v1.1.0 - More detections, full dashboards, SSM hardening, SCP docs, plain-text alerts

The smallest possible setup that emails you (or pings Slack/Teams) within minutes when something risky happens in your AWS account. Two CloudFormation stacks, no agents, no extra accounts, no SaaS. EventBridge + CloudWatch + SNS. Usually a few cents a month.

New detections (~30 rules now)

• Public Lambda function URLs created/updated with AuthType: NONE
• S3 bucket replication configured (data copied elsewhere)
• Bulk CloudWatch Logs export (CreateExportTask)
• RDS instances made publicly accessible
• New EC2 Client VPN endpoints
• KMS PutKeyPolicy (key policy changes that can grant cross-account access)
• IAM CreateLoginProfile (a programmatic user suddenly gets console access)
• AWS Organizations account joins and departures (opt-in: EnableOrganizationsMembershipDetection)
• IAM enumeration / reconnaissance (opt-in: EnableIamEnumerationDetection)

Stronger secure defaults

• Account hardening now also blocks public sharing of SSM documents in every enabled region, on top of S3 Block Public Access, default EBS encryption, public AMI/snapshot blocking, and IMDSv2.

Better visibility

• CloudWatch dashboards (local + global) now have a widget for every detection, grouped by category, so you can read account activity at a glance.

Self-protection

• Documented Service Control Policies (SCPs) so you can lock down the kit's own resources and hardening settings. An attacker should not be able to quietly delete your alarms before doing damage.

Cleaner alerts

• Every notification is now a human-readable plain-text key/value message. No JSON, no emoji, no raw CloudTrail blobs. Still pure SNS, no SES or Lambda required.

Implements #36 and #37; partially addresses #33 and #35.

Full changelog: v1.0.0...v1.1.0

v1.0.0

First tagged release.

The AWS Security Survival Kit (ASSK) is a free and open source project that turns CloudTrail into a small set of actionable alerts. Two CloudFormation stacks, a handful of EventBridge rules, an SNS topic. You get an email (or Slack / Teams via AWS Chatbot) the moment something obviously bad happens in your account. It complements GuardDuty, it is not a SIEM.

This release captures the state of the project after a major hardening and feature pass driven by community feedback (#32) and a follow-up security architect review.

New detections

• GuardDuty tampering and finding suppression (CreateFilter with action: ARCHIVE).
• Self-protection on the kit's own CloudFormation stacks (DeleteStack, UpdateTerminationProtection on ${Project}-*).
• Six new opt-in detections behind CloudFormation parameters: S3 bucket policy, Lambda, IAM Identity Center, VPC network infrastructure, IAM trust policy (UpdateAssumeRolePolicy), and AWS Organizations tampering.
• IPv6 admin-port exposure. The previous IPv4-only pattern was an invalid EventBridge wildcard that silently matched nothing; fixed and split.

Hardening

• SNS topic policy: sns:Subscribe and four other destructive actions removed from the wildcard-Principal statement. Subscribe via topic policy was a real alert-exfiltration path.
• Optional dedicated SNS KMS CMK behind EnableSnsEncryption=true, with chatbot.amazonaws.com in the key policy so AWS Chatbot keeps working when encryption is enabled.
• Account-level hardening now runs across every enabled region. EBS encryption default, AMI public-share block, snapshot public-share block, and IMDSv2 default are region-scoped APIs that were previously only applied in one region. S3 Block Public Access is and remains truly global.
• CloudFormation stack termination protection enabled by default by make deploy.
• Configurable AccessDeniedThreshold parameter (was hard-coded to 1, now defaults to 25 to cut alert fatigue).

Operational

• Works seamlessly under aws-vault, IRSA, ECS task role, and named profiles (the Profile Makefile variable is now optional).
• SkipRegions Makefile variable to skip regions known to be slow or non-functional in your account.
• Optional S3 staging for the regional template, which is now above the 51,200-byte CloudFormation inline limit.

Documentation

• README rewritten for clarity with foldable sections.
• New AGENT.md codifying project conventions for AI coding agents working in this repo.

Upgrading

If you are already running this kit from main, upgrading is a single make deploy. All new parameters default to backward-compatible values:

• Opt-in detections default to "false".
• The three back-compat-on noisy rules (GetCallerIdentity, BatchGetSecretValue, GetPasswordData) default to "true".
• EnableSnsEncryption defaults to "false".
• AccessDeniedThreshold defaults to 25 (more permissive than the previous hard-coded 1).

If the cfn-local.yml deploy fails with the 51,200-byte size error, set LocalS3Bucket=<existing-bucket-in-LocalAWSRegion> and GlobalS3Bucket=<existing-bucket-in-us-east-1> in the Makefile.

Links

• Pull request: #34
• Original suggestions thread that kicked this off: #32
• Tracker for additional detection ideas not yet implemented: #33

Free and open source, MIT.