ahnyongjooandClaude Sonnet 5.5
964a841de1
- Code\rebar_pipeline, review_pipeline, pier-program을 정션에서 실제 폴더로 전환 - Code\rhino_mcp 및 CLAUDE_rhino배경.md 추가, .mcp.json은 PYTHONPATH로 새 위치 사용 - pier-program 내부 .git 제거(이력은 backup\pier-program_20261028.bundle에 보관) - worktree 가이드 반영(CLAUDE.local.md, HANDOFF.md) - D:\Rhino-MCP 경로 참조를 새 위치로 치환 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
131 lines
3.1 KiB
Plaintext
131 lines
3.1 KiB
Plaintext
# Security Layer Templates — Auto-generated by hmcmkit security-architect
|
|
# 8 Security Components for Enterprise deployments
|
|
|
|
---
|
|
# 1. CloudFront Distribution
|
|
apiVersion: cloudfront
|
|
kind: Distribution
|
|
spec:
|
|
origins:
|
|
- domainName: ${alb_domain}
|
|
originProtocolPolicy: https-only
|
|
defaultCacheBehavior:
|
|
viewerProtocolPolicy: redirect-to-https
|
|
allowedMethods: [GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE]
|
|
webACLId: ${waf_acl_arn}
|
|
comment: "hmcmkit-managed CDN + DDoS protection"
|
|
|
|
---
|
|
# 2. AWS WAF — OWASP Top 10
|
|
# Apply via Terraform: aws_wafv2_web_acl
|
|
waf_rules:
|
|
- name: AWSManagedRulesCommonRuleSet
|
|
priority: 1
|
|
vendor: AWS
|
|
- name: AWSManagedRulesSQLiRuleSet
|
|
priority: 2
|
|
vendor: AWS
|
|
- name: AWSManagedRulesKnownBadInputsRuleSet
|
|
priority: 3
|
|
vendor: AWS
|
|
- name: rate-limit
|
|
priority: 10
|
|
limit: 2000 # requests per 5 minutes per IP
|
|
|
|
---
|
|
# 3. VPC Design
|
|
vpc:
|
|
cidr: "10.0.0.0/16"
|
|
subnets:
|
|
public:
|
|
- "10.0.1.0/24" # ALB, NAT Gateway
|
|
- "10.0.2.0/24"
|
|
private:
|
|
- "10.0.10.0/24" # EKS nodes, application
|
|
- "10.0.11.0/24"
|
|
database:
|
|
- "10.0.20.0/24" # RDS (no internet access)
|
|
- "10.0.21.0/24"
|
|
nat_gateway: single # staging: single, prod: per-az
|
|
|
|
---
|
|
# 4. IAM — IRSA (IAM Roles for Service Accounts)
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: ${project_name}-api
|
|
namespace: ${environment}
|
|
annotations:
|
|
eks.amazonaws.com/role-arn: arn:aws:iam::${aws_account_id}:role/${project_name}-${environment}-api
|
|
|
|
---
|
|
# 5. Network Policy (Calico/Cilium)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: ${project_name}-api-policy
|
|
namespace: ${environment}
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: ${project_name}-api
|
|
policyTypes: [Ingress, Egress]
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: ingress-nginx
|
|
ports:
|
|
- port: 3000
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: ${environment}
|
|
ports:
|
|
- port: 5432 # PostgreSQL
|
|
- port: 6379 # Redis
|
|
|
|
---
|
|
# 6. ACM + cert-manager
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
privateKeySecretRef:
|
|
name: letsencrypt-prod-key
|
|
solvers:
|
|
- http01:
|
|
ingress:
|
|
class: nginx
|
|
|
|
---
|
|
# 7. Secrets Rotation Policy
|
|
secrets_rotation:
|
|
provider: aws-secrets-manager
|
|
rotation_interval: 30d
|
|
secrets:
|
|
- name: db-credentials
|
|
type: rds
|
|
auto_rotate: true
|
|
- name: api-keys
|
|
type: custom
|
|
auto_rotate: false # manual rotation
|
|
|
|
---
|
|
# 8. Backup & DR
|
|
backup:
|
|
rds:
|
|
retention_period: 7 # days (staging)
|
|
# retention_period: 35 # days (production)
|
|
copy_to_region: ap-northeast-1 # Cross-region backup
|
|
snapshot_schedule: "cron(0 3 * * ? *)" # Daily 3AM UTC
|
|
s3:
|
|
versioning: true
|
|
lifecycle_rule:
|
|
transition_to_ia: 30 # days
|
|
transition_to_glacier: 90
|