AWS 클라우드 보안 완벽 가이드: IAM부터 EKS까지 실무 중심 보안 아키텍처

# IAM 정책 예시: 최소 권한 원칙
Version: '2012-10-17'
Statement:
  - Sid: AllowS3ReadOnly
    Effect: Allow
    Action:
      - s3:GetObject
      - s3:ListBucket
    Resource:
      - 'arn:aws:s3:::secure-bucket'
      - 'arn:aws:s3:::secure-bucket/*'
    Condition:
      StringEquals:
        's3:x-amz-server-side-encryption': 'AES256'
      IpAddress:
        'aws:SourceIp':
          - '10.0.0.0/8'

# IAM 역할 예시
Resources:
  ApplicationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ApplicationRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
      Policies:
        - PolicyName: ApplicationPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                Resource: 'arn:aws:dynamodb:*:*:table/ApplicationTable'

# VPC 아키텍처 예시
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: SecureVPC
  
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: ap-northeast-2a
      MapPublicIpOnLaunch: true
  
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: ap-northeast-2a
      MapPublicIpOnLaunch: false

# NAT Gateway 예시
Resources:
  NATGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt EIP.AllocationId
      SubnetId: !Ref PublicSubnet
  
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Routes:
        - DestinationCidrBlock: 0.0.0.0/0
          NatGatewayId: !Ref NATGateway

# Security Group 예시
# ISMS-P 요구사항: 네트워크 접근 제어
Resources:
  WebServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: web-server-sg
      GroupDescription: Security group for web servers
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
          Description: HTTPS from internet
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          Description: HTTP from internet
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
          Description: Allow all outbound traffic
      Tags:
        - Key: Name
          Value: WebServerSecurityGroup
        - Key: Compliance
          Value: ISMS-P

# S3 버킷 정책 예시
# ISMS-P 요구사항: 접근 통제 및 암호화
Resources:
  SecureBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: secure-data-bucket
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
            BucketKeyEnabled: true
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LoggingConfiguration:
        DestinationBucketName: !Ref AccessLogsBucket
        LogFilePrefix: access-logs/
      LifecycleConfiguration:
        Rules:
          - Id: DeleteOldVersions
            Status: Enabled
            NoncurrentVersionExpirationInDays: 90

# RDS 암호화 설정 예시
Resources:
  SecureDatabase:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: secure-db
      Engine: mysql
      EngineVersion: '8.0'
      MasterUsername: admin
      MasterUserPassword: !Ref DatabasePassword
      DBInstanceClass: db.t3.medium
      AllocatedStorage: 100
      StorageEncrypted: true
      KmsKeyId: !Ref RDSKMSKey
      VPCSecurityGroups:
        - !Ref DatabaseSecurityGroup
      DBSubnetGroupName: !Ref DBSubnetGroup
      BackupRetentionPeriod: 7
      PreferredBackupWindow: '03:00-04:00'
      EnableCloudwatchLogsExports:
        - error
        - slowquery

# Pod Security Policy 예시
apiVersion: v1
kind: Namespace
metadata:
  name: secure-namespace
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
---
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
  namespace: secure-namespace
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
    - name: app
      image: nginx:latest
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL

# Network Policy 예시
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: secure-network-policy
  namespace: secure-namespace
spec:
  podSelector:
    matchLabels:
      app: secure-app
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: allowed-app
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 3306

# CloudTrail 설정 예시
Resources:
  CloudTrailLogs:
    Type: AWS::CloudTrail::Trail
    Properties:
      TrailName: security-audit-trail
      S3BucketName: !Ref AuditLogsBucket
      IncludeGlobalServiceEvents: true
      IsLogging: true
      IsMultiRegionTrail: true
      EventSelectors:
        - ReadWriteType: All
          IncludeManagementEvents: true
          DataResources:
            - Type: AWS::S3::Object
              Values:
                - 'arn:aws:s3:::secure-bucket/*'
      KMSKeyId: !Ref CloudTrailKMSKey
      CloudWatchLogsLogGroupArn: !GetAtt CloudWatchLogGroup.Arn
      CloudWatchLogsRoleArn: !GetAtt CloudWatchLogsRole.Arn

# Security Hub 설정 예시
Resources:
  SecurityHubAccount:
    Type: AWS::SecurityHub::Hub
    Properties:
      EnableDefaultStandards: true
      StandardsSubscriptionArns:
        - arn:aws:securityhub:ap-northeast-2::standards/cis-aws-foundations-benchmark/v/1.2.0
        - arn:aws:securityhub:ap-northeast-2::standards/pci-dss/v/3.2.1

# aws:SourceVpcArn 조건 키 예시
Version: '2012-10-17'
Statement:
  - Effect: Allow
    Action:
      - s3:GetObject
      - s3:PutObject
    Resource: 'arn:aws:s3:::secure-bucket/*'
    Condition:
      StringEquals:
        'aws:SourceVpcArn': 'arn:aws:ec2:ap-northeast-2:ACCOUNT_ID:vpc/vpc-xxxxxxxxx'

# AWS Backup EKS 백업 설정 예시
Resources:
  EKSBackupPlan:
    Type: AWS::Backup::BackupPlan
    Properties:
      BackupPlan:
        BackupPlanName: eks-backup-plan
        Rules:
          - RuleName: eks-daily-backup
            TargetBackupVault: !Ref BackupVault
            ScheduleExpression: cron(0 3 * * ? *)
            Lifecycle:
              DeleteAfterDays: 30
            CopyActions:
              - DestinationBackupVaultArn: !GetAtt BackupVault.Arn
                Lifecycle:
                  DeleteAfterDays: 90

# EKS Cluster Insights Policy 예시
Resources:
  EKSClusterInsightsRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EKSClusterInsightsRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: eks.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSClusterInsightsPolicy