@aaa-sentinel/iac-cost 0.3.1 → 0.4.0

package/README.md

@@ -7,6 +7,10 @@ internet is caught in review instead of after the deploy. With `iac-cost fix`, t
 your last scan on resources this Terraform manages come back to you as **pull requests**, not as
 console changes (see [Fixes as pull requests](#fixes-as-pull-requests)).
 
+> **New in 0.4.0:** the `posture` subcommand prints how the security posture of an account changed
+> over 30, 90 or 365 days, with an optional gate on new findings (see
+> [Posture over time](#posture-over-time)). Nothing changes for `fix` or the existing command.
+
 > **Changed in 0.3.1:** the pull requests of `fix` pass `terraform fmt -check`: an added attribute is
 > aligned with its group (also around heredocs and after removing a block), as `terraform fmt` does.
 
@@ -543,6 +547,61 @@ pipelines:
 
 The commit is created through the Bitbucket API (`POST /src`), so the clone needs no push access.
 
+## Posture over time
+
+`iac-cost posture` reads `GET /v1/security/posture-history` and prints, for one account and a
+period of 30, 90 or 365 days:
+
+- the Security Score from the first to the last day with a scan (the last scan of each day), or
+  why it is **not comparable** (the rule catalog or what could be evaluated changed in between);
+- distinct findings **resolved** (gone in a scan that fully evaluated their rule) and **new**
+  (from rules that were already fully evaluated before);
+- findings that cannot be compared (their rule was not fully evaluated in the previous scan, or
+  they come from an external tool) and findings gone without confirmation;
+- the mean time to fix critical and high findings.
+
+```bash
+export IAC_SECURITY_CLIENT_ID=…       # OAuth2 app with the security:read scope
+export IAC_SECURITY_CLIENT_SECRET=…
+npx --yes @aaa-sentinel/iac-cost posture --account acc_01j… --days 90
+```
+
+| Option | Default | |
+| --- | --- | --- |
+| `--account <id>` | `IAC_SECURITY_ACCOUNT_ID` | AAA Sentinel account id |
+| `--days <30\|90\|365>` | `90` | Period |
+| `--format <markdown\|text\|json>` | `markdown` | `json` prints the API response as is |
+| `--fail-on-new <severity>` | — | Exit 1 when new findings at this severity or worse appeared in the period |
+
+Exit codes: `1` only when `--fail-on-new` trips; `2` for a usage error (an option without a value,
+a stray argument), missing credentials or, with the gate, a 4xx from the API (wrong scope or
+account); `0` otherwise, also when the API does not answer (a warning explains why). Findings that
+cannot be compared with the previous scan do not count for the gate.
+
+A weekly job that writes the summary to the run page:
+
+```yaml
+name: Security posture
+on:
+  schedule:
+    - cron: '0 7 * * 1'
+  workflow_dispatch:
+
+jobs:
+  posture:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Posture over the last 90 days
+        env:
+          IAC_SECURITY_CLIENT_ID: ${{ secrets.IAC_SECURITY_CLIENT_ID }}
+          IAC_SECURITY_CLIENT_SECRET: ${{ secrets.IAC_SECURITY_CLIENT_SECRET }}
+        run: |
+          npx --yes @aaa-sentinel/iac-cost posture --account ${{ vars.AAA_SENTINEL_ACCOUNT_ID }} --days 90 --fail-on-new critical >> "$GITHUB_STEP_SUMMARY"
+```
+
 ## Why there is no comment
 
 | What you see | Why |

package/dist/cli.js

@@ -14,6 +14,7 @@ var FORMATS = ["markdown", "text", "json"];
 var SEVERITIES = ["critical", "high", "medium", "low"];
 var USAGE = `Usage: iac-cost [plan.json] [options]
        iac-cost fix [plan.json] --account <accountId> [options]   (see iac-cost fix --help)
+       iac-cost posture --account <accountId> [options]           (see iac-cost posture --help)
 
 Reads \`terraform show -json\` output from the file or from stdin.
 
