@aaa-sentinel/iac-cost 0.3.1 → 0.4.1

package/dist/cli.js

@@ -14,6 +14,7 @@ var FORMATS = ["markdown", "text", "json"];
 var SEVERITIES = ["critical", "high", "medium", "low"];
 var USAGE = `Usage: iac-cost [plan.json] [options]
        iac-cost fix [plan.json] --account <accountId> [options]   (see iac-cost fix --help)
+       iac-cost posture --account <accountId> [options]           (see iac-cost posture --help)
 
 Reads \`terraform show -json\` output from the file or from stdin.
 
@@ -1724,9 +1725,9 @@ var Doc = class {
       return;
     }
     const content = arg;
-    const lines = content.split("\n").filter((x) => x);
-    const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));
-    const dedented = lines.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
+    const lines2 = content.split("\n").filter((x) => x);
+    const minIndent = Math.min(...lines2.map((x) => x.length - x.trimStart().length));
+    const dedented = lines2.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
     for (const line of dedented) {
       this.content.push(line);
     }
@@ -6409,8 +6410,8 @@ function aggregateEstimates(estimates) {
   const billable = pricedResources + unpricedResources;
   const ratio = billable === 0 ? 1 : pricedResources / billable;
   const sufficientForTotal = ratio >= IAC_MIN_COVERAGE_RATIO;
-  const total = [...priced.values()].reduce((acc, i) => acc + i.monthlyDeltaUsd, 0);
-  const totalMonthlyDeltaUsd = sufficientForTotal ? round2(total) : null;
+  const total2 = [...priced.values()].reduce((acc, i) => acc + i.monthlyDeltaUsd, 0);
+  const totalMonthlyDeltaUsd = sufficientForTotal ? round2(total2) : null;
   const first = estimates[0]?.displayCurrency;
   const display = first && estimates.every((e) => e.displayCurrency?.code === first.code && e.displayCurrency.rate === first.rate) ? first : null;
   for (const item of priced.values()) {
@@ -8152,6 +8153,8 @@ function sqlInstances(index) {
     const builder = new ObservationBuilder(index, sql, "cloud_sql_instance", "gcp").cloudId("name");
     const ip = ["settings", 0, "ip_configuration", 0];
     builder.from("ipv4Enabled", index.get(sql, ...ip, "ipv4_enabled"), Boolean, true);
+    builder.from("sslMode", index.get(sql, ...ip, "ssl_mode"), String, null);
+    builder.from("requireSsl", index.get(sql, ...ip, "require_ssl"), Boolean, null);
     const networks = index.get(sql, ...ip, "authorized_networks");
     if (networks.state === "unknown") builder.gap("authorizedNetworks", "known_after_apply");
     else {
@@ -8267,6 +8270,18 @@ var RULE_TITLES = {
   SEC_AWS_NETWORK_ADMIN_PREFIX_LIST: "Admin ports open to the internet through a prefix list",
   SEC_AWS_EXPOSURE_S3_PUBLICO: "Public S3 bucket",
   SEC_AWS_EXPOSURE_LAMBDA_PUBLICA: "Lambda invocable from the internet",
+  SEC_AZURE_ENCRYPTION_KEYVAULT_SIN_PURGA: "Key Vault without purge protection",
+  SEC_AZURE_ENCRYPTION_SQL_SIN_TDE: "SQL database without TDE encryption",
+  SEC_AZURE_LOGGING_VNET_SIN_FLOW_LOGS: "VNet without flow logs",
+  SEC_GCP_ENCRYPTION_KMS_SIN_ROTACION: "Cloud KMS key without 90-day rotation",
+  SEC_GCP_LOGGING_VPC_SIN_FLOW_LOGS: "VPC network with subnets without flow logs",
+  SEC_AWS_NETWORK_BD_ABIERTO: "Database ports open to the internet",
+  SEC_AZURE_NETWORK_BD_ABIERTO: "NSG with database ports open to the internet",
+  SEC_GCP_NETWORK_BD_ABIERTO: "Firewall with database ports open to the internet",
+  SEC_AWS_EXPOSURE_RDS_PUBLICA: "Publicly accessible RDS instance",
+  SEC_GCP_ENCRYPTION_SQL_SIN_SSL: "Cloud SQL accepts unencrypted connections",
+  SEC_AWS_IAM_CLAVE_ANTIGUA: "Active access key older than 90 days",
+  SEC_AWS_IAM_POLITICA_CONTRASENAS: "Weak or missing IAM password policy",
   SEC_AWS_ENCRYPTION_KMS_SIN_ROTACION: "KMS key without rotation",
   SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR: "Unencrypted RDS",
   SEC_AWS_LOGGING_TRAIL_PARADO: "CloudTrail stopped",
@@ -8285,6 +8300,7 @@ var RULE_TITLES = {
   SEC_AZURE_LOGGING_SIN_DIAGNOSTICO: "Subscription does not export Activity Log",
   SEC_GCP_NETWORK_ADMIN_ABIERTO: "Firewall with admin ports open to the internet",
   SEC_GCP_EXPOSURE_SQL_PUBLICO: "Cloud SQL authorized from 0.0.0.0/0",
+  SEC_GCP_EXPOSURE_GCS_PUBLICO: "Public Cloud Storage bucket (allUsers or allAuthenticatedUsers)",
   SEC_GCP_ENCRYPTION_SQL_SIN_CMEK: "Cloud SQL without CMEK",
   SEC_GCP_SECRETS_FUNCTION_ENV: "Secret in a Cloud Function environment variable",
   SEC_GCP_IAM_ROL_PRIMITIVO: "Primitive Owner or Editor role on the project",
@@ -8779,7 +8795,7 @@ function carry(findingId, fix2, state) {
 }
 async function runFix(options, deps) {
   const warnings = [];
-  const lines = [];
+  const lines2 = [];
   const reports = [];
   const { host } = deps;
   let input;
@@ -8787,7 +8803,7 @@ async function runFix(options, deps) {
     input = await deps.api.load();
   } catch (error2) {
     warnings.push(`could not read the open findings, nothing to fix: ${error2.message}`);
-    return { stdout: render(options, lines, deps.accountId, null), warnings, lines, reported: 0 };
+    return { stdout: render(options, lines2, deps.accountId, null), warnings, lines: lines2, reported: 0 };
   }
   if (input.truncated) warnings.push("the account has more open findings than the API returns (500 most severe): the rest are left for a later run");
   let publicRepo = false;
@@ -8818,7 +8834,7 @@ async function runFix(options, deps) {
       }
       if (state !== "merged") {
         reports.push(carry(finding.findingId, existing, state));
-        lines.push({ findingId: finding.findingId, ruleId: finding.ruleId, address: existing.address, outcome: state, pullRequest: existing.pullRequest.url });
+        lines2.push({ findingId: finding.findingId, ruleId: finding.ruleId, address: existing.address, outcome: state, pullRequest: existing.pullRequest.url });
         continue;
       }
       existing.state = "merged";
@@ -8840,7 +8856,7 @@ async function runFix(options, deps) {
     const merged = existing && sameRepo && existing.state === "merged" && existing.pullRequest ? existing : null;
     if (merged && outcome.kind !== "patch") {
       reports.push(carry(finding.findingId, merged, "merged"));
-      lines.push({ findingId: finding.findingId, ruleId: finding.ruleId, address: merged.address, outcome: "merged", ...merged.pullRequest ? { pullRequest: merged.pullRequest.url } : {} });
+      lines2.push({ findingId: finding.findingId, ruleId: finding.ruleId, address: merged.address, outcome: "merged", ...merged.pullRequest ? { pullRequest: merged.pullRequest.url } : {} });
       continue;
     }
     const base = { findingId: finding.findingId, ruleId: finding.ruleId, address: outcome.address };
@@ -8853,18 +8869,18 @@ async function runFix(options, deps) {
         ...outcome.file !== void 0 ? { file: outcome.file } : {},
         ...outcome.attribute !== void 0 ? { attribute: outcome.attribute } : {}
       });
-      lines.push({ ...base, outcome: "suggested", reason: outcome.reason, ...outcome.file !== void 0 ? { file: outcome.file } : {} });
+      lines2.push({ ...base, outcome: "suggested", reason: outcome.reason, ...outcome.file !== void 0 ? { file: outcome.file } : {} });
       continue;
     }
     if (outcome.kind === "fixed_in_code") {
       reports.push({ findingId: finding.findingId, state: "pending", reason: "fixed_in_code", address: outcome.address, file: outcome.file, attribute: outcome.attribute });
-      lines.push({ ...base, outcome: "pending", reason: "fixed_in_code", file: outcome.file });
