Skip to main content

Technical Controls

This document details the technical security controls implemented in DocuStack for compliance with HIPAA, SOC 2, and other regulatory frameworks.

Service Control Policies (SCPs)​

SCPs provide preventive guardrails that cannot be bypassed, even by account administrators.

SCPTargetEffectCompliance Mapping
Region RestrictionAll accountsOnly us-east-1 allowedData residency, HIPAA
S3 Encryption RequiredWorkloads OUBlock unencrypted S3 uploads§164.312(a)(2)(iv)
CloudTrail ProtectionAll accountsPrevent trail deletion/modification§164.312(b)
Log Archive ProtectionLog ArchiveDeny object deletion§164.312(b)
Deny Public S3Workloads OUBlock public bucket policies§164.312(e)(1)

Example: S3 Encryption Required SCP​

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnencryptedS3Uploads",
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "*",
      "Condition": {
        "Null": {
          "s3:x-amz-server-side-encryption": "true"
        }
      }
    }
  ]
}

AWS Config Rules​

AWS Config provides continuous compliance monitoring with automated remediation.

RulePurposeAuto-RemediationHIPAA Mapping
encrypted-volumesEBS encryption requiredNo§164.312(a)(2)(iv)
s3-bucket-server-side-encryption-enabledS3 encryption requiredYes§164.312(a)(2)(iv)
rds-storage-encryptedRDS encryption requiredNo§164.312(a)(2)(iv)
vpc-flow-logs-enabledNetwork logging requiredYes§164.312(b)
access-keys-rotatedKey rotation (90 days)No§164.308(a)(5)(ii)(D)
cloudtrail-enabledAPI logging requiredYes§164.312(b)
iam-password-policyPassword complexityYes§164.308(a)(5)(ii)(D)
mfa-enabled-for-iam-console-accessMFA requiredNo§164.312(d)
root-account-mfa-enabledRoot MFA requiredNo§164.312(d)

Encryption​

At Rest​

ResourceEncryption MethodKey Management
S3 BucketsSSE-KMSCustomer Managed Key (CMK)
RDS PostgreSQLAES-256Customer Managed Key (CMK)
EBS VolumesAES-256Customer Managed Key (CMK)
Secrets ManagerAES-256AWS Managed Key
CloudWatch LogsAES-256AWS Managed Key

KMS Key Policy Example​

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM policies",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::ACCOUNT_ID:root"},
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow service usage",
      "Effect": "Allow",
      "Principal": {"Service": ["s3.amazonaws.com", "rds.amazonaws.com"]},
      "Action": ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey*"],
      "Resource": "*"
    }
  ]
}

In Transit​

ConnectionProtocolMinimum Version
Client to ALBHTTPSTLS 1.2
ALB to ECSHTTPSTLS 1.2
ECS to RDSTLSTLS 1.2 (forced via rds.force_ssl=1)
ECS to S3HTTPSTLS 1.2 (via VPC endpoint)
ECS to AWS APIsHTTPSTLS 1.2 (via VPC endpoints)

Network Security​

Architecture​

┌─────────────────────────────────────────────────────────────────────────────┐
│                              VPC (10.X.0.0/16)                               │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│   ┌─────────────────────────────────────────────────────────────────────┐   │
│   │  Public Subnets (Load Balancers Only)                                │   │
│   │  • ALB (HTTPS 443 only)                                              │   │
│   │  • NAT Gateway (outbound only)                                       │   │
│   └─────────────────────────────────────────────────────────────────────┘   │
│                                    │                                         │
│   ┌─────────────────────────────────────────────────────────────────────┐   │
│   │  Private Subnets (Compute)                                           │   │
│   │  • ECS Fargate tasks (NO public IPs)                                │   │
│   │  • Access AWS services via VPC endpoints                            │   │
│   └─────────────────────────────────────────────────────────────────────┘   │
│                                    │                                         │
│   ┌─────────────────────────────────────────────────────────────────────┐   │
│   │  Database Subnets (Isolated)                                         │   │
│   │  • RDS PostgreSQL                                                    │   │
│   │  • No internet access                                                │   │
│   │  • Access only from private subnets                                  │   │
│   └─────────────────────────────────────────────────────────────────────┘   │
│                                                                              │
│   ┌─────────────────────────────────────────────────────────────────────┐   │
│   │  VPC Endpoints (PrivateLink)                                         │   │
│   │  • S3, ECR, CloudWatch, Secrets Manager, SSM, KMS                   │   │
│   │  • Traffic stays within AWS network                                  │   │
│   └─────────────────────────────────────────────────────────────────────┘   │
│                                                                              │
└─────────────────────────────────────────────────────────────────────────────┘

