How umer-r/cloud-compliance-automation works
This repository currently contains one AWS security automation: a Lambda reconciles Cloudflare’s published IPv4/IPv6 ranges with customer-managed AWS prefix lists, avoiding changes on unsafe or empty input and notifying through SNS after successful modifications. The graph follows the documented event-driven workflow and the sampled Lambda calls; Terraform provisions the automation, but its wiring details were not sampled.
Main entry points: lambda_function.py Reconciliation Lambda · terraform Terraform deployment
Components 6
AWS deployment
- Terraform deployment
aws/cf-whitelisting-reconciliation/terraform
Range reconciliation
- Reconciliation Lambda
aws/cf-whitelisting-reconciliation/lambda_function.py - Cloudflare IP API
- EC2 prefix lists
Change alerting
- Amazon SNS
Other components
- Automation operator
Connections 7
- Automation operator → Terraform deployment: deploys
- Terraform deployment → Reconciliation Lambda: provisions
- Reconciliation Lambda → Cloudflare IP API: fetches ranges
- Reconciliation Lambda → EC2 prefix lists: reads state
- Reconciliation Lambda → EC2 prefix lists: updates entries
- Reconciliation Lambda → EC2 prefix lists: tags changes
- Reconciliation Lambda → Amazon SNS: publishes alert