+      lines2.push({ ...base, outcome: "pending", reason: "fixed_in_code", file: outcome.file });
       continue;
     }
     const patch = outcome;
     const pending = (reason) => {
       reports.push({ findingId: finding.findingId, state: "pending", reason, address: patch.address, file: patch.file, attribute: patch.attribute });
-      lines.push({ ...base, outcome: "pending", reason, file: patch.file, changes: patch.changes });
+      lines2.push({ ...base, outcome: "pending", reason, file: patch.file, changes: patch.changes });
     };
     if (options.dryRun || !host) {
       pending("dry_run");
@@ -8872,7 +8888,7 @@ async function runFix(options, deps) {
     }
     if (host.unsupported) {
       reports.push({ findingId: finding.findingId, state: "suggested", reason: "unsupported_host", address: patch.address, file: patch.file, attribute: patch.attribute });
-      lines.push({ ...base, outcome: "suggested", reason: "unsupported_host", file: patch.file, changes: patch.changes });
+      lines2.push({ ...base, outcome: "suggested", reason: "unsupported_host", file: patch.file, changes: patch.changes });
       continue;
     }
     if (publicRepo) {
@@ -8896,7 +8912,7 @@ async function runFix(options, deps) {
         repository: host.repository,
         pullRequest: { url: pr.url, number: pr.number }
       });
-      lines.push({ ...base, outcome: state, file: patch.file, pullRequest: pr.url, changes: patch.changes });
+      lines2.push({ ...base, outcome: state, file: patch.file, pullRequest: pr.url, changes: patch.changes });
     };
     try {
       if (await host.branchExists(branch)) {
@@ -8946,7 +8962,7 @@ async function runFix(options, deps) {
       warnings.push(`could not record the fixes in AAA Sentinel: ${error2.message}`);
     }
   }
-  return { stdout: render(options, lines, deps.accountId, input.scanAt), warnings, lines, reported };
+  return { stdout: render(options, lines2, deps.accountId, input.scanAt), warnings, lines: lines2, reported };
 }
 var SkipFinding = class extends Error {
 };
@@ -8965,11 +8981,11 @@ var OUTCOME_TEXT = {
   pending: "pending",
   suggested: "change suggested, no pull request"
 };
-function render(options, lines, accountId, scanAt) {
-  if (options.format === "json") return JSON.stringify({ formatVersion: "1", accountId, scanAt, dryRun: options.dryRun, fixes: lines }, null, 2);
-  if (lines.length === 0) return `No open finding of account ${accountId} matches a resource of this plan.`;
+function render(options, lines2, accountId, scanAt) {
+  if (options.format === "json") return JSON.stringify({ formatVersion: "1", accountId, scanAt, dryRun: options.dryRun, fixes: lines2 }, null, 2);
+  if (lines2.length === 0) return `No open finding of account ${accountId} matches a resource of this plan.`;
   const out = [`Security fixes for account ${accountId}${options.dryRun ? " (dry run: nothing opened or recorded)" : ""}`];
-  for (const line of lines) {
+  for (const line of lines2) {
     const detail = [line.reason, line.file, line.pullRequest].filter(Boolean).join(", ");
     out.push(`  ${line.address} \u2014 ${title(line.ruleId)}: ${OUTCOME_TEXT[line.outcome]}${detail ? ` (${detail})` : ""}`);
     for (const change of line.changes ?? []) out.push(`      ${change}`);
@@ -9078,6 +9094,168 @@ ${FIX_USAGE}`);
   return { stdout: result.stdout, warnings: [...warnings, ...result.warnings], exitCode: 0 };
 }
 
+// src/posture/posture.ts
+import { parseArgs as parseArgs3 } from "node:util";
+var POSTURE_USAGE = `Usage: iac-cost posture --account <accountId> [options]
+
+Prints how the security posture of an AAA Sentinel account changed over a
+period: Score from the first to the last day with a scan, distinct findings
+resolved and new, mean time to fix, and catalog or coverage changes that make
+the Score not comparable.
