Class IamSecurityRules

java.lang.Object

com.cloudforgeci.api.core.rules.IamSecurityRules

All Implemented Interfaces:

FrameworkRules<SystemContext>

@ComplianceFramework(value="IamSecurity",
                     priority=0,
                     alwaysLoad=true,
                     displayName="IAM Security",
                     description="Cross-framework IAM policy and access control validation")
public class IamSecurityRules
extends Object
implements FrameworkRules<SystemContext>

IAM security compliance validation rules.

These rules enforce IAM policy and role security requirements across multiple compliance frameworks:

• PCI-DSS - Req 7.1: Limit access by business need; Req 8.3: MFA
• HIPAA - §164.312(a)(1): Access control; §164.312(d): Authentication
• SOC 2 - CC6.1: Logical access controls; CC6.2: User authentication
• GDPR - Art.32(1)(b): Confidentiality and access control

Controls Implemented

• Least privilege enforcement
• MFA requirements
• Root account protection
• Credential rotation
• KMS key policy security

Since:

3.0.0

Constructor Summary

Constructors

Constructor	Description
IamSecurityRules()

Method Summary

Modifier and Type	Method	Description
Set<String>	claimedControls()	Controls checked across every validate* method above -- see FrameworkRules.claimedControls().
void	install(SystemContext ctx)	Install compliance validation rules into the CDK construct tree.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface FrameworkRules

alwaysLoad, description, displayName, frameworkId, getRequiredConfiguration, priority

Constructor Details

IamSecurityRules

public IamSecurityRules()

Method Details

install

public void install(SystemContext ctx)

Description copied from interface: FrameworkRules

Install compliance validation rules into the CDK construct tree.

This method is called during CDK synthesis to register validation rules for the compliance framework. Implementations should use ctx.getNode().addValidation() to add CDK validations.

Specified by:

install in interface FrameworkRules<SystemContext>

Parameters:

ctx - the system context containing deployment configuration and CDK stack

claimedControls

public Set<String> claimedControls()

Controls checked across every validate* method above -- see FrameworkRules.claimedControls(). IAM-LEAST-PRIVILEGE and ROOT-ACCESS-KEYS and UNUSED-CREDENTIALS are conditional checks with no direct ComplianceMatrix call, but their descriptions ("least privilege", "access key protection", "unused credential management") fall squarely within ACCESS_CONTROL, ROOT_ACCOUNT_PROTECTION, and CREDENTIAL_ROTATION respectively -- all already claimed via the sibling check in the same method that does call the matrix directly. PASSWORD-POLICY is a conditional check with no corresponding matrix control (password length is not modeled separately from AUTHENTICATION) and is not claimed.

Specified by:

claimedControls in interface FrameworkRules<SystemContext>

Returns:

the control identifiers this framework's install() validates; empty if undeclared