NPCI Cloud Governance Center of Excellence

Overview

A multi-cloud governance, security, and compliance framework providing automated guardrails, policy-as-code, incident response, and infrastructure baselines. Built to meet NPCI security requirements, RBI IT Framework controls, and OWASP standards across AWS, Azure, and GCP.

Architecture

cloud-governance-center-of-excellence/
├── main.tf
├── variables.tf
├── outputs.tf
├── backend.hcl.example
├── terraform.tfvars.example
├── control-tower/
├── scp/
│   └── policies/
├── iam/
│   └── cognito/
├── security/
│   ├── guardduty/
│   ├── security-hub/
│   ├── waf/
│   ├── inspector/
│   ├── cloudtrail/
│   ├── cloudwatch-alarms/
│   ├── config-conformance/
│   └── ec2-image-builder/
├── networking/
│   ├── vpc-flow-logs/
│   ├── network-firewall/
│   ├── segmentation/
│   ├── alb-access-logs/
│   └── mtls/
├── data-protection/
│   ├── kms/
│   ├── s3-access-logs/
│   └── data-classification/
├── incident-response/
│   ├── automation/
│   │   └── src/
│   └── playbooks/
└── backup/
    └── policies/

Key Principles

1. Least Privilege — Every identity and resource gets minimum required permissions
2. Defense in Depth — Multiple layers: SCPs → IAM policies → Security Groups → WAF → encryption
3. Automated Detection and Response — GuardDuty, Security Hub, and Config for detection; EventBridge + Lambda for automated remediation
4. Centralized Governance — Control Tower as the single pane of glass for account management and guardrail enforcement
5. Region Confinement — All workloads restricted to approved regions unless explicitly authorized
6. Policy as Code — All guardrails, policies, and baselines defined in version-controlled Terraform modules
7. Encryption Everywhere — Customer-managed KMS keys with automatic rotation for all data tiers

Security Controls

Domain	Controls Implemented
Identity & Access	MFA enforcement, password policy, quarterly access reviews, IAM Access Analyzer
Governance	SCPs (region lock, root protection, security service protection, encryption enforcement, public access prevention, network protection)
Detection	GuardDuty (S3, EKS, malware protection), Security Hub (CIS, PCI-DSS, NIST), Inspector, CloudTrail with SNS alerts
Network	VPC flow logs, Network Firewall, tiered segmentation (web/app/db), WAF (OWASP Top 10), mTLS
Data Protection	3-tier KMS keys, S3 encryption, data classification tagging, access logging
Incident Response	Automated EC2 isolation, automated IAM key disable, SNS alerts, CloudWatch security dashboard
Backup	Daily/weekly/monthly backup plans, vault lock (7-day min, 365-day max retention)

Compliance Alignment

Standard	Coverage
CIS AWS Foundations Benchmark v1.5	Security Hub CIS conformance pack
NPCI Security Guidelines	MFA, encryption, network segmentation, incident response
RBI IT Framework for NBFCs	Data protection, access controls, audit logging
OWASP Top 10	WAF rules (SQLi, XSS, known bad inputs, anonymous IP, IP reputation)
SOC 2 Type II	CloudTrail, Config, GuardDuty, encryption at rest and in transit

Multi-Cloud Strategy

This framework follows a cloud-agnostic governance model:

• AWS — Current implementation (this repository)
• Azure — Planned: Azure Policy, Defender for Cloud, Sentinel
• GCP — Planned: Organization Policy, Security Command Center, Cloud Armor

Each cloud provider module follows the same governance domains: Identity, Network, Data Protection, Detection, Response, and Backup.

Prerequisites

• Terraform >= 1.10.0
• AWS Provider >= 5.30.0
• AWS CLI configured with appropriate credentials
• An AWS account with Organizations enabled (for SCPs and Control Tower)

Quick Start

# 1. Clone the repository
git clone https://github.com/npci/cloud-governance-center-of-excellence.git
cd cloud-governance-center-of-excellence

# 2. Copy and configure variables
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars with your account details

# 3. Copy and configure backend
cp backend.hcl.example backend.hcl
# Edit backend.hcl with your S3 bucket details

# 4. Initialize Terraform
terraform init -backend-config=backend.hcl

# 5. Review the plan
terraform plan -var-file=terraform.tfvars

# 6. Apply
terraform apply -var-file=terraform.tfvars

Testing

# Run unit tests
python3 -m pytest tests/unit/ -v --cov=incident-response/automation/src --cov-report=term-missing

# Run Terraform validation
terraform validate

# Run security scans (via CI)
# - Checkov, TFSec, TFLint, Bandit, Black, flake8

CI/CD

All changes are validated through GitHub Actions:

• Terraform format check
• Terraform validate (per-module)
• TFLint
• TFSec security scan
• Checkov security scan
• Python lint (flake8, black)
• Python security scan (bandit)
• Python unit tests (>= 60% coverage)
• SCP policy JSON validation

License

Apache-2.0 — See LICENSE for details.