← All demos
Aster Ridge Labs · 847219356041DT

Architect

Ask for what you want to deploy. Architect designs secure-by-default AWS infrastructure, explains the security choices, maps the design to controls, and keeps the change behind a pull request.
Create a secure S3 upload bucket for customer files.
Architect · just now
tudovu-aster-ridge-uploadstudovu-customer-intaketudovu-secure-uploads
tudovu-aster-ridge-uploads

                    
Guardrails passed. Review before opening as a PR.Open as PR

                    Security controls applied:
                    
  • All four S3 public access block settings enabled.
  • KMS encryption and key rotation enabled.
  • Versioning enabled for recovery from overwrite or deletion mistakes.
  • Old object versions expire after 90 days to reduce retained sensitive data.

                  

                  
REMEDIATION LIFECYCLEPR #412 merged→Apply in AWS · CREATE_COMPLETE→Verify checks · AC-S3-001, AC-S3-004 pass
Merged by David Thompson · deployed by your tudovu-deploy-infra workflow

                

                

                  
CONFIGURATION STARTERSNew EC2 instanceCI/CD pipelinePrivate app + PostgresSecure S3 upload bucketEnvironment risks

                  
Describe what you want to deploy. e.g. 'A private app with Postgres and the strongest secure defaults you can use.'

                  
output is suggestion only, never deployed automatically

                

              

            

          

          
          

            
aster-ridge / infraPull requestsActionsSecurity

            

              
Create secure upload bucket tudovu-aster-ridge-uploads #412

              
⎇ Open tudovu wants to merge 1 commit into main from tudovu/architect/secure-upload-bucket

            

            
ConversationCommits 1Checks 3Files changed 1

            

              
tudovu commented
Adds infra/storage/tudovu-aster-ridge-uploads.yaml: a private bucket with a customer-managed KMS key (rotation on), versioning, all four public access block settings, and a 90-day expiry for old versions. Guardrails passed. Checks this satisfies: AC-S3-001, AC-S3-004.
Nothing is created until you merge. Your deploy workflow applies it.

              
infra/storage/tudovu-aster-ridge-uploads.yaml+   UploadBucket:+     Type: AWS::S3::Bucket+     Properties:+       BucketName: tudovu-aster-ridge-uploads+       PublicAccessBlockConfiguration: { BlockPublicAcls: true, IgnorePublicAcls: true, BlockPublicPolicy: true, RestrictPublicBuckets: true }

              

                
Tudovu deploy preview · planning the change setrunning

                
CloudFormation template lintpassed

                
Tudovu guardrails · encryption, versioning, public accesspassed

              

              
Merge pull requestAll checks have passed · 1 approval by david-thompson

              
tudovu-deploy-infra · Configure AWS for deploy (OIDC) ✓ · Deploy CloudFormation stack ✓ CREATE_COMPLETE

            

          

          
        

        

        
Tudovu
Architect.
Describe the infrastructure. Review the pull request.

        
      

    


  

  

    
    
    0:00 / 0:00