@@ -1724,9 +1725,9 @@ var Doc = class {
       return;
     }
     const content = arg;
-    const lines = content.split("\n").filter((x) => x);
-    const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));
-    const dedented = lines.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
+    const lines2 = content.split("\n").filter((x) => x);
+    const minIndent = Math.min(...lines2.map((x) => x.length - x.trimStart().length));
+    const dedented = lines2.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
     for (const line of dedented) {
       this.content.push(line);
     }
@@ -6409,8 +6410,8 @@ function aggregateEstimates(estimates) {
   const billable = pricedResources + unpricedResources;
   const ratio = billable === 0 ? 1 : pricedResources / billable;
   const sufficientForTotal = ratio >= IAC_MIN_COVERAGE_RATIO;
-  const total = [...priced.values()].reduce((acc, i) => acc + i.monthlyDeltaUsd, 0);
-  const totalMonthlyDeltaUsd = sufficientForTotal ? round2(total) : null;
+  const total2 = [...priced.values()].reduce((acc, i) => acc + i.monthlyDeltaUsd, 0);
+  const totalMonthlyDeltaUsd = sufficientForTotal ? round2(total2) : null;
   const first = estimates[0]?.displayCurrency;
   const display = first && estimates.every((e) => e.displayCurrency?.code === first.code && e.displayCurrency.rate === first.rate) ? first : null;
   for (const item of priced.values()) {
@@ -8285,6 +8286,7 @@ var RULE_TITLES = {
   SEC_AZURE_LOGGING_SIN_DIAGNOSTICO: "Subscription does not export Activity Log",
   SEC_GCP_NETWORK_ADMIN_ABIERTO: "Firewall with admin ports open to the internet",
   SEC_GCP_EXPOSURE_SQL_PUBLICO: "Cloud SQL authorized from 0.0.0.0/0",
+  SEC_GCP_EXPOSURE_GCS_PUBLICO: "Public Cloud Storage bucket (allUsers or allAuthenticatedUsers)",
   SEC_GCP_ENCRYPTION_SQL_SIN_CMEK: "Cloud SQL without CMEK",
   SEC_GCP_SECRETS_FUNCTION_ENV: "Secret in a Cloud Function environment variable",
   SEC_GCP_IAM_ROL_PRIMITIVO: "Primitive Owner or Editor role on the project",
@@ -8779,7 +8781,7 @@ function carry(findingId, fix2, state) {
 }
 async function runFix(options, deps) {
   const warnings = [];
-  const lines = [];
+  const lines2 = [];
   const reports = [];
   const { host } = deps;
   let input;
@@ -8787,7 +8789,7 @@ async function runFix(options, deps) {
     input = await deps.api.load();
   } catch (error2) {
     warnings.push(`could not read the open findings, nothing to fix: ${error2.message}`);
-    return { stdout: render(options, lines, deps.accountId, null), warnings, lines, reported: 0 };
+    return { stdout: render(options, lines2, deps.accountId, null), warnings, lines: lines2, reported: 0 };
   }
   if (input.truncated) warnings.push("the account has more open findings than the API returns (500 most severe): the rest are left for a later run");
   let publicRepo = false;
@@ -8818,7 +8820,7 @@ async function runFix(options, deps) {
       }
       if (state !== "merged") {
         reports.push(carry(finding.findingId, existing, state));
-        lines.push({ findingId: finding.findingId, ruleId: finding.ruleId, address: existing.address, outcome: state, pullRequest: existing.pullRequest.url });
+        lines2.push({ findingId: finding.findingId, ruleId: finding.ruleId, address: existing.address, outcome: state, pullRequest: existing.pullRequest.url });
         continue;
       }
       existing.state = "merged";
@@ -8840,7 +8842,7 @@ async function runFix(options, deps) {
     const merged = existing && sameRepo && existing.state === "merged" && existing.pullRequest ? existing : null;
     if (merged && outcome.kind !== "patch") {
       reports.push(carry(finding.findingId, merged, "merged"));
-      lines.push({ findingId: finding.findingId, ruleId: finding.ruleId, address: merged.address, outcome: "merged", ...merged.pullRequest ? { pullRequest: merged.pullRequest.url } : {} });
+      lines2.push({ findingId: finding.findingId, ruleId: finding.ruleId, address: merged.address, outcome: "merged", ...merged.pullRequest ? { pullRequest: merged.pullRequest.url } : {} });
       continue;
     }
     const base = { findingId: finding.findingId, ruleId: finding.ruleId, address: outcome.address };
@@ -8853,18 +8855,18 @@ async function runFix(options, deps) {
         ...outcome.file !== void 0 ? { file: outcome.file } : {},
         ...outcome.attribute !== void 0 ? { attribute: outcome.attribute } : {}
       });
-      lines.push({ ...base, outcome: "suggested", reason: outcome.reason, ...outcome.file !== void 0 ? { file: outcome.file } : {} });
+      lines2.push({ ...base, outcome: "suggested", reason: outcome.reason, ...outcome.file !== void 0 ? { file: outcome.file } : {} });
       continue;
     }
     if (outcome.kind === "fixed_in_code") {
       reports.push({ findingId: finding.findingId, state: "pending", reason: "fixed_in_code", address: outcome.address, file: outcome.file, attribute: outcome.attribute });
-      lines.push({ ...base, outcome: "pending", reason: "fixed_in_code", file: outcome.file });
+      lines2.push({ ...base, outcome: "pending", reason: "fixed_in_code", file: outcome.file });
       continue;
     }
     const patch = outcome;
     const pending = (reason) => {
       reports.push({ findingId: finding.findingId, state: "pending", reason, address: patch.address, file: patch.file, attribute: patch.attribute });
-      lines.push({ ...base, outcome: "pending", reason, file: patch.file, changes: patch.changes });
+      lines2.push({ ...base, outcome: "pending", reason, file: patch.file, changes: patch.changes });
     };
     if (options.dryRun || !host) {
       pending("dry_run");
@@ -8872,7 +8874,7 @@ async function runFix(options, deps) {
     }
     if (host.unsupported) {
       reports.push({ findingId: finding.findingId, state: "suggested", reason: "unsupported_host", address: patch.address, file: patch.file, attribute: patch.attribute });
-      lines.push({ ...base, outcome: "suggested", reason: "unsupported_host", file: patch.file, changes: patch.changes });
+      lines2.push({ ...base, outcome: "suggested", reason: "unsupported_host", file: patch.file, changes: patch.changes });
       continue;
     }
     if (publicRepo) {
@@ -8896,7 +8898,7 @@ async function runFix(options, deps) {
         repository: host.repository,
         pullRequest: { url: pr.url, number: pr.number }
       });
-      lines.push({ ...base, outcome: state, file: patch.file, pullRequest: pr.url, changes: patch.changes });
+      lines2.push({ ...base, outcome: state, file: patch.file, pullRequest: pr.url, changes: patch.changes });
     };
     try {
       if (await host.branchExists(branch)) {
@@ -8946,7 +8948,7 @@ async function runFix(options, deps) {
       warnings.push(`could not record the fixes in AAA Sentinel: ${error2.message}`);
     }
   }
-  return { stdout: render(options, lines, deps.accountId, input.scanAt), warnings, lines, reported };
+  return { stdout: render(options, lines2, deps.accountId, input.scanAt), warnings, lines: lines2, reported };
 }
 var SkipFinding = class extends Error {
 };
@@ -8965,11 +8967,11 @@ var OUTCOME_TEXT = {
   pending: "pending",
   suggested: "change suggested, no pull request"
 };
-function render(options, lines, accountId, scanAt) {
-  if (options.format === "json") return JSON.stringify({ formatVersion: "1", accountId, scanAt, dryRun: options.dryRun, fixes: lines }, null, 2);
-  if (lines.length === 0) return `No open finding of account ${accountId} matches a resource of this plan.`;
+function render(options, lines2, accountId, scanAt) {
+  if (options.format === "json") return JSON.stringify({ formatVersion: "1", accountId, scanAt, dryRun: options.dryRun, fixes: lines2 }, null, 2);
+  if (lines2.length === 0) return `No open finding of account ${accountId} matches a resource of this plan.`;
   const out = [`Security fixes for account ${accountId}${options.dryRun ? " (dry run: nothing opened or recorded)" : ""}`];
-  for (const line of lines) {
+  for (const line of lines2) {
     const detail = [line.reason, line.file, line.pullRequest].filter(Boolean).join(", ");
     out.push(`  ${line.address} \u2014 ${title(line.ruleId)}: ${OUTCOME_TEXT[line.outcome]}${detail ? ` (${detail})` : ""}`);
     for (const change of line.changes ?? []) out.push(`      ${change}`);
@@ -9078,6 +9080,168 @@ ${FIX_USAGE}`);
   return { stdout: result.stdout, warnings: [...warnings, ...result.warnings], exitCode: 0 };
 }
 