+
+Options:
+  --account <accountId>      AAA Sentinel account id (acc_\u2026), or IAC_SECURITY_ACCOUNT_ID
+  --days <30|90|365>         Period (default: 90)
+  --format <markdown|text|json>
+                             Output format (default: markdown)
+  --fail-on-new <critical|high|medium|low>
+                             Exit 1 when new findings at this severity or worse
+                             appeared in the period (findings that cannot be
+                             compared with the previous scan do not count).
+                             With the gate, a 4xx from the API (scope, account)
+                             exits 2; our outage still exits 0.
+  -h, --help                 Show this help
+
+Environment:
+  IAC_SECURITY_CLIENT_ID / IAC_SECURITY_CLIENT_SECRET   OAuth2 app with the security:read scope`;
+var SEVERITIES2 = ["critical", "high", "medium", "low"];
+var DAYS = [30, 90, 365];
+var FORMATS2 = ["markdown", "text", "json"];
+var TIMEOUT_MS3 = 35e3;
+var APP_URL = "https://app.aaa-sentinel.com";
+var total = (c) => SEVERITIES2.reduce((n, s) => n + (c[s] ?? 0), 0);
+var bySeverity = (c) => SEVERITIES2.filter((s) => (c[s] ?? 0) > 0).map((s) => `${c[s]} ${s}`).join(", ");
+var REASONS = {
+  catalog_changed: "the rule catalog changed",
+  coverage_changed: "what could be evaluated changed",
+  not_compared: "a scan could not be compared with the previous one",
+  scored_changed: "the number of scoring rules changed",
+  partial: "one end was read incompletely"
+};
+function scoreLine(summary) {
+  const from = summary.from?.score;
+  const to = summary.to?.score;
+  if (from === null || from === void 0 || to === null || to === void 0) return "no comparable Score in the period";
+  if (!summary.comparable) {
+    const why = summary.notComparableReasons.map((r) => REASONS[r] ?? r).join("; ");
+    return `${from} \u2192 ${to}, not comparable (${why})`;
+  }
+  if (to > from) return `up from ${from} to ${to}`;
+  if (to < from) return `down from ${from} to ${to}`;
+  return `steady at ${to}`;
+}
+function lines(history) {
+  const s = history.summary;
+  const fix2 = ["critical", "high"].filter((sev) => s.meanFixDays[sev] !== null).map((sev) => `${sev} ${s.meanFixDays[sev]} d`);
+  const out = [
+    ["Score", scoreLine(s)],
+    ["Resolved", `${total(s.resolved)}${total(s.resolved) ? ` (${bySeverity(s.resolved)})` : ""}`],
+    ["New", `${total(s.opened)}${total(s.opened) ? ` (${bySeverity(s.opened)})` : ""}`]
+  ];
+  if (total(s.surfaced)) out.push(["Not comparable", `${total(s.surfaced)} new findings whose rule was not fully evaluated before`]);
+  if (total(s.unverified)) out.push(["Unverified", `${total(s.unverified)} gone without confirmation`]);
+  out.push(["Mean time to fix", fix2.length ? fix2.join(", ") : "no critical or high finding fixed with a known date"]);
+  out.push(["Scans", String(s.scans)]);
+  return out;
+}
+function renderPosture(history, format) {
+  const enlace = `${APP_URL}/posture?accountId=${encodeURIComponent(history.accountId)}`;
+  const notas = [];
+  if (history.points.length < 2) notas.push("The trend appears once the period has scans on at least two different days.");
+  if (history.acceptedRisks) notas.push("The account has accepted risks: each day keeps the Score computed at the time.");
+  if (history.summary.notCompared) notas.push(`${history.summary.notCompared} scan(s) could not be compared with the previous one.`);
