amadan

eleven / ocho Public

infra: budget alarm + EBS encryption-by-default + encrypted dev-box root (#964)

Aikido cloud-scan follow-ups, per Paul's calls:
- aws_budgets_budget "eleven-monthly": $25/month (~5x the ~$5 actual
  run rate), alerts to team@elevenmessenger.com at 80% actual and 100%
  forecasted.
- aws_ebs_encryption_by_default in eu-west-1: every new volume encrypts
  at rest.
- The one existing unencrypted volume is the dev box's root; compute.tf
  now declares it encrypted, which forces a replacement — apply with
  -replace=aws_instance.dev_box (the box is stopped and disposable).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Paul Campbell b4b1ba7d293079a37157fc089473898036803af2 parent 1207850
2 files changed, +44 −0
  • infra/dev/compute.tf +4 −0
  • infra/prod/account.tf +40 −0
diff --git a/infra/dev/compute.tf b/infra/dev/compute.tf
index 1c36be6..a21d1e1 100644
--- a/infra/dev/compute.tf
+++ b/infra/dev/compute.tf
@@ -126,9 +126,13 @@ resource "aws_instance" "dev_box" {
http_tokens = "required"
}
+ # encrypted forces a replacement of the original (unencrypted) volume —
+ # apply with -replace=aws_instance.dev_box; the box is a disposable pet
+ # (state parks in S3, that's the whole point of the activator proof).
root_block_device {
volume_size = 20
volume_type = "gp3"
+ encrypted = true
}
tags = {
diff --git a/infra/prod/account.tf b/infra/prod/account.tf
new file mode 100644
index 0000000..7c8cb2d
--- /dev/null
+++ b/infra/prod/account.tf
@@ -0,0 +1,40 @@
+# 🤖 Account-level hygiene, sibling to cloudtrail.tf: a spending alarm and
+# the EBS encryption default. Both are settings, not infrastructure — cheap,
+# reversible, and account-wide.
+
+# The budget alarm: actual spend runs ~$5/month (books.json publishes it),
+# so $25 is ~5× headroom — quiet in normal months, loud the month something
+# runs away (a leaked key mining, a misconfigured loop hammering S3).
+# Alerts at 80% actual and 100% forecasted, to the team address.
+resource "aws_budgets_budget" "monthly" {
+ name = "eleven-monthly"
+ budget_type = "COST"
+ limit_amount = "25"
+ limit_unit = "USD"
+ time_unit = "MONTHLY"
+
+ notification {
+ comparison_operator = "GREATER_THAN"
+ threshold = 80
+ threshold_type = "PERCENTAGE"
+ notification_type = "ACTUAL"
+ subscriber_email_addresses = ["team@elevenmessenger.com"]
+ }
+
+ notification {
+ comparison_operator = "GREATER_THAN"
+ threshold = 100
+ threshold_type = "PERCENTAGE"
+ notification_type = "FORECASTED"
+ subscriber_email_addresses = ["team@elevenmessenger.com"]
+ }
+}
+
+# Every NEW EBS volume in eu-west-1 (the only region we use) is encrypted at
+# rest with the default KMS key. Existing volumes are untouched — the one
+# unencrypted volume (the dev box's root) is fixed by recreating the box
+# (infra/dev/compute.tf now declares its root encrypted; apply with
+# -replace=aws_instance.dev_box).
+resource "aws_ebs_encryption_by_default" "on" {
+ enabled = true
+}