+// src/posture/posture.ts
+import { parseArgs as parseArgs3 } from "node:util";
+var POSTURE_USAGE = `Usage: iac-cost posture --account <accountId> [options]
+
+Prints how the security posture of an AAA Sentinel account changed over a
+period: Score from the first to the last day with a scan, distinct findings
+resolved and new, mean time to fix, and catalog or coverage changes that make
+the Score not comparable.
+
+Options:
+  --account <accountId>      AAA Sentinel account id (acc_\u2026), or IAC_SECURITY_ACCOUNT_ID
+  --days <30|90|365>         Period (default: 90)
+  --format <markdown|text|json>
+                             Output format (default: markdown)
+  --fail-on-new <critical|high|medium|low>
+                             Exit 1 when new findings at this severity or worse
+                             appeared in the period (findings that cannot be
+                             compared with the previous scan do not count).
+                             With the gate, a 4xx from the API (scope, account)
+                             exits 2; our outage still exits 0.
+  -h, --help                 Show this help
+
+Environment:
+  IAC_SECURITY_CLIENT_ID / IAC_SECURITY_CLIENT_SECRET   OAuth2 app with the security:read scope`;
+var SEVERITIES2 = ["critical", "high", "medium", "low"];
+var DAYS = [30, 90, 365];
+var FORMATS2 = ["markdown", "text", "json"];
+var TIMEOUT_MS3 = 35e3;
+var APP_URL = "https://app.aaa-sentinel.com";
+var total = (c) => SEVERITIES2.reduce((n, s) => n + (c[s] ?? 0), 0);
+var bySeverity = (c) => SEVERITIES2.filter((s) => (c[s] ?? 0) > 0).map((s) => `${c[s]} ${s}`).join(", ");
+var REASONS = {
+  catalog_changed: "the rule catalog changed",
+  coverage_changed: "what could be evaluated changed",
+  not_compared: "a scan could not be compared with the previous one",
+  scored_changed: "the number of scoring rules changed",
+  partial: "one end was read incompletely"
+};
+function scoreLine(summary) {
+  const from = summary.from?.score;
+  const to = summary.to?.score;
+  if (from === null || from === void 0 || to === null || to === void 0) return "no comparable Score in the period";
+  if (!summary.comparable) {
+    const why = summary.notComparableReasons.map((r) => REASONS[r] ?? r).join("; ");
+    return `${from} \u2192 ${to}, not comparable (${why})`;
+  }
+  if (to > from) return `up from ${from} to ${to}`;
+  if (to < from) return `down from ${from} to ${to}`;
+  return `steady at ${to}`;
+}
+function lines(history) {
+  const s = history.summary;
+  const fix2 = ["critical", "high"].filter((sev) => s.meanFixDays[sev] !== null).map((sev) => `${sev} ${s.meanFixDays[sev]} d`);
+  const out = [
+    ["Score", scoreLine(s)],
+    ["Resolved", `${total(s.resolved)}${total(s.resolved) ? ` (${bySeverity(s.resolved)})` : ""}`],
+    ["New", `${total(s.opened)}${total(s.opened) ? ` (${bySeverity(s.opened)})` : ""}`]
+  ];
+  if (total(s.surfaced)) out.push(["Not comparable", `${total(s.surfaced)} new findings whose rule was not fully evaluated before`]);
+  if (total(s.unverified)) out.push(["Unverified", `${total(s.unverified)} gone without confirmation`]);
+  out.push(["Mean time to fix", fix2.length ? fix2.join(", ") : "no critical or high finding fixed with a known date"]);
+  out.push(["Scans", String(s.scans)]);
+  return out;
+}
+function renderPosture(history, format) {
+  const enlace = `${APP_URL}/posture?accountId=${encodeURIComponent(history.accountId)}`;
+  const notas = [];
+  if (history.points.length < 2) notas.push("The trend appears once the period has scans on at least two different days.");
+  if (history.acceptedRisks) notas.push("The account has accepted risks: each day keeps the Score computed at the time.");
+  if (history.summary.notCompared) notas.push(`${history.summary.notCompared} scan(s) could not be compared with the previous one.`);
+  if (history.summary.changesTruncated) notas.push("A scan had more changes than are stored: the figures are a minimum.");
+  if (history.truncated) notas.push("The period has more scans than fit: only the most recent ones are counted.");
+  const titulo = `Security posture, last ${history.days} days`;
+  if (format === "text") {
+    return [titulo, ...lines(history).map(([k, v]) => `  ${k}: ${v}`), ...notas.map((n) => `  ${n}`), `  ${enlace}`].join("\n");
+  }
+  return [
+    `### ${titulo}`,
+    "",
+    "| | |",
+    "|---|---|",
+    ...lines(history).map(([k, v]) => `| ${k} | ${v} |`),
+    "",
+    ...notas.map((n) => `> ${n}`),
+    ...notas.length ? [""] : [],
+    `[Open in AAA Sentinel](${enlace})`
+  ].join("\n");
+}
+function newAtOrAbove(summary, severity) {
+  return SEVERITIES2.slice(0, SEVERITIES2.indexOf(severity) + 1).reduce((n, s) => n + (summary.opened[s] ?? 0), 0);
+}
+async function fetchPostureHistory(config2) {
+  const fetchImpl = config2.fetchImpl ?? fetch;
+  const token = await fetchToken(config2, "security:read");
+  const url = `${config2.baseUrl}/v1/security/posture-history?accountId=${encodeURIComponent(config2.accountId)}&days=${config2.days}`;
+  const response = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(TIMEOUT_MS3) });
+  if (!response.ok) throw new Error(`posture_history_http_${response.status}`);
+  return await response.json();
+}
+async function runPostureCli(argv, io) {
+  const warnings = [];
+  const fail = (message) => ({ stdout: null, warnings: [...warnings, message], exitCode: 2 });
+  const { values, positionals } = parseArgs3({
+    args: [...argv],
+    strict: false,
+    allowPositionals: true,
+    options: {
+      account: { type: "string" },
+      days: { type: "string" },
+      format: { type: "string" },
+      "fail-on-new": { type: "string" },
+      help: { type: "boolean", short: "h" }
+    }
+  });
+  const known = /* @__PURE__ */ new Set(["account", "days", "format", "fail-on-new", "help", "h"]);
+  for (const name of Object.keys(values)) {
+    if (known.has(name)) continue;
+    if (/^fail[-_]?on/i.test(name)) return fail(`unknown option --${name}: the gate is spelled --fail-on-new`);
+    warnings.push(`unknown option --${name} ignored`);
+  }
+  if (values.help === true || values.h === true) return { stdout: POSTURE_USAGE, warnings, exitCode: 0 };
+  for (const name of ["account", "days", "format", "fail-on-new"]) {
+    const v = values[name];
+    if (v === true || typeof v === "string" && v.startsWith("-")) return fail(`--${name} needs a value`);
