| // Weekly AWS cost report -> Slack | |
| // | |
| // Lambda (nodejs18.x) triggered by EventBridge every Friday 08:00 UTC: | |
| // cron(0 8 ? * FRI *) | |
| // | |
| // Pulls month-to-date usage, credits (MTD + YTD) and an end-of-month | |
| // forecast from Cost Explorer, then posts a Block Kit summary to Slack. | |
| // Slack webhook URL is read from SSM Parameter Store (SecureString). | |
| // | |
| // Env: |
The important pieces from my weekend hardening pass. All values anonymized (account IDs, emails, usernames). Code is straight from the live setup, just stripped of identifiers.
01-scps.tf — DenyServices (13 statements) + EnforceMFA.
Region pin, instance-class allowlist, audit-tamper denies,
| #!/bin/bash | |
| set -eu | |
| # ── SSM agent ──────────────────────────────────────────────────────────────── | |
| # We need the SSM agent for accessing Lightsail instances | |
| if ! snap services amazon-ssm-agent | grep -q 'active'; then | |
| snap stop amazon-ssm-agent || true | |
| fi | |
| /snap/amazon-ssm-agent/current/amazon-ssm-agent -register -y \ | |
| -id "${ssm_activation_id}" \ |
| #!/bin/bash | |
| retention_days=$1 | |
| if [ -z "$retention_days" ]; then | |
| echo "Usage: $0 <retention_days>" | |
| exit 1 | |
| fi | |
| regions=$(aws ec2 describe-regions \ |
| import AWS, { StepFunctions } from 'aws-sdk' | |
| import { v4 } from 'uuid' | |
| import { StartExecutionInput, StartExecutionOutput } from 'aws-sdk/clients/stepfunctions' | |
| interface StateMachineSubmission { | |
| customerId: string | |
| traceId: string | |
| } | |
| export class StateMachineService { |
I hereby claim:
To claim this, I am signing this object: