Multi-Cloud Secure Baseline

A simple, secure starting point for deploying infrastructure and containers across AWS, GCP, and Azure.

This repository includes:

• Terraform code for three cloud providers.
• Docker examples built with security best practices.
• CI checks to catch configuration, container, and secret risks.

What this project does

This project helps deploy a multi-purpose and a consistent, secure environment in each cloud provider:

• AWS: network, encryption, audit logging, and threat detection.
• GCP: network, customer-managed encryption keys, audit logs, and IAM deployment support.
• Azure: secure network, key management, encrypted storage, logging, and Defender controls.

It also includes example container setups for a Python web app and NGINX that do not run as root.

Contents

Location	What it contains
terraform/aws/	AWS secure baseline: VPC, KMS, CloudTrail, GuardDuty, Security Hub, encrypted audit storage, flow logs
terraform/aws/bootstrap/	Setup for remote Terraform state using encrypted S3 and DynamoDB
terraform/gcp/	GCP secure baseline: VPC, CMEK, audit GCS bucket, log sink, deployer IAM role
terraform/azure/	Azure secure baseline: VNet, Key Vault, encrypted storage, NSGs, flow logs, Defender, Azure Policy
docker/examples/fastapi/	Hardened Python FastAPI image built in stages and run as a non-root user
docker/examples/nginx-unprivileged/	Hardened non-root NGINX image
docker/compose/docker-compose.prod.yml	Local deployment example with stricter runtime settings
.github/workflows/security.yml	Automated security checks for Terraform, Docker, and secrets

Who should use this

Use this repository if you need:

• A starting point for strong cloud security posture.
• A reusable template for AWS, GCP, and Azure infrastructure.
• Example container builds that follow safer Docker practices.
• Automated checks that run before changes reach production.

Prerequisites

Before you begin, install:

• Terraform 1.6 or newer.
• Docker 24 or newer.
• Cloud access configured for your environment.

For CI, it is best to use short-lived credentials or OIDC instead of long-lived cloud keys.

Quick start

1. Bootstrap remote state (AWS example)

This step creates the remote storage Terraform will use to save its state.

cd terraform/aws/bootstrap
terraform init
terraform apply -var="project=secure-baseline" -var="environment=production"

After this finishes, update terraform/aws/backend.tf with the values printed by Terraform.

2. Deploy the AWS baseline

cd terraform/aws
cp terraform.tfvars.example terraform.tfvars
terraform init
terraform plan
terraform apply

Repeat a similar process for GCP (backend "gcs") and Azure (backend "azurerm") using each cloud provider’s setup instructions.

3. Build the example containers

docker build -t secure-api:latest docker/examples/fastapi
docker build -t secure-nginx:latest docker/examples/nginx-unprivileged

docker compose -f docker/compose/docker-compose.prod.yml up --build

4. Run local security checks

pip install pre-commit
pre-commit install
pre-commit run --all-files

Important notes

• Replace placeholder values in each backend.tf file before terraform init.
• Use OIDC or short-lived cloud credentials in CI rather than permanent secrets.
• Pin production container references to digest values like image@sha256:....
• Review docs/COMPLIANCE.md with your team to align this baseline to your compliance needs.
• Keep separate environments isolated with separate state backends and variable files.

Variable files

Each cloud folder includes a terraform.tfvars.example file. Copy it to terraform.tfvars and fill in your real values. Do not commit secrets.

Continuous integration

The GitHub workflow runs the following checks on every push and pull request:

• Terraform formatting and validation for all cloud providers.
• Checkov policy scanning and Trivy configuration scanning.
• Docker image build and Trivy image scanning.
• Gitleaks secret scanning.

License

MIT — see LICENSE.

Security

If you find a security issue, see SECURITY.md for reporting instructions.