+  }
+  if (positionals.length > 0) return fail(`unexpected argument ${positionals.join(" ")}`);
+  const account = (typeof values.account === "string" ? values.account : io.env["IAC_SECURITY_ACCOUNT_ID"])?.trim();
+  if (!account) return fail(`posture needs --account <accountId>
+
+${POSTURE_USAGE}`);
+  const days = values.days === void 0 ? 90 : Number(values.days);
+  if (!DAYS.includes(days)) return fail("--days must be 30, 90 or 365");
+  const format = values.format === void 0 ? "markdown" : values.format;
+  if (typeof format !== "string" || !FORMATS2.includes(format)) return fail(`--format must be one of ${FORMATS2.join(", ")}`);
+  let gate = null;
+  if (values["fail-on-new"] !== void 0) {
+    const raw = typeof values["fail-on-new"] === "string" ? values["fail-on-new"].trim().toLowerCase() : "";
+    if (!SEVERITIES2.includes(raw)) return fail(`--fail-on-new must be one of ${SEVERITIES2.join(", ")}`);
+    gate = raw;
+  }
+  const baseUrl = resolveBaseUrl(io.env["IAC_COST_BASE_URL"] ?? "https://api.aaa-sentinel.com");
+  if (baseUrl === null) return fail("IAC_COST_BASE_URL must be an https URL");
+  const clientId = io.env["IAC_SECURITY_CLIENT_ID"];
+  const clientSecret = io.env["IAC_SECURITY_CLIENT_SECRET"];
+  if (!clientId || !clientSecret) return fail("IAC_SECURITY_CLIENT_ID/IAC_SECURITY_CLIENT_SECRET are not set: create an app with the security:read scope");
+  let history;
+  try {
+    history = await fetchPostureHistory({ baseUrl, clientId, clientSecret, accountId: account, days, ...io.fetchImpl ? { fetchImpl: io.fetchImpl } : {} });
+  } catch (error2) {
+    const mensaje = error2.message;
+    if (gate && /_http_4(00|01|03|04)$/.test(mensaje)) return fail(`could not read the posture history (${mensaje}): check the app scope (security:read) and the account id`);
+    return { stdout: null, warnings: [...warnings, `could not read the posture history, skipping: ${mensaje}`], exitCode: 0 };
+  }
+  if (history.access !== "full") {
+    return { stdout: null, warnings: [...warnings, "the account does not have the security add-on: no posture history to show"], exitCode: 0 };
+  }
+  const nuevos = gate ? newAtOrAbove(history.summary, gate) : 0;
+  const stdout = format === "json" ? JSON.stringify(history, null, 2) : renderPosture(history, format);
+  if (gate && nuevos > 0) warnings.push(`${nuevos} new finding(s) at ${gate} or worse in the last ${days} days (--fail-on-new ${gate})`);
+  return { stdout, warnings, exitCode: gate && nuevos > 0 ? 1 : 0 };
+}
+
 // src/terraform-plan.ts
 function actionOf2(actions) {
   if (actions.includes("create") && actions.includes("delete")) return "replace";
@@ -9169,51 +9333,51 @@ function actionVerb(action) {
 }
 function renderComment(estimate) {
   const { coverage } = estimate;
-  const lines = [COMMENT_MARKER, "### \u{1F4B2} Infrastructure cost estimate", ""];
-  lines.push(
+  const lines2 = [COMMENT_MARKER, "### \u{1F4B2} Infrastructure cost estimate", ""];
+  lines2.push(
     `**Coverage: ${coverage.pricedResources} of ${coverage.pricedResources + coverage.unpricedResources} billable resources priced** (${coverage.freeResources} more have no cost by design).`
   );
-  lines.push("");
+  lines2.push("");
   const display = estimate.displayCurrency?.approximate ? estimate.displayCurrency : null;
   const delta = (usd, converted) => display && typeof converted === "number" ? fmtConverted(converted, display.code) : fmtUsd(usd);
   if (estimate.totalMonthlyDeltaUsd !== null) {
-    const total = delta(estimate.totalMonthlyDeltaUsd, estimate.totalMonthlyDelta);
-    lines.push(
-      display ? `**Estimated change: ${total}** (list price, ${fmtUsd(estimate.totalMonthlyDeltaUsd)} in USD)` : `**Estimated change: ${total}** (list price, USD)`
+    const total2 = delta(estimate.totalMonthlyDeltaUsd, estimate.totalMonthlyDelta);
+    lines2.push(
+      display ? `**Estimated change: ${total2}** (list price, ${fmtUsd(estimate.totalMonthlyDeltaUsd)} in USD)` : `**Estimated change: ${total2}** (list price, USD)`
     );
   } else {
-    lines.push(
+    lines2.push(
       `_Coverage is below the threshold needed to publish a total \u2014 see the breakdown below instead of a number that wouldn't hold up._`
     );
   }
-  lines.push("");
-  lines.push(
+  lines2.push("");
+  lines2.push(
     display ? `> These are **list prices**, not what you actually pay. Cloud providers publish them in USD; the amounts shown are **approximate**, converted to ${display.code} at the ECB reference rate${display.rateDate ? ` of ${display.rateDate}` : ""} (1 USD = ${display.rate} ${display.code}). ` + LIST_PRICE_CAVEAT : `> These are **list prices in USD**, not what you actually pay. Cloud providers set their list prices in USD, so showing this in another billing currency would be an estimate on top of an estimate. ${LIST_PRICE_CAVEAT}`
   );
   if (estimate.priced.length > 0) {
-    lines.push("", "| Resource | Change | Qty | Delta |", "|---|---|---|---|");
+    lines2.push("", "| Resource | Change | Qty | Delta |", "|---|---|---|---|");
     for (const item of estimate.priced) {
-      lines.push(
+      lines2.push(
         `| \`${item.type}\` | ${actionVerb(item.action)} | ${item.count} | ${delta(item.monthlyDeltaUsd, item.monthlyDelta)} |`
       );
     }
   }
   if (estimate.unpriced.length > 0) {
-    lines.push("", "<details><summary>Not priced (" + coverage.unpricedResources + " resources)</summary>", "");
-    lines.push("| Resource | Change | Qty | Why |", "|---|---|---|---|");
+    lines2.push("", "<details><summary>Not priced (" + coverage.unpricedResources + " resources)</summary>", "");
+    lines2.push("| Resource | Change | Qty | Why |", "|---|---|---|---|");
     for (const item of estimate.unpriced) {
-      lines.push(`| \`${item.type}\` | ${actionVerb(item.action)} | ${item.count} | ${reasonText(item.reason)} |`);
+      lines2.push(`| \`${item.type}\` | ${actionVerb(item.action)} | ${item.count} | ${reasonText(item.reason)} |`);
     }
-    lines.push("", "</details>");
+    lines2.push("", "</details>");
   }
   const truncated = estimate.catalogs.filter((c) => c.truncated);
   if (truncated.length > 0) {
-    lines.push(
+    lines2.push(
       "",
       `\u26A0\uFE0F The price catalog for ${truncated.map((c) => c.region).join(", ")} was truncated by pagination: some prices may be missing.`
     );
   }
-  return lines.join("\n");
+  return lines2.join("\n");
 }
 
