Best Practices Exercise - #3

As an integral part of our team, you will be responsible for deploying and managing our healthcare software infrastructure on AWS. Given the critical nature of our work, compliance and security are of utmost importance to us.

For this exercise, we would like you to review a Terraform pull request (PR) that aims to deploy an ECS service behind an Application Load Balancer (ALB) and use RDS for the database. Your task is to assess the security and compliance aspects of the cloud infrastructure and identify any potential vulnerabilities or areas for improvement.

Please note that for this exercise, we will focus solely on the cloud aspects of the infrastructure. We can assume that the application itself is secure, and the database options are configured to be optimally secure. Your main objective is to evaluate the cloud infrastructure's security posture and recommend any necessary modifications.

While reviewing the PR, pay close attention to network architecture, network configuration, and encryption settings. Your goal is to ensure that the infrastructure adheres to security best practices and compliance requirements for a healthcare software environment.

Here are some general principles to consider:

1. Encryption at Rest: Ensure all data at rest is encrypted to ensure the confidentiality and integrity of sensitive healthcare information.

2. Least Privilege: Assess if the infrastructure follows the principle of least privilege, ensuring that no user or resource has more permissions than necessary. Evaluate the access controls and restrict access to sensitive resources and data.

3. Segmentation and Isolation: Evaluate the network architecture to determine if it adequately isolates different components of the infrastructure. Assess if machines are accessible only to entities that require access and if unnecessary access is restricted.

During your assessment, focus on the security and compliance aspects of the cloud infrastructure. Consider any potential vulnerabilities, misconfigurations, or deviations from best practices.

If you have any questions or need clarification on any aspect of the exercise, please don't hesitate to ask.