GRC Compliance Dashboard

The CI/CD pipeline enforces shift-left security by automatically scanning dependencies for vulnerabilities before every deploy. There's no OS or runtime to patch in the first place — the serverless stack (S3, CloudFront, Lambda, API Gateway) has no instance layer for a CVE to land on.

• Snyk (SAST) checks package.json for vulnerable dependencies and fails the pipeline on high/critical.
• No EC2/OS layer to patch — AWS manages the Lambda runtime, CloudFront edge, and S3 storage layer entirely.
• CloudWatch Logs capture every Lambda invocation for ongoing monitoring and incident response.

The Lambda execution role is scoped to exactly the 3 SSM parameters it reads and CloudWatch Logs — nothing else. Both origins behind CloudFront (S3 and API Gateway) are reachable only through this specific distribution, enforced by Origin Access Control conditions rather than network-perimeter trust. Terraform itself runs via GitHub OIDC with scoped IAM — no long-lived AWS credentials stored anywhere.

• No SSH, no servers, no persistent compute to access at all — there's no shell to get into.
• Lambda's execution role: ssm:GetParameter on 3 specific parameter ARNs, nothing else.
• S3's bucket policy and the API Gateway origin both key off an Origin Access Control condition scoped to this exact CloudFront distribution's ARN — no other caller can reach either origin directly.

Terraform defines the entire baseline as code — S3 bucket policy, CloudFront cache and origin behaviors, Lambda configuration, and IAM roles. There's no instance userdata and no "golden image" to drift from a running server, because there's no server to drift.

• Every resource is declared in Terraform; there's no mutable instance state that can drift from it between deploys.
• The S3 bucket blocks all public access by default (all four Block Public Access settings) and is versioned.
• Every deploy replaces the Lambda function's code wholesale from a fresh build — no incremental patching of a running process.

CloudFront terminates TLS 1.2+ at the edge with an ACM-managed certificate (us-east-1, auto-renewing). Both origins behind it — S3 and API Gateway — are private and reject unauthenticated requests, so there's no unencrypted or untrusted hop anywhere in the request path, not even internally.

• CloudFront enforces TLS 1.2+ (the TLS 1.2_2021 policy) for every viewer connection; HTTP requests are redirected to HTTPS.
• ACM provides automatic certificate renewal with zero on-instance cert management — there's no instance.
• Origin traffic to S3 and API Gateway stays on AWS's own network backbone, authenticated via Origin Access Control rather than network-perimeter trust.