Auto-Remediation · AWS CLI -- enforce SSE-S3 on all buckets

# Enable default encryption on every unencrypted bucket
aws s3api list-buckets --query 'Buckets[].Name' --output text | \
  tr '\t' '\n' | while read BUCKET; do
    aws s3api put-bucket-encryption \
      --bucket "$BUCKET" \
      --server-side-encryption-configuration '{
        "Rules":[{"ApplyServerSideEncryptionByDefault":
          {"SSEAlgorithm":"AES256"}}]}'
  done

# Verify (repeat for each bucket):
aws s3api get-bucket-encryption --bucket acmefs-customer-data-prod

Financial Exposure

Auto-Remediation · Terraform -- provision IR runbook S3 bucket and SNS alerting topic

resource "aws_s3_bucket" "ir_runbooks" {
  bucket = "acmefs-ir-runbooks-${var.env}"
  tags   = { Compliance = "SOC2-CC7.3" }
}

resource "aws_sns_topic" "ir_alerts" {
  name = "acmefs-incident-response"
}

resource "aws_sns_topic_subscription" "ir_email" {
  topic_arn = aws_sns_topic.ir_alerts.arn
  protocol  = "email"
  endpoint  = var.security_team_email
}

Financial Exposure

Auto-Remediation · AWS CLI -- rotate and scope third-party IAM credentials

# List all IAM users with access keys older than 90 days
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | \
  base64 -d | awk -F, '$10 != "N/A" && $10 < "$(date -d '-90 days' +%Y-%m-%d)"' | \
  cut -d, -f1

# For each stale user -- create new key, update secret, delete old key:
aws iam create-access-key --user-name stripe-webhook-prod
# (update key in vendor dashboard, then:)
aws iam delete-access-key --user-name stripe-webhook-prod \
  --access-key-id AKIA_OLD_KEY_ID

# Attach a least-privilege inline policy (example for Stripe webhook user):
aws iam put-user-policy \
  --user-name stripe-webhook-prod \
  --policy-name LeastPrivilege \
  --policy-document file://policies/stripe-webhook-policy.json

Financial Exposure