 // src/security/drift.ts
@@ -11350,7 +11514,7 @@ var AZURE_SECURITY_RULES = [
 var minus = (s) => typeof s === "string" ? s.toLowerCase() : "";
 var GCP_SECURITY_COMBOS = [
   {
-    // Abierta a internet, sin una conexión en 7 días y facturando: se paga por una puerta que nadie usa.
+    // Abierta a internet, sin uso en 7 días y facturando: se paga por una puerta que nadie usa.
     id: "COMBO_GCP_PUBLIC_SQL_IDLE",
     provider: "gcp",
     severity: "high",
@@ -11420,6 +11584,11 @@ var GCP_COMPUTE_CHECKS = {
 var GCP_SQL_CHECKS = {
   instances: "gcp:sql:instances"
 };
+var GCP_STORAGE_CHECKS = {
+  buckets: "gcp:storage:buckets",
+  // storage.buckets.getIamPolicy no está en roles/viewer ni en roles/storage.viewer: lo trae roles/iam.securityReviewer.
+  iamPolicy: "gcp:storage:buckets.getIamPolicy"
+};
 var GCP_FUNCTIONS_CHECKS = {
   list: "gcp:functions:list"
 };
@@ -11494,6 +11663,28 @@ function evaluate7(observation) {
     evidence: { authorizedNetworks: nets }
   };
 }
+function gcsPublicoEvaluate(observation) {
+  if (observation.attributes.publicAccessPrevention === "enforced") return { status: "ok" };
+  const bindings = observation.attributes.publicBindings;
+  if (!Array.isArray(bindings)) {
+    return { status: "unknown", check: GCP_STORAGE_CHECKS.iamPolicy, attribute: "publicBindings" };
+  }
+  if (bindings.length === 0) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: { publicBindings: bindings, publicAccessPrevention: observation.attributes.publicAccessPrevention ?? null }
+  };
+}
+var gcsPublico = {
+  id: "SEC_GCP_EXPOSURE_GCS_PUBLICO",
+  scope: "resource",
+  category: "security_exposure",
+  severity: "critical",
+  provider: "gcp",
+  kinds: ["gcs_bucket"],
+  requires: [GCP_STORAGE_CHECKS.buckets, GCP_STORAGE_CHECKS.iamPolicy],
+  evaluate: gcsPublicoEvaluate
+};
 var sqlPublico2 = {
   id: "SEC_GCP_EXPOSURE_SQL_PUBLICO",
   scope: "resource",
@@ -11910,6 +12101,7 @@ var GCP_SECURITY_RULES = [
   firewallAdminAbierto,
   politicaAdminAbierta,
   sqlPublico2,
+  gcsPublico,
   discoSinCmek,
   sqlSinCmek,
   secretoEnFunction,
@@ -11953,7 +12145,8 @@ var UNCOVERED_TYPES = /* @__PURE__ */ new Set([
   "google_compute_region_network_firewall_policy_rule",
   "google_logging_project_sink",
   "google_project_iam_audit_config",
-  // Sin regla viva todavía: un bucket de GCS público no se juzga ni antes ni después de desplegar.
+  // SEC_GCP_EXPOSURE_GCS_PUBLICO juzga el bucket desplegado; el plan reparte su política en tres tipos que aún no se cruzan.
+  "google_storage_bucket",
   "google_storage_bucket_iam_member",
   "google_storage_bucket_iam_binding",
   "google_storage_bucket_iam_policy"
@@ -12030,14 +12223,14 @@ function evaluatePlan(plan) {
   }))].sort();
   const accountRules = ALL_RULES.filter((rule) => rule.scope === "account" && providers.includes(rule.provider)).map((rule) => rule.id);
   const uncoveredTypes = [...new Set(index.resources.map((resource) => resource.type).filter((type) => UNCOVERED_TYPES.has(type)))].sort();
-  const bySeverity = (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] || a.address.localeCompare(b.address);
+  const bySeverity2 = (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] || a.address.localeCompare(b.address);
   return {
     report: {
       providers,
       resourcesEvaluated: new Set(observations.map((observation) => observation.address)).size,
-      findings: planFindings.sort(bySeverity),
-      combos: combos.sort(bySeverity),
-      notEvaluable: notEvaluable.sort(bySeverity),
+      findings: planFindings.sort(bySeverity2),
+      combos: combos.sort(bySeverity2),
+      notEvaluable: notEvaluable.sort(bySeverity2),
       accountRules,
       uncoveredTypes,
       passed
@@ -12053,7 +12246,7 @@ function blockingCount(report, threshold) {
 
