Rename CLAUDE.md to AGENTS.md and symlink it back

AGENTS.md

@@ -0,0 +1,51 @@
+# IaC Security Lab
+
+## Project Purpose
+Portfolio project demonstrating infrastructure-as-code security hardening,
+static analysis, and policy-as-code enforcement aligned with the CIS AWS
+Foundations Benchmark.
+
+Companion project to container-hardening-lab — same philosophy (hardened
+configs, failure demos, policy unit tests, CI pipeline) applied to Terraform
+infrastructure modules rather than container images.
+
+## Structure
+- /modules       — Hardened Terraform modules (s3, iam, vpc)
+- /examples      — Hardened and insecure root module examples
+- /policies/opa  — Rego policies evaluated by Conftest against HCL
+- /tests/opa     — OPA unit tests for every policy rule
+- /tests/terraform — Native terraform test configs
+
+## Standards
+- All modules align to CIS AWS Foundations Benchmark (note the specific
+  control number in every policy rule and README)
+- No wildcard Actions or Resources in IAM policies
+- All S3 buckets encrypted, versioned, and with public access blocked
+- All VPCs have flow logs enabled; no 0.0.0.0/0 ingress on sensitive ports
+- Every policy rule has a corresponding OPA unit test
+- Every suppressed tfsec finding in .tfsec.yml has a justification comment
+
+## Tools
+- Terraform 1.9.x for validate (no apply in CI)
+- tfsec for Terraform-native static analysis
+- Trivy (config mode) as a second scanner
+- Conftest + OPA for custom policy enforcement against HCL
+- Native terraform test for module unit tests
+
+## Conventions
+- Terraform: no hardcoded values, all inputs via variables with validation
+  blocks, all outputs documented with description attributes
+- Rego: same style as container-hardening-lab policies — annotated, with
+  deny[] for hard failures and warn[] for advisory findings
+- No real AWS credentials in CI — all checks are static analysis only
+- Makefile is the primary task interface, same pattern as container-hardening-lab
+- Commit style: focused commits, reference CIS control numbers where relevant
+- Documentation depth matches container-hardening-lab: annotated policies,
+  per-module READMEs, failure demo README, tool-decisions.md
+
+## Relationship to container-hardening-lab
+The two projects are designed to be read together. Where container-hardening-lab
+secures the runtime (what runs in a container), this project secures the
+infrastructure that hosts it (VPC, IAM, S3). Cross-reference where relevant —
+for example, the VPC module's private subnet design is where a hardened EKS
+cluster (from container-hardening-lab) would run.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md