Deployment time security audit using CloudFormation custom resource.

To prevent deployment of the potentially sensitive resources or infrastructure into the AWS account that might not meet current organizational security standard we can use AWS CloudFormation custom resource to perform quick security audit (or kind of sanity check) of the cloud account before processing with deployment.

Why we need this if we can scan/audit account as a part of the CI/CD pipeline? For the cases when deployments are performed manually or to have CI/CD independent "portable" CloudFormation template that has all security checks built-in and not bolt-on.

How it will look like:

1. To you normal CloudFormation template you will add a custom resource.
2. This custom resource it technically speaking a Lambda function that created and called during CloudFormation stack deployment.
3. This Lambda function will perform quick (to meet CloudFormation deployment timeouts restrictions) security audit of the account where template going to be deployed
4. As result of this audit Lambda will return status that will be interpreted by CloudFormation as a resource creation outcome.
5. If AWS environment pass security check - deployment of other resources in you stack continue as usual
6. If AWS environment fail security check - stack deployment will interrupted and rolled back as a result of the custom resource failure. 

I will publish example on such functionality on my Github shorty and will update this post with more details.