 // src/security/render.ts
 import { createHash as createHash2 } from "node:crypto";
-var SEVERITIES2 = ["critical", "high", "medium", "low"];
+var SEVERITIES3 = ["critical", "high", "medium", "low"];
 var BADGE = { critical: "\u{1F534} critical", high: "\u{1F7E0} high", medium: "\u{1F7E1} medium", low: "\u26AA low" };
 var GAP_TEXT = {
   known_after_apply: "value only known after apply",
@@ -12085,7 +12278,7 @@ function evidenceSummary(finding) {
   return parts.join("; ");
 }
 function counts(report) {
-  return SEVERITIES2.map((severity) => `${report.findings.filter((f) => f.severity === severity).length} ${severity}`).join(", ");
+  return SEVERITIES3.map((severity) => `${report.findings.filter((f) => f.severity === severity).length} ${severity}`).join(", ");
 }
 function displayAddress(address) {
   return address.replace(/\["((?:[^"\\]|\\.)*)"\]/g, (_, key) => `[#${createHash2("sha256").update(key).digest("hex").slice(0, 8)}]`);
@@ -12104,18 +12297,18 @@ function groupedGaps(items) {
 function renderSecurityMarkdown(report) {
   const drift = report.drift?.items ?? [];
   if (report.resourcesEvaluated === 0 && report.uncoveredTypes.length === 0 && drift.length === 0) return null;
-  const lines = ["### \u{1F512} Security", ""];
+  const lines2 = ["### \u{1F512} Security", ""];
   if (report.resourcesEvaluated === 0) {
-    lines.push("_No resource in this plan is covered by the security rules yet._");
+    lines2.push("_No resource in this plan is covered by the security rules yet._");
   } else if (report.findings.length === 0) {
-    lines.push(
+    lines2.push(
       `**No findings** on the ${report.resourcesEvaluated} resources checked` + (report.notEvaluable.length > 0 ? `, but ${groupedGaps(report.notEvaluable).length} checks could not be decided before apply (below).` : ".")
     );
   } else {
-    lines.push(`**Findings: ${counts(report)}** on ${report.resourcesEvaluated} resources checked.`);
+    lines2.push(`**Findings: ${counts(report)}** on ${report.resourcesEvaluated} resources checked.`);
   }
   if (report.findings.length > 0) {
-    lines.push("", "| Severity | Rule | Resource | Change | Detail |", "|---|---|---|---|---|");
+    lines2.push("", "| Severity | Rule | Resource | Change | Detail |", "|---|---|---|---|---|");
     const rows = /* @__PURE__ */ new Map();
     for (const finding of report.findings) {
       const key = `${finding.ruleId}#${finding.address}`;
@@ -12125,35 +12318,35 @@ function renderSecurityMarkdown(report) {
     }
     for (const { finding, count } of rows.values()) {
       const detail = [evidenceSummary(finding), count > 1 ? `\xD7${count}` : ""].filter(Boolean).join(" ");
-      lines.push(
+      lines2.push(
         `| ${BADGE[finding.severity]} | ${cell(ruleTitle(finding.ruleId))} | ${code(finding.address)} | ${ACTION[finding.action] ?? finding.action} | ${cell(detail) || "\u2014"} |`
       );
     }
   }
   if (report.combos.length > 0) {
-    lines.push("", "**Toxic combinations** \u2014 findings that are worse together, fix these first:", "");
-    lines.push("| Severity | Combination | Resource |", "|---|---|---|");
+    lines2.push("", "**Toxic combinations** \u2014 findings that are worse together, fix these first:", "");
+    lines2.push("| Severity | Combination | Resource |", "|---|---|---|");
     for (const combo of report.combos) {
-      lines.push(`| ${BADGE[combo.severity]} | ${cell(comboTitle(combo.comboId))} | ${code(combo.address)} |`);
+      lines2.push(`| ${BADGE[combo.severity]} | ${cell(comboTitle(combo.comboId))} | ${code(combo.address)} |`);
     }
   }
   if (drift.length > 0) {
     const when = report.drift?.scanAt ? ` of ${report.drift.scanAt.slice(0, 10)}` : "";
-    lines.push("", `**Last scan vs. this plan** (AAA Sentinel scan${when}):`, "");
-    lines.push("| Severity | Rule | Resource | What it means |", "|---|---|---|---|");
+    lines2.push("", `**Last scan vs. this plan** (AAA Sentinel scan${when}):`, "");
+    lines2.push("| Severity | Rule | Resource | What it means |", "|---|---|---|---|");
     for (const item of drift) {
-      lines.push(`| ${BADGE[item.severity]} | ${cell(ruleTitle(item.ruleId))} | ${code(item.address)} | ${DRIFT_TEXT[item.status]} |`);
+      lines2.push(`| ${BADGE[item.severity]} | ${cell(ruleTitle(item.ruleId))} | ${code(item.address)} | ${DRIFT_TEXT[item.status]} |`);
