Section 13 — Security Monitoring and Auditability

Companion to musehub-production-readiness-checklist.md. Most of this section requires account-wide IAM/CloudTrail/GuardDuty/Access-Analyzer visibility that musehub-infra is denied. Gabriel agreed earlier in this session to grant broader read access but it hasn't landed yet — re-run this section's blocked checks once it does.

What I could check without broader access

• musehub-releases S3 bucket has all four Block Public Access settings set to false (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets — all false). This is likely intentional — this bucket serves the public /install.sh CLI installer and release tarballs — but needs Gabriel's explicit confirmation that (a) this is deliberate and (b) no other, more sensitive data ever lands in this same bucket. The checklist's "enable S3 Block Public Access at the account level unless explicitly incompatible" item applies here: this bucket is the "explicitly incompatible" exception, worth documenting as such rather than silently leaving unblocked.
• ECR image scanning is not enabled — imageScanStatus on the most recent musehub/musehub image returned null (no scan has ever run). 100 images in the repo, none scanned.

Blocked — needs Gabriel's broader-access grant (requested earlier this session)

Every one of these returns AccessDeniedException for musehub-infra today:

• [ ] Enable CloudTrail (multi-region, read+write management events, encrypted, log-file validation, nonpublic bucket, forwarded to CloudWatch Logs) — cannot confirm current state
• [ ] Enable AWS Config — cannot confirm current state
• [ ] Enable GuardDuty — cannot confirm current state
• [ ] Enable Security Hub + AWS Foundational Security Best Practices — cannot confirm current state
• [ ] Enable IAM Access Analyzer — cannot confirm current state
• [ ] Review public/cross-account resource access — cannot confirm current state (this is exactly what Access Analyzer would tell us)
• [ ] Enable S3 Block Public Access at the account level — cannot confirm current state; the one bucket I could check has it disabled (see above)
• [ ] Monitor changes to IAM/KMS/CloudTrail/DNS/security-groups — N/A until CloudTrail exists
• [ ] Alert on root-account activity / failed console logins — N/A until CloudTrail + GuardDuty exist

Partially checkable / recommendations

• [ ] Enable ECR image vulnerability scanning — confirmed not enabled; this one's an easy, low-risk win once broader ECR permissions exist (ecr:PutImageScanningConfiguration) — flagging as a good early target for the build phase since it's non-disruptive.
• [ ] Define a vulnerability-remediation SLA — not done, and can't be meaningfully defined before scanning exists to generate findings.
• [ ] Run a production security review before launch — this entire checklist effort is a step toward that, but a dedicated pass (Section 17/14 overlap) still needs to happen closer to launch.
• [ ] Record and assign every security finding — no findings-tracking process exists yet.

The actual work items here

1. Get the broader read-access grant (requested earlier) and re-run the blocked checks above — this is the single highest-leverage next step for this section specifically.
2. Enable GuardDuty and Security Hub — both are largely "flip it on" with modest ongoing cost, and directly answer several of this section's remaining questions once enabled.
3. Enable ECR scanning on the musehub/musehub repository.
4. Get explicit sign-off that musehub-releases' public access settings are intentional, and confirm nothing sensitive ever lands there.