CIDR Allocation​

EnvironmentVPC CIDRPublic SubnetsPrivate SubnetsDatabase Subnets
Dev10.0.0.0/1610.0.1.0/24, 10.0.2.0/2410.0.10.0/24, 10.0.11.0/2410.0.20.0/24, 10.0.21.0/24
Staging10.1.0.0/1610.1.1.0/24, 10.1.2.0/2410.1.10.0/24, 10.1.11.0/2410.1.20.0/24, 10.1.21.0/24
Prod10.2.0.0/1610.2.1.0/24, 10.2.2.0/2410.2.10.0/24, 10.2.11.0/2410.2.20.0/24, 10.2.21.0/24

VPC Endpoints​

VPC endpoints reduce NAT Gateway costs and improve security by keeping traffic within AWS:

EndpointTypePurposeCost
s3GatewayDocument storage accessFree
dynamodbGatewayTerraform state lockingFree
ecr.apiInterfaceContainer image pulls~$7/mo
ecr.dkrInterfaceContainer image pulls~$7/mo
logsInterfaceCloudWatch logging~$7/mo
secretsmanagerInterfaceCredential retrieval~$7/mo
ssmInterfaceParameter Store access~$7/mo
kmsInterfaceEncryption operations~$7/mo

Security Groups​

Security GroupInboundOutbound
ALB443 from 0.0.0.0/0All to ECS SG
ECS8080 from ALB SGAll to VPC endpoints, NAT
RDS5432 from ECS SGNone
VPC Endpoints443 from private subnetsNone

Key Security Features​

  • No public IPs: All ECS tasks run in private subnets
  • VPC endpoints: AWS service traffic stays within VPC
  • Security groups: Least-privilege, explicit allow rules
  • NACLs: Additional subnet-level filtering
  • VPC Flow Logs: All traffic logged to S3 (Log Archive account)

Audit Logging​

Log TypeSourceDestinationRetention
CloudTrailAll accountsLog Archive S37 years
VPC Flow LogsAll VPCsLog Archive S31 year
CloudWatch LogsApplicationsCloudWatch90 days
S3 Access LogsDocument bucketsLog Archive S31 year
RDS Audit LogsPostgreSQLCloudWatch90 days
ALB Access LogsLoad balancersLog Archive S31 year

Continuous Monitoring​

ToolPurposeAlert Threshold
AWS ConfigConfiguration complianceAny non-compliant resource
Security HubSecurity findings aggregationMedium+ severity
GuardDutyThreat detectionAll findings
CloudWatchOperational metricsCustom thresholds
CloudTrailAPI activity monitoringSpecific events

Disaster Recovery​

Recovery Objectives​

MetricTargetImplementation
RTO4 hoursMulti-AZ, automated recovery
RPO1 hourContinuous replication, hourly backups

Backup Strategy​

ResourceBackup MethodFrequencyRetention
RDS PostgreSQLAutomated snapshotsDaily7 days (35 days prod)
RDS PostgreSQLTransaction logsContinuous7 days
S3 DocumentsVersioningContinuousIndefinite
S3 DocumentsCross-region replicationContinuousSame as source
Terraform StateS3 versioningOn change30 versions

DR Scenarios​

ScenarioRecovery ProcedureRTO
Single AZ failureAutomatic failover to standby AZ< 5 minutes
Region failureRestore from cross-region backups4 hours
Data corruptionPoint-in-time recovery1 hour
RansomwareRestore from immutable backups4 hours