+  if (history.summary.changesTruncated) notas.push("A scan had more changes than are stored: the figures are a minimum.");
+  if (history.truncated) notas.push("The period has more scans than fit: only the most recent ones are counted.");
+  const titulo = `Security posture, last ${history.days} days`;
+  if (format === "text") {
+    return [titulo, ...lines(history).map(([k, v]) => `  ${k}: ${v}`), ...notas.map((n) => `  ${n}`), `  ${enlace}`].join("\n");
+  }
+  return [
+    `### ${titulo}`,
+    "",
+    "| | |",
+    "|---|---|",
+    ...lines(history).map(([k, v]) => `| ${k} | ${v} |`),
+    "",
+    ...notas.map((n) => `> ${n}`),
+    ...notas.length ? [""] : [],
+    `[Open in AAA Sentinel](${enlace})`
+  ].join("\n");
+}
+function newAtOrAbove(summary, severity) {
+  return SEVERITIES2.slice(0, SEVERITIES2.indexOf(severity) + 1).reduce((n, s) => n + (summary.opened[s] ?? 0), 0);
+}
+async function fetchPostureHistory(config2) {
+  const fetchImpl = config2.fetchImpl ?? fetch;
+  const token = await fetchToken(config2, "security:read");
+  const url = `${config2.baseUrl}/v1/security/posture-history?accountId=${encodeURIComponent(config2.accountId)}&days=${config2.days}`;
+  const response = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(TIMEOUT_MS3) });
+  if (!response.ok) throw new Error(`posture_history_http_${response.status}`);
+  return await response.json();
+}
+async function runPostureCli(argv, io) {
+  const warnings = [];
+  const fail = (message) => ({ stdout: null, warnings: [...warnings, message], exitCode: 2 });
+  const { values, positionals } = parseArgs3({
+    args: [...argv],
+    strict: false,
+    allowPositionals: true,
+    options: {
+      account: { type: "string" },
+      days: { type: "string" },
+      format: { type: "string" },
+      "fail-on-new": { type: "string" },
+      help: { type: "boolean", short: "h" }
+    }
+  });
+  const known = /* @__PURE__ */ new Set(["account", "days", "format", "fail-on-new", "help", "h"]);
+  for (const name of Object.keys(values)) {
+    if (known.has(name)) continue;
+    if (/^fail[-_]?on/i.test(name)) return fail(`unknown option --${name}: the gate is spelled --fail-on-new`);
+    warnings.push(`unknown option --${name} ignored`);
+  }
+  if (values.help === true || values.h === true) return { stdout: POSTURE_USAGE, warnings, exitCode: 0 };
+  for (const name of ["account", "days", "format", "fail-on-new"]) {
+    const v = values[name];
+    if (v === true || typeof v === "string" && v.startsWith("-")) return fail(`--${name} needs a value`);
+  }
+  if (positionals.length > 0) return fail(`unexpected argument ${positionals.join(" ")}`);
+  const account = (typeof values.account === "string" ? values.account : io.env["IAC_SECURITY_ACCOUNT_ID"])?.trim();
+  if (!account) return fail(`posture needs --account <accountId>
+
+${POSTURE_USAGE}`);
+  const days = values.days === void 0 ? 90 : Number(values.days);
+  if (!DAYS.includes(days)) return fail("--days must be 30, 90 or 365");
+  const format = values.format === void 0 ? "markdown" : values.format;
+  if (typeof format !== "string" || !FORMATS2.includes(format)) return fail(`--format must be one of ${FORMATS2.join(", ")}`);
+  let gate = null;
+  if (values["fail-on-new"] !== void 0) {
+    const raw = typeof values["fail-on-new"] === "string" ? values["fail-on-new"].trim().toLowerCase() : "";
+    if (!SEVERITIES2.includes(raw)) return fail(`--fail-on-new must be one of ${SEVERITIES2.join(", ")}`);
+    gate = raw;
+  }
