CDK kit · TypeScript
AWS Account Baseline Kit: security and cost guardrails in one deploy
Every new AWS account starts the same way: you tell yourself you'll set up billing alerts and CloudTrail "right after this deploy", and then a surprise bill or a public S3 bucket does it for you.
The advice is scattered across checklist blog posts that end in fifteen console screenshots you'll never repeat on the next account. This kit is that setup as code — the baseline I run on my own AWS account, not a demo. One small CDK app, two stacks, about 250 lines of commented TypeScript you can read in fifteen minutes and deploy in one: budgets with 80%/100% alerts, CloudTrail to encrypted S3, GuardDuty, Security Hub with the AWS Foundational and CIS standards, IAM Access Analyzer, Cost Anomaly Detection, EBS default encryption, an account-wide S3 public access block, and opt-in AWS Config.
ZIP with the complete CDK project, README, and quick-start guide. Lifetime updates to this edition. 7-day refund policy.
What's in the kit
- One
cdk deploy— spend alerts, audit trail, threat detection, and compliance findings on a fresh or existing account - Cost guardrails included — monthly budget plus ML anomaly detection, all alerts to one SNS topic you confirm once
- The hardening everyone forgets — EBS encryption by default and the account-level S3 public access block
- Honest cost table — per-service estimates for a small account (realistically $2–10/month after free trials), not "free*"
- Troubleshooting for the real failures — detector-already-exists, Security Hub already subscribed, Cost Explorer not active, the unconfirmed SNS email
- Full source, no black box — every resource is visible, commented, and yours to edit; teardown keeps your audit history
FAQ
- Can't I do this myself in the console?
- You can, once. This is repeatable, reviewable, and reversible — and it includes the cost research you'd have to do first: what's worth enabling and what each piece actually costs.
- Isn't Control Tower or Landing Zone this?
- Those are multi-account organization tools with real complexity and cost. This kit is deliberately single-account — the right size for a personal or early-startup account.
- What does it cost to run?
- Realistically $2–10/month on a small account after free trials, itemized per service in the README. The kit itself alerts you if that drifts — that's part of what it deploys.
- What about AWS Config?
- Config is the one component with a real always-on cost, so it ships as an opt-in flag with daily recording rather than a default.
- What's the refund policy?
- 7 days, consistent with my other products. Refunded purchases lose access to future updates.