From af8cf09826462147ca712f0dfde04ab64fd03b7b Mon Sep 17 00:00:00 2001 From: Ross Tomsic Date: Sun, 9 Aug 2026 12:25:16 -0400 Subject: [PATCH] Rename CLAUDE.md to AGENTS.md and symlink it back Codex reads AGENTS.md and Claude Code reads CLAUDE.md; neither reads the other's. A symlink makes one file serve both, per R055LE/runbook decisions/0012. Content is unchanged. --- AGENTS.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ CLAUDE.md | 52 +--------------------------------------------------- 2 files changed, 52 insertions(+), 51 deletions(-) create mode 100644 AGENTS.md mode change 100644 => 120000 CLAUDE.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..a29ba5c --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,51 @@ +# IaC Security Lab + +## Project Purpose +Portfolio project demonstrating infrastructure-as-code security hardening, +static analysis, and policy-as-code enforcement aligned with the CIS AWS +Foundations Benchmark. + +Companion project to container-hardening-lab — same philosophy (hardened +configs, failure demos, policy unit tests, CI pipeline) applied to Terraform +infrastructure modules rather than container images. + +## Structure +- /modules — Hardened Terraform modules (s3, iam, vpc) +- /examples — Hardened and insecure root module examples +- /policies/opa — Rego policies evaluated by Conftest against HCL +- /tests/opa — OPA unit tests for every policy rule +- /tests/terraform — Native terraform test configs + +## Standards +- All modules align to CIS AWS Foundations Benchmark (note the specific + control number in every policy rule and README) +- No wildcard Actions or Resources in IAM policies +- All S3 buckets encrypted, versioned, and with public access blocked +- All VPCs have flow logs enabled; no 0.0.0.0/0 ingress on sensitive ports +- Every policy rule has a corresponding OPA unit test +- Every suppressed tfsec finding in .tfsec.yml has a justification comment + +## Tools +- Terraform 1.9.x for validate (no apply in CI) +- tfsec for Terraform-native static analysis +- Trivy (config mode) as a second scanner +- Conftest + OPA for custom policy enforcement against HCL +- Native terraform test for module unit tests + +## Conventions +- Terraform: no hardcoded values, all inputs via variables with validation + blocks, all outputs documented with description attributes +- Rego: same style as container-hardening-lab policies — annotated, with + deny[] for hard failures and warn[] for advisory findings +- No real AWS credentials in CI — all checks are static analysis only +- Makefile is the primary task interface, same pattern as container-hardening-lab +- Commit style: focused commits, reference CIS control numbers where relevant +- Documentation depth matches container-hardening-lab: annotated policies, + per-module READMEs, failure demo README, tool-decisions.md + +## Relationship to container-hardening-lab +The two projects are designed to be read together. Where container-hardening-lab +secures the runtime (what runs in a container), this project secures the +infrastructure that hosts it (VPC, IAM, S3). Cross-reference where relevant — +for example, the VPC module's private subnet design is where a hardened EKS +cluster (from container-hardening-lab) would run. \ No newline at end of file diff --git a/CLAUDE.md b/CLAUDE.md deleted file mode 100644 index a29ba5c..0000000 --- a/CLAUDE.md +++ /dev/null @@ -1,51 +0,0 @@ -# IaC Security Lab - -## Project Purpose -Portfolio project demonstrating infrastructure-as-code security hardening, -static analysis, and policy-as-code enforcement aligned with the CIS AWS -Foundations Benchmark. - -Companion project to container-hardening-lab — same philosophy (hardened -configs, failure demos, policy unit tests, CI pipeline) applied to Terraform -infrastructure modules rather than container images. - -## Structure -- /modules — Hardened Terraform modules (s3, iam, vpc) -- /examples — Hardened and insecure root module examples -- /policies/opa — Rego policies evaluated by Conftest against HCL -- /tests/opa — OPA unit tests for every policy rule -- /tests/terraform — Native terraform test configs - -## Standards -- All modules align to CIS AWS Foundations Benchmark (note the specific - control number in every policy rule and README) -- No wildcard Actions or Resources in IAM policies -- All S3 buckets encrypted, versioned, and with public access blocked -- All VPCs have flow logs enabled; no 0.0.0.0/0 ingress on sensitive ports -- Every policy rule has a corresponding OPA unit test -- Every suppressed tfsec finding in .tfsec.yml has a justification comment - -## Tools -- Terraform 1.9.x for validate (no apply in CI) -- tfsec for Terraform-native static analysis -- Trivy (config mode) as a second scanner -- Conftest + OPA for custom policy enforcement against HCL -- Native terraform test for module unit tests - -## Conventions -- Terraform: no hardcoded values, all inputs via variables with validation - blocks, all outputs documented with description attributes -- Rego: same style as container-hardening-lab policies — annotated, with - deny[] for hard failures and warn[] for advisory findings -- No real AWS credentials in CI — all checks are static analysis only -- Makefile is the primary task interface, same pattern as container-hardening-lab -- Commit style: focused commits, reference CIS control numbers where relevant -- Documentation depth matches container-hardening-lab: annotated policies, - per-module READMEs, failure demo README, tool-decisions.md - -## Relationship to container-hardening-lab -The two projects are designed to be read together. Where container-hardening-lab -secures the runtime (what runs in a container), this project secures the -infrastructure that hosts it (VPC, IAM, S3). Cross-reference where relevant — -for example, the VPC module's private subnet design is where a hardened EKS -cluster (from container-hardening-lab) would run. \ No newline at end of file diff --git a/CLAUDE.md b/CLAUDE.md new file mode 120000 index 0000000..47dc3e3 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1 @@ +AGENTS.md \ No newline at end of file