+  const baseUrl = resolveBaseUrl(io.env["IAC_COST_BASE_URL"] ?? "https://api.aaa-sentinel.com");
+  if (baseUrl === null) return fail("IAC_COST_BASE_URL must be an https URL");
+  const clientId = io.env["IAC_SECURITY_CLIENT_ID"];
+  const clientSecret = io.env["IAC_SECURITY_CLIENT_SECRET"];
+  if (!clientId || !clientSecret) return fail("IAC_SECURITY_CLIENT_ID/IAC_SECURITY_CLIENT_SECRET are not set: create an app with the security:read scope");
+  let history;
+  try {
+    history = await fetchPostureHistory({ baseUrl, clientId, clientSecret, accountId: account, days, ...io.fetchImpl ? { fetchImpl: io.fetchImpl } : {} });
+  } catch (error2) {
+    const mensaje = error2.message;
+    if (gate && /_http_4(00|01|03|04)$/.test(mensaje)) return fail(`could not read the posture history (${mensaje}): check the app scope (security:read) and the account id`);
+    return { stdout: null, warnings: [...warnings, `could not read the posture history, skipping: ${mensaje}`], exitCode: 0 };
+  }
+  if (history.access !== "full") {
+    return { stdout: null, warnings: [...warnings, "the account does not have the security add-on: no posture history to show"], exitCode: 0 };
+  }
+  const nuevos = gate ? newAtOrAbove(history.summary, gate) : 0;
+  const stdout = format === "json" ? JSON.stringify(history, null, 2) : renderPosture(history, format);
+  if (gate && nuevos > 0) warnings.push(`${nuevos} new finding(s) at ${gate} or worse in the last ${days} days (--fail-on-new ${gate})`);
+  return { stdout, warnings, exitCode: gate && nuevos > 0 ? 1 : 0 };
+}
+
 // src/terraform-plan.ts
 function actionOf2(actions) {
   if (actions.includes("create") && actions.includes("delete")) return "replace";
@@ -9169,51 +9347,51 @@ function actionVerb(action) {
 }
 function renderComment(estimate) {
   const { coverage } = estimate;
-  const lines = [COMMENT_MARKER, "### \u{1F4B2} Infrastructure cost estimate", ""];
-  lines.push(
+  const lines2 = [COMMENT_MARKER, "### \u{1F4B2} Infrastructure cost estimate", ""];
+  lines2.push(
     `**Coverage: ${coverage.pricedResources} of ${coverage.pricedResources + coverage.unpricedResources} billable resources priced** (${coverage.freeResources} more have no cost by design).`
   );
-  lines.push("");
+  lines2.push("");
   const display = estimate.displayCurrency?.approximate ? estimate.displayCurrency : null;
   const delta = (usd, converted) => display && typeof converted === "number" ? fmtConverted(converted, display.code) : fmtUsd(usd);
   if (estimate.totalMonthlyDeltaUsd !== null) {
-    const total = delta(estimate.totalMonthlyDeltaUsd, estimate.totalMonthlyDelta);
-    lines.push(
-      display ? `**Estimated change: ${total}** (list price, ${fmtUsd(estimate.totalMonthlyDeltaUsd)} in USD)` : `**Estimated change: ${total}** (list price, USD)`
+    const total2 = delta(estimate.totalMonthlyDeltaUsd, estimate.totalMonthlyDelta);
+    lines2.push(
+      display ? `**Estimated change: ${total2}** (list price, ${fmtUsd(estimate.totalMonthlyDeltaUsd)} in USD)` : `**Estimated change: ${total2}** (list price, USD)`
     );
   } else {
-    lines.push(
+    lines2.push(
       `_Coverage is below the threshold needed to publish a total \u2014 see the breakdown below instead of a number that wouldn't hold up._`
     );
   }
-  lines.push("");
-  lines.push(
+  lines2.push("");
+  lines2.push(
