foxxcyber/docsChange & Configuration Management
Infrastructure as code, immutable containers, and a controlled path to production.
Covers the NIST SP 800-171 Configuration Management (CM) family.
Everything is code
The entire AWS environment — networking, compute, database, storage, firewall rules, monitoring — is defined in CloudFormation templates under version control. There are no hand-built resources; security groups and policies are never edited by hand. Change sets are reviewed before deployment, and CloudTrail records every infrastructure change with the identity that made it.
Immutable, minimal containers
- Application containers are built from minimal hardened base images and run as a non-root user.
- The API is a statically compiled binary — no runtime package manager, no dynamic dependencies to drift.
- Container images are scanned for vulnerabilities on every push to the registry, and image tags are immutable — a published image can never be silently replaced.
- Fargate tasks have no host access and no SSH; software cannot be installed into a running container.
The result: what was reviewed, scanned, and tagged is exactly what runs, and the only way to change production is to ship a new image through the pipeline.
Controlled path to production
- All changes land through merge requests on protected branches — direct pushes and force pushes to release branches are blocked, and CI (lint + tests) must pass before merge.
- Merges deploy automatically to a test environment; production deploys are a separate, explicit release step by an authorized person.
- Deployment credentials are short-lived (OIDC federation from CI to AWS) — no long-lived cloud keys sit in the CI system.
Least functionality
Only the ports and services the architecture requires exist: deny-by-default security groups, no unnecessary OS packages in images, and no general-purpose compute the platform doesn't need.