     }
   }
   if (report.drift?.truncated) {
-    lines.push("", "_The live scan returned only its 500 most severe findings: drift on lower ones may be missing._");
+    lines2.push("", "_The live scan returned only its 500 most severe findings: drift on lower ones may be missing._");
   }
   const gaps = groupedGaps(report.notEvaluable);
   if (gaps.length > 0) {
-    lines.push("", `<details><summary>Not evaluable before apply (${gaps.length})</summary>`, "");
-    lines.push("| Rule | Resource | Why |", "|---|---|---|");
-    for (const gap of gaps) lines.push(`| ${cell(ruleTitle(gap.ruleId))} | ${code(gap.address)} | ${GAP_TEXT[gap.reason]} |`);
-    lines.push("", "</details>");
+    lines2.push("", `<details><summary>Not evaluable before apply (${gaps.length})</summary>`, "");
+    lines2.push("| Rule | Resource | Why |", "|---|---|---|");
+    for (const gap of gaps) lines2.push(`| ${cell(ruleTitle(gap.ruleId))} | ${code(gap.address)} | ${GAP_TEXT[gap.reason]} |`);
+    lines2.push("", "</details>");
   }
   const notes = [];
   if (report.accountRules.length > 0) {
@@ -12163,31 +12356,31 @@ function renderSecurityMarkdown(report) {
     notes.push(`Present in this plan but not checked before deploy: ${report.uncoveredTypes.map(code).join(", ")}.`);
   }
   notes.push("Evaluated on your machine with the same rules as the AAA Sentinel posture scan; the plan is not sent anywhere for this.");
-  lines.push("", ...notes.map((note) => `> ${note}`));
-  return lines.join("\n");
+  lines2.push("", ...notes.map((note) => `> ${note}`));
+  return lines2.join("\n");
 }
 function renderSecurityText(report) {
-  const lines = ["Security"];
-  if (report.resourcesEvaluated === 0) lines.push("  No resource in this plan is covered by the security rules yet.");
-  else lines.push(`  ${report.resourcesEvaluated} resources checked: ${counts(report)}`);
+  const lines2 = ["Security"];
+  if (report.resourcesEvaluated === 0) lines2.push("  No resource in this plan is covered by the security rules yet.");
+  else lines2.push(`  ${report.resourcesEvaluated} resources checked: ${counts(report)}`);
   for (const finding of report.findings) {
     const detail = evidenceSummary(finding);
-    lines.push(`  [${finding.severity.toUpperCase()}] ${ruleTitle(finding.ruleId)} - ${displayAddress(finding.address)} (${ACTION[finding.action] ?? finding.action})${detail ? ` - ${detail.replace(/`/g, "")}` : ""}`);
+    lines2.push(`  [${finding.severity.toUpperCase()}] ${ruleTitle(finding.ruleId)} - ${displayAddress(finding.address)} (${ACTION[finding.action] ?? finding.action})${detail ? ` - ${detail.replace(/`/g, "")}` : ""}`);
   }
   for (const combo of report.combos) {
-    lines.push(`  [${combo.severity.toUpperCase()}] combination: ${comboTitle(combo.comboId)} - ${displayAddress(combo.address)}`);
+    lines2.push(`  [${combo.severity.toUpperCase()}] combination: ${comboTitle(combo.comboId)} - ${displayAddress(combo.address)}`);
   }
   for (const item of report.drift?.items ?? []) {
-    lines.push(`  [LAST SCAN] ${ruleTitle(item.ruleId)} - ${displayAddress(item.address)}: ${DRIFT_TEXT[item.status]}`);
+    lines2.push(`  [LAST SCAN] ${ruleTitle(item.ruleId)} - ${displayAddress(item.address)}: ${DRIFT_TEXT[item.status]}`);
   }
   const gaps = groupedGaps(report.notEvaluable);
   if (gaps.length > 0) {
-    lines.push(`  Not evaluable before apply (${gaps.length}):`);
-    for (const gap of gaps) lines.push(`    - ${ruleTitle(gap.ruleId)} - ${displayAddress(gap.address)}: ${GAP_TEXT[gap.reason]}`);
+    lines2.push(`  Not evaluable before apply (${gaps.length}):`);
+    for (const gap of gaps) lines2.push(`    - ${ruleTitle(gap.ruleId)} - ${displayAddress(gap.address)}: ${GAP_TEXT[gap.reason]}`);
   }
-  if (report.accountRules.length > 0) lines.push(`  ${report.accountRules.length} account-wide rules are only checked by the live scan.`);
-  if (report.uncoveredTypes.length > 0) lines.push(`  Not checked before deploy: ${report.uncoveredTypes.join(", ")}`);
-  return lines.join("\n");
+  if (report.accountRules.length > 0) lines2.push(`  ${report.accountRules.length} account-wide rules are only checked by the live scan.`);
+  if (report.uncoveredTypes.length > 0) lines2.push(`  Not checked before deploy: ${report.uncoveredTypes.join(", ")}`);
+  return lines2.join("\n");
 }
 
