Generate Terraform modules for security infrastructure including WAF, GuardDuty, Security Hub, and compliance automation.
You are a cloud security architect. Create Terraform security modules for [CLOUD_PROVIDER]. ## Configuration - **Cloud Provider**: [CLOUD e.g. AWS / Azure / GCP] - **Environment**: [ENV e.g. production / staging / development] - **Compliance**: [COMPLIANCE e.g. CIS Benchmarks / SOC2 / HIPAA / PCI-DSS] - **Terraform Version**: [TF_VERSION e.g. 1.8+] ## Security Modules ### 1. Web Application Firewall (`modules/waf/`) - AWS WAF v2 / Azure Front Door WAF / Cloud Armor - Managed rule groups: OWASP Top 10, known bad inputs, bot control - Custom rules: rate limiting, geo-blocking, IP reputation - Logging to CloudWatch/Log Analytics/Cloud Logging - Dashboard for blocked requests analytics - Variables: rate_limit, allowed_countries, custom_rules ### 2. Threat Detection (`modules/detection/`) - GuardDuty / Azure Sentinel / Security Command Center - Enable all finding types - SNS/Event Grid notifications for high severity - Auto-remediation Lambda/Function for common findings - Multi-account/subscription aggregation - Integration with SIEM ### 3. Security Monitoring (`modules/monitoring/`) - CloudTrail / Activity Log / Audit Logs - Multi-region logging to centralized bucket - Log integrity validation - Metric filters and alarms for: - Root account usage - IAM policy changes - Security group modifications - Console login without MFA - Failed API calls spike ### 4. Network Security (`modules/network/`) - VPC/VNet with public, private, and data subnets - NACLs/NSGs with deny-by-default - VPC Flow Logs / NSG Flow Logs - Private endpoints for managed services - No public IPs on compute resources - NAT Gateway for controlled outbound ### 5. IAM Hardening (`modules/iam/`) - Password policy enforcement - MFA requirement for all users - Service-linked roles with least privilege - Cross-account role assumption with conditions - Access key rotation automation - IAM Access Analyzer for policy validation ### 6. Compliance Automation (`modules/compliance/`) - Security Hub / Defender for Cloud / SCC standards - Enable [COMPLIANCE] benchmark - Automated finding export to ticketing system - Compliance score tracking over time - Remediation runbooks per finding type ### 7. Encryption (`modules/encryption/`) - KMS key management with rotation - Default encryption for all storage services - Certificate management with ACM/Key Vault - TLS policy enforcement All modules with: variables.tf, main.tf, outputs.tf, README.md, examples/, and tests/.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.0 Flash, Llama 4 Maverick.
Select your cloud provider and compliance requirements. Apply modules incrementally starting with IAM and monitoring. Run terraform plan to review before applying. Validate compliance scores after deployment.
Initial release
Sign in and download this prompt to leave a review.