Cloud Agent LabSecurity
Every control, and how it is checked
Security settings are only useful if they are actually in effect. Each control below has a test that produces evidence anyone can reproduce.
Check this connection
This sends a real request to the site from your browser and reports what came back. Nothing is stored.
Controls in place
| Control | How it is configured | How it is verified |
|---|---|---|
| HTTPS only | CloudFront viewer protocol policy: redirect HTTP to HTTPS | An http:// request returns 301 with an https:// location |
| Valid certificate | ACM certificate for the domain and www, TLS 1.2 minimum |
TLS handshake succeeds and the certificate names match the domain |
| Private origin | S3 Block Public Access on; bucket policy allows only this CloudFront distribution | A direct request to the S3 object URL returns 403 |
| CloudFront delivery | DNS aliases point the domain at the distribution | Responses carry CloudFront Via and X-Cache headers |
| Least privilege | The deployment user can manage only S3, CloudFront, Route 53 and ACM | IAM policy review; any other AWS call is denied |
| No exposed secrets | Keys live in local configuration files that Git ignores | Repository scan before each push; logs are redacted |
Human approval
Agents may read configuration and run checks on their own. Anything that changes the live site, such as editing DNS, changing the bucket policy or updating the CloudFront distribution, is shown to a person as a proposed action and runs only after they approve it.