     display ? `> These are **list prices**, not what you actually pay. Cloud providers publish them in USD; the amounts shown are **approximate**, converted to ${display.code} at the ECB reference rate${display.rateDate ? ` of ${display.rateDate}` : ""} (1 USD = ${display.rate} ${display.code}). ` + LIST_PRICE_CAVEAT : `> These are **list prices in USD**, not what you actually pay. Cloud providers set their list prices in USD, so showing this in another billing currency would be an estimate on top of an estimate. ${LIST_PRICE_CAVEAT}`
   );
   if (estimate.priced.length > 0) {
-    lines.push("", "| Resource | Change | Qty | Delta |", "|---|---|---|---|");
+    lines2.push("", "| Resource | Change | Qty | Delta |", "|---|---|---|---|");
     for (const item of estimate.priced) {
-      lines.push(
+      lines2.push(
         `| \`${item.type}\` | ${actionVerb(item.action)} | ${item.count} | ${delta(item.monthlyDeltaUsd, item.monthlyDelta)} |`
       );
     }
   }
   if (estimate.unpriced.length > 0) {
-    lines.push("", "<details><summary>Not priced (" + coverage.unpricedResources + " resources)</summary>", "");
-    lines.push("| Resource | Change | Qty | Why |", "|---|---|---|---|");
+    lines2.push("", "<details><summary>Not priced (" + coverage.unpricedResources + " resources)</summary>", "");
+    lines2.push("| Resource | Change | Qty | Why |", "|---|---|---|---|");
     for (const item of estimate.unpriced) {
-      lines.push(`| \`${item.type}\` | ${actionVerb(item.action)} | ${item.count} | ${reasonText(item.reason)} |`);
+      lines2.push(`| \`${item.type}\` | ${actionVerb(item.action)} | ${item.count} | ${reasonText(item.reason)} |`);
     }
-    lines.push("", "</details>");
+    lines2.push("", "</details>");
   }
   const truncated = estimate.catalogs.filter((c) => c.truncated);
   if (truncated.length > 0) {
-    lines.push(
+    lines2.push(
       "",
       `\u26A0\uFE0F The price catalog for ${truncated.map((c) => c.region).join(", ")} was truncated by pagination: some prices may be missing.`
     );
   }
-  return lines.join("\n");
+  return lines2.join("\n");
 }
 
 // src/security/drift.ts
@@ -9376,8 +9554,6 @@ function publicVulnerable(input, provider) {
 }
 
 // ../../services/security/src/rules/aws/combos.ts
-var DIA_MS = 24 * 60 * 60 * 1e3;
-var OLD_ACCESS_KEY_DAYS = 90;
 function lambdaRef(resourceId, region) {
   const partes = resourceId.split(":");
   if (partes[0] === "arn" && partes[2] === "lambda" && partes[5] === "function" && partes[3] && partes[6]) {
@@ -9416,38 +9592,23 @@ var AWS_SECURITY_COMBOS = [
     id: "COMBO_AWS_PUBLIC_DB_UNENCRYPTED",
     provider: "aws",
     severity: "critical",
-    rules: ["SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR"],
-    detect: (input) => input.findings.filter((f) => f.ruleId === "SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR").flatMap((f) => {
-      const db = observationOf(input, "rds_instance", f.region, f.resourceId);
-      if (db?.attributes["publiclyAccessible"] !== true) return [];
-      return [{ region: f.region, resourceId: f.resourceId, resourceName: f.resourceName, findingIds: [f.id], evidence: { publiclyAccessible: true } }];
-    })
+    rules: ["SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR", "SEC_AWS_EXPOSURE_RDS_PUBLICA"],
+    detect: (input) => sameResource(input, "SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR", "SEC_AWS_EXPOSURE_RDS_PUBLICA").map((m) => ({ ...m, evidence: { publiclyAccessible: true } }))
   },
   {
     // Entra a la consola solo con contraseña y además tiene una clave de acceso vieja y activa: dos puertas sin segundo factor.
