The problem

Most organizations have security rules. Few enforce them. A developer opens SSH to the world on a Friday afternoon, a scanner flags it on Monday, a ticket gets filed, and someone fixes it a week later. That gap is where breaches happen. This project closes the gap by turning every guardrail into code that prevents, detects and corrects.

What you’ll build

• Organization-wide Service Control Policies that protect CloudTrail, Config, GuardDuty and Security Hub, deny the root user, and lock workloads to approved regions
• Five AWS Config managed rules watching for public S3, internet-open SSH/RDP/database ports, unencrypted EBS and disabled CloudTrail
• An EventBridge → Lambda remediator that fixes violations automatically (or reports them in dry-run mode)
• KMS-encrypted SNS notices so every fix is visible to humans

Architecture

AWS Config rule ──NON_COMPLIANT──▶ EventBridge ──▶ Lambda remediator ──▶ fix resource
                                                          └──────────────▶ SNS (email/Slack)

AWS services used

How it works

1. PreventSCPs in the management account make whole classes of mistakes impossible, such as disabling audit logging or deploying to an unapproved region.
2. DetectAWS Config continuously evaluates every resource against managed rules and emits a compliance-change event.
3. CorrectEventBridge routes only NON_COMPLIANT results to a Python Lambda that applies the fix: block public access, revoke the open rule, restart logging.
4. NotifyThe remediator publishes a structured notice to SNS, so the team learns about the fix from the fix itself.

Key design decisions

• Ship with a dry-run flag. Trust is earned, so you watch the notices for a week before letting it act.
• EBS volumes can’t be encrypted in place, so the remediator tags and flags them instead of doing something destructive.
• SCP exemptions are scoped to the AWSControlTowerExecution role so the landing zone can still manage itself.
• Roll out to every account with CloudFormation StackSets (auto-deploys to new accounts in the OU).

Deploy it

npm install

# 1) Guardrails in a workload account (start in dry-run mode!)
npx cdk deploy SelfHealingGuardrails -c alertEmail=you@example.com -c dryRun=true

# If AWS Config is NOT already on in this account:
npx cdk deploy SelfHealingGuardrails -c alertEmail=you@example.com -c createConfigRecorder=true

# 2) SCPs from the management account
npx cdk deploy OrgPolicies -c targetOuIds=ou-xxxx-aaaaaaaa -c allowedRegions=us-east-1,us-west-2

Full prerequisites, parameters and clean-up steps are in the project README on the code page.

See it work

Open port 22 to 0.0.0.0/0 on a test security group. Within a minute or two of AWS Config evaluating it, the rule is gone, the group is tagged self-healing/remediated, and an email lands in your inbox.

Skills this demonstrates