From GAP to OK: the Terraform behind each fix.

resource "aws_vpc_security_group_ingress_rule" "exposure_world_open" {
  for_each = { ssh = 22, app = 8080 }

  security_group_id = aws_security_group.exposure.id
  ip_protocol       = "tcp"
  from_port         = each.value
  to_port           = each.value
  cidr_ipv4         = "0.0.0.0/0"
}

resource "aws_instance" "app" {
  # ...
  associate_public_ip_address = true
  iam_instance_profile        = null
}

# No world-open ingress rules exist (for_each = {}).

data "aws_iam_policy_document" "app_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy" "ssm_core" {
  name = "AmazonSSMManagedInstanceCore"
}

resource "aws_iam_role" "app_ssm" {
  name               = "example-ssm"
  assume_role_policy = data.aws_iam_policy_document.app_assume_role.json
}

resource "aws_iam_role_policy_attachment" "app_ssm" {
  role       = aws_iam_role.app_ssm.name
  policy_arn = data.aws_iam_policy.ssm_core.arn
}

resource "aws_iam_instance_profile" "app" {
  name = "example-ssm"
  role = aws_iam_role.app_ssm.name
}

resource "aws_instance" "app" {
  # ...
  associate_public_ip_address = false
  iam_instance_profile        = aws_iam_instance_profile.app.name
}

resource "aws_vpc_security_group_ingress_rule" "exposure_world_open_db" {
  security_group_id = aws_security_group.exposure.id
  ip_protocol       = "tcp"
  from_port         = 5432
  to_port           = 5432
  cidr_ipv4         = "0.0.0.0/0"
}

# The world-open tcp/5432 rule does not exist (count = 0).
# Database access stays on the internal group, scoped to the VPC CIDR:
resource "aws_security_group" "internal" {
  # ...
  ingress {
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = [aws_vpc.example.cidr_block]
  }
}

resource "aws_db_instance" "example" {
  # ...
  backup_retention_period = 0
}

resource "aws_db_instance" "example" {
  # ...
  backup_retention_period = 7 # scanner minimum is 7 days; the lab used 1 as toggle proof only
}

# No CloudWatch metric alarms exist (rds_alarms = {}, alb_alarms = {}, ec2_cpu count = 0).

locals {
  rds_alarms = {
    cpu     = { metric = "CPUUtilization", stat = "Average", op = "GreaterThanThreshold", threshold = 80 }
    storage = { metric = "FreeStorageSpace", stat = "Average", op = "LessThanThreshold", threshold = 2147483648 }
    memory  = { metric = "FreeableMemory", stat = "Average", op = "LessThanThreshold", threshold = 134217728 }
    io      = { metric = "ReadIOPS", stat = "Average", op = "GreaterThanThreshold", threshold = 1000 }
  }

  alb_alarms = {
    latency        = { metric = "TargetResponseTime", stat = "Average", op = "GreaterThanThreshold", threshold = 2 }
    server_errors  = { metric = "HTTPCode_ELB_5XX_Count", stat = "Sum", op = "GreaterThanThreshold", threshold = 10 }
    unhealthy_host = { metric = "UnHealthyHostCount", stat = "Maximum", op = "GreaterThanThreshold", threshold = 0 }
  }
}

resource "aws_cloudwatch_metric_alarm" "rds" {
  for_each = local.rds_alarms

  alarm_name          = "example-rds-${each.key}"
  namespace           = "AWS/RDS"
  metric_name         = each.value.metric
  statistic           = each.value.stat
  comparison_operator = each.value.op
  threshold           = each.value.threshold
  period              = 300
  evaluation_periods  = 1
  dimensions          = { DBInstanceIdentifier = aws_db_instance.example.identifier }
}

resource "aws_cloudwatch_metric_alarm" "alb" {
  for_each = local.alb_alarms

  alarm_name          = "example-alb-${each.key}"
  namespace           = "AWS/ApplicationELB"
  metric_name         = each.value.metric
  statistic           = each.value.stat
  comparison_operator = each.value.op
  threshold           = each.value.threshold
  period              = 300
  evaluation_periods  = 1
  dimensions = each.key == "unhealthy_host" ? {
    LoadBalancer = aws_lb.example.arn_suffix
    TargetGroup  = aws_lb_target_group.example.arn_suffix
  } : {
    LoadBalancer = aws_lb.example.arn_suffix
  }
}

resource "aws_cloudwatch_metric_alarm" "ec2_cpu" {
  alarm_name          = "example-ec2-cpu"
  namespace           = "AWS/EC2"
  metric_name         = "CPUUtilization"
  statistic           = "Average"
  comparison_operator = "GreaterThanThreshold"
  threshold           = 80
  period              = 300
  evaluation_periods  = 1
  dimensions          = { InstanceId = aws_instance.app.id }
}

resource "aws_cloudtrail" "example" {
  # ...
  enable_logging             = false
  cloud_watch_logs_group_arn = null
  cloud_watch_logs_role_arn  = null

  advanced_event_selector {
    name = "management-events"
    field_selector {
      field  = "eventCategory"
      equals = ["Management"]
    }
  }
}

# No server access logging on the trail log bucket.

resource "aws_cloudwatch_log_group" "trail" {
  name              = "/aws/cloudtrail/example"
  retention_in_days = 365
}

resource "aws_iam_role" "trail_cwl" {
  name               = "example-trail-cwl"
  assume_role_policy = data.aws_iam_policy_document.trail_cwl_assume.json # cloudtrail.amazonaws.com
}

resource "aws_iam_role_policy" "trail_cwl" {
  role   = aws_iam_role.trail_cwl.id
  policy = data.aws_iam_policy_document.trail_cwl.json # logs:CreateLogStream, logs:PutLogEvents on the group
}

resource "aws_cloudtrail" "example" {
  # ...
  enable_logging             = true
  cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.trail.arn}:*"
  cloud_watch_logs_role_arn  = aws_iam_role.trail_cwl.arn

  advanced_event_selector {
    name = "management-events"
    field_selector {
      field  = "eventCategory"
      equals = ["Management"]
    }
  }

  advanced_event_selector {
    name = "all-s3-object-events"
    field_selector {
      field  = "eventCategory"
      equals = ["Data"]
    }
    field_selector {
      field  = "resources.type"
      equals = ["AWS::S3::Object"]
    }
  }
}

resource "aws_s3_bucket_logging" "trail_logs" {
  bucket        = aws_s3_bucket.trail_logs.id
  target_bucket = aws_s3_bucket.trail_access_logs.id # private bucket that allows logging.s3.amazonaws.com to write
  target_prefix = "trail-bucket/"
}