Security

The controls protecting transport, AWS access, and application secrets.

Overview

The current implementation focuses on securing application transport, minimising AWS permissions and separating sensitive configuration from application code while keeping the overall architecture straightforward.

As the project grows, additional controls will be introduced alongside new infrastructure and application services.

Security Overview

Diagram

flowchart LR

    GitHub[GitHub Actions]
    OIDC[OIDC]
    IAM[IAM Role]

    User[Browser]

    Route53[Route 53]
    ALB[Application Load Balancer]

    ECS[ECS Service]

    SSM[Parameter Store]

    User --> Route53
    Route53 --> ALB
    ALB --> ECS

    GitHub --> OIDC
    OIDC --> IAM
    IAM --> ECS

    SSM --> ECS

Security Controls

Area	Implementation
HTTPS	TLS certificates managed through AWS Certificate Manager (ACM).
Identity	GitHub Actions authenticates using OpenID Connect (OIDC) and short-lived IAM roles.
Permissions	IAM roles follow the principle of least privilege for deployment and runtime services.
Secrets	Sensitive configuration is stored in AWS Systems Manager Parameter Store.
Runtime Configuration	Secrets are injected into containers at runtime rather than embedded into Docker images.

Secure Transport

All public traffic is encrypted using HTTPS.

TLS certificates are managed through AWS Certificate Manager and terminated at the Application Load Balancer before requests are forwarded to the running application. This keeps certificate management outside of the application while ensuring encrypted communication between users and the platform.

Authentication and AWS Access

GitHub Actions authenticates with AWS using OpenID Connect (OIDC).

Rather than storing long-lived AWS access keys, GitHub exchanges its identity token for a temporary IAM role during deployment. The role is scoped only to the permissions required to publish container images and deploy new ECS task definitions.

The ECS task uses a dedicated execution role that allows the ECS agent to retrieve the container image, publish logs and load the configured Parameter Store values. The application currently has no task IAM role because its code does not call AWS APIs directly. If future services require AWS API access, they will receive task roles scoped to their individual responsibilities.

Secrets Management

Application secrets are managed using AWS Systems Manager Parameter Store.

Sensitive configuration values are stored as SecureString parameters and referenced by ARN within the ECS task definition. The values are injected into the container only when it starts and are never committed to source control, embedded into the Docker image or exposed through client-side environment variables.

Application Security

The contact form currently performs server-side schema validation before processing requests.

As the portfolio evolves, additional protections will be introduced, including:

Rate limiting.
Honeypot fields.
Structured request logging.
Abuse monitoring.
Expanded input validation.

Future Improvements

The current implementation establishes the foundation for securing the application while avoiding unnecessary complexity during the early stages of the project.

Future enhancements include:

Private application services running within the existing private subnet architecture.
Additional IAM separation as backend services are introduced.
Expanded application monitoring and security logging.
Automated security scanning within the CI pipeline.
Ongoing review of infrastructure permissions as the platform grows.