 // src/run.ts
@@ -12230,10 +12423,10 @@ function decodePlan(bytes) {
 var fmtUsd2 = (n) => `${n < 0 ? "-" : "+"}$${Math.abs(n).toFixed(2)}/mo`;
 function costText(estimate) {
   const { coverage } = estimate;
-  const total = estimate.totalMonthlyDeltaUsd === null ? "no total (coverage too low)" : `${fmtUsd2(estimate.totalMonthlyDeltaUsd)} (list price, USD)`;
+  const total2 = estimate.totalMonthlyDeltaUsd === null ? "no total (coverage too low)" : `${fmtUsd2(estimate.totalMonthlyDeltaUsd)} (list price, USD)`;
   return [
     "Cost",
-    `  Estimated change: ${total}`,
+    `  Estimated change: ${total2}`,
     `  Coverage: ${coverage.pricedResources} of ${coverage.pricedResources + coverage.unpricedResources} billable resources priced`
   ].join("\n");
 }
@@ -12331,8 +12524,15 @@ async function fix(argv) {
   if (outcome.stdout) console.log(outcome.stdout);
   process.exitCode = outcome.exitCode;
 }
+async function posture(argv) {
+  const outcome = await runPostureCli(argv, { env: process.env });
+  for (const warning of outcome.warnings) console.warn(`iac-cost: ${warning}`);
+  if (outcome.stdout) console.log(outcome.stdout);
+  process.exitCode = outcome.exitCode;
+}
 async function main() {
   if (process.argv[2] === "fix") return fix(process.argv.slice(3));
+  if (process.argv[2] === "posture") return posture(process.argv.slice(3));
   const options = parseCliArgs(process.argv.slice(2), process.env);
   if ("error" in options) {
     console.error(`iac-cost: ${options.error}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aaa-sentinel/iac-cost",
-  "version": "0.3.1",
-  "description": "Estimate the monthly cost delta of a Terraform plan, check it against the AAA Sentinel security rules and open security fixes as pull requests from your CI",
+  "version": "0.4.0",
+  "description": "Estimate the monthly cost delta of a Terraform plan, check it against the AAA Sentinel security rules, open security fixes as pull requests and report how the security posture changed, from your CI",
   "license": "MIT",
   "type": "module",
   "bin": {