector rules on the same group on its own slower cadence. Both are shown live; every call lands in the KMS-encrypted trail.
Recent drills
Log 04 · The policy desk
The policy desk
IAM bills nothing, so this desk is open year-round, even while the season stack is struck. Two read-only evaluations, straight from AWS: the permissions boundary proven by the policy simulator, and any policy run through Access Analyzer's own validator.
Boundary simulator
The sec-boundary-demo role's policy grants read and
write on the site bucket, but its boundary ceilings read. Effective permission is the
intersection. iam:SimulatePrincipalPolicy proves each case, live.
Policy validator
Access Analyzer's ValidatePolicy lints a policy document and
returns its own findings verbatim. Pick a specimen, or paste your own. The linter only reads a
document, it changes nothing.
or paste your own policy JSON
Log 05 · The perimeter fence
The perimeter fence log
The whole boardwalk sits behind one shared AWS WAF edge ACL: a per-IP rate limit,
Amazon's IP reputation list, and the known-bad-inputs set (Log4j probes and the like). This is its
last few hours of real sampled traffic across all thirteen sites, straight from
GetSampledRequests at $0. Client addresses are masked on purpose: the exhibit is the
hostile traffic, not the senders.
Log 06 · The evidence
Latest evidence report
–
No evidence has been generated yet. The first
make demo cycle will populate this section.
Audit trail · CloudTrail
Encryption · KMS
Threat detection · GuardDuty sample findings
Smoke field guide · what the watch is trained to see
Security Hub · FSBP
NIST 800-53 rev 5 conformance pack
Permissions boundary · simulated proof
| Action | Decision |
|---|
Log 07 · The season ledger
Posture across the season
Each demo window files one row. Security Hub and Config coverage deepens for a couple of hours after every deploy, so a longer-staffed window posts higher passes. That trend is the point: a security posture is a thing you watch over a season, not a single snapshot.
Log 08 · Why it matters
What this plank proves
- Compliance automation, not compliance paperwork: the NIST 800-53 rev 5 conformance pack evaluates 130 managed Config rules against the live account, and the evidence report is generated from API results. That is the findings-to-evidence motion an ATO package needs, automated end to end.
- The full native security stack, wired together: CloudTrail writing KMS-encrypted, integrity-validated audit logs; GuardDuty detections and Config evaluations aggregating into Security Hub as the single pane.
- Detection that responds, watched live: a visitor can stage a safe misconfiguration and watch an event-driven tripwire remediate it automatically while AWS Config rules on the same change independently. The honest contrast between the two, timed on the page, is the exhibit: cloud-native detection is fast, but it is not instant, and knowing the difference is the job.
- Least privilege beyond policies: a permissions boundary exhibit proves the ceiling holds even when an attached policy over-grants, verified live by IAM's own policy simulator, not by assertion. The policy desk and the shared WAF's fence log stay open year-round, because IAM and the edge ACL cost nothing to keep on.
- Cost-honest architecture: these services bill daily, so the plank is deploy-demo-teardown by design. One command up, one command down, evidence persisted between windows. Knowing when not to leave something running is part of the skillset.
- Real checks against a real estate: Security Hub and Config evaluate the whole demo account, including the nine always-on planks, so passes and failures above are genuine posture, not a staged fixture.