[Security] Fix AWS Security Hub findings - GuardDuty, Inspector, and SSM

[sean-navapbc]

Summary

Fixes 7 HIGH/CRITICAL findings from AWS Security Hub by enabling account-level security monitoring and scanning features.

Findings Resolved:

• ✅ GuardDuty.11 - GuardDuty Runtime Monitoring (CRITICAL)
• ✅ GuardDuty.7 - GuardDuty EKS Runtime Monitoring (HIGH)
• ✅ Inspector.1 - EC2 scanning (HIGH)
• ✅ Inspector.2 - ECR scanning (HIGH)
• ✅ Inspector.3 - Lambda code scanning (HIGH)
• ✅ Inspector.4 - Lambda standard scanning (HIGH)
• ✅ SSM.7 - Block SSM document public sharing (CRITICAL)

Findings Documented as Accepted:

• CloudFront.1 - False positive (control doesn't apply to ALB origins)
• ECS.5 - Operational requirement (Fluent Bit needs write access)

Changes

New Terraform files:

• infra/accounts/guardduty.tf - GuardDuty detector with runtime monitoring enabled
• infra/accounts/inspector.tf - Amazon Inspector scanning for EC2, ECR, Lambda
• infra/accounts/ssm.tf - SSM document public sharing block
• docs/security/accepted-findings.md - Documentation of accepted/false positive findings

Security improvements:

• Enables runtime threat detection for ECS Fargate, EKS, and EC2 instances
• Enables vulnerability scanning for container images and Lambda functions
• Prevents accidental public sharing of SSM documents

Deployment Notes

Before applying, import the existing GuardDuty detector:

cd infra/accounts
terraform import aws_guardduty_detector.main 94c62cc0d4fe7b2eb627a33e8273238c
terraform plan  # Review changes
terraform apply # Apply when ready

These are account-level settings (not environment-specific) that apply to the entire AWS account.

Validation

• ✅ All Terraform files validated with terraform validate
• ✅ All files formatted with terraform fmt
• ✅ Plan reviewed (adds 6 resources, updates 2, removes 13 unrelated legacy resources)

Security Hub findings should update within 24 hours of applying these changes.