     id: "COMBO_AWS_USER_NO_MFA_OLD_KEY",
     provider: "aws",
     severity: "critical",
-    rules: ["SEC_AWS_IAM_USUARIO_SIN_MFA"],
-    detect: (input) => input.findings.filter((f) => f.ruleId === "SEC_AWS_IAM_USUARIO_SIN_MFA").flatMap((f) => {
-      const user = observationOf(input, "iam_user", f.region, f.resourceId);
-      const claves = Array.isArray(user?.attributes["accessKeys"]) ? user.attributes["accessKeys"] : [];
-      const viejas = claves.filter((k) => k["active"] === true && typeof k["createdAt"] === "string").map((k) => k["createdAt"]).filter((creada) => {
-        const dias = Math.floor((input.now.getTime() - Date.parse(creada)) / DIA_MS);
-        return Number.isFinite(dias) && dias > OLD_ACCESS_KEY_DAYS;
-      }).sort();
-      if (viejas.length === 0) return [];
-      return [
-        {
-          region: f.region,
-          resourceId: f.resourceId,
-          resourceName: f.resourceName,
-          findingIds: [f.id],
-          // La fecha y no la edad: la edad la calcula quien la enseña, si no se quedaría congelada el día del escaneo.
-          evidence: { oldActiveKeys: viejas.length, oldestKeyCreatedAt: viejas[0] }
-        }
-      ];
-    })
+    rules: ["SEC_AWS_IAM_USUARIO_SIN_MFA", "SEC_AWS_IAM_CLAVE_ANTIGUA"],
+    detect: (input) => {
+      const viejas = findingsByResource(input.findings, "SEC_AWS_IAM_CLAVE_ANTIGUA");
+      return sameResource(input, "SEC_AWS_IAM_USUARIO_SIN_MFA", "SEC_AWS_IAM_CLAVE_ANTIGUA").map((m) => {
+        const claves = viejas.get(`${m.region}::${m.resourceId}`)?.evidence["oldActiveKeys"];
+        const lista = Array.isArray(claves) ? claves : [];
+        return { ...m, evidence: { oldActiveKeys: lista.length, oldestKeyCreatedAt: lista[0]?.["createdAt"] ?? null } };
+      });
+    }
   },
   {
     // Alcanzable desde internet y con un CVE crítico o alto que ya tiene exploit público: el ataque está escrito.
@@ -9926,6 +10087,31 @@ var rdsClusterSnapshotPublico = {
   ],
   evaluate: (observation) => snapshotPublicoEvaluate(observation, RDS_CHECKS.clusterSnapshotAttributes)
 };
+function rdsPublicaEvaluate(observation) {
+  const publica = observation.attributes.publiclyAccessible;
+  if (typeof publica !== "boolean") {
+    return { status: "unknown", check: RDS_CHECKS.instances, attribute: "publiclyAccessible" };
+  }
+  if (!publica) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: {
+      publiclyAccessible: true,
+      engine: observation.attributes.engine ?? null,
+      securityGroupIds: observation.attributes.securityGroupIds ?? null
+    }
+  };
+}
+var rdsPublica = {
+  id: "SEC_AWS_EXPOSURE_RDS_PUBLICA",
+  scope: "resource",
+  category: "security_exposure",
+  severity: "high",
+  provider: "aws",
+  kinds: ["rds_instance"],
+  requires: [REGION_CHECKS.listRegions, RDS_CHECKS.instances],
+  evaluate: rdsPublicaEvaluate
+};
 
 // ../../services/security/src/rules/aws/iam.ts
 function falta4(check, attribute) {
@@ -9979,6 +10165,74 @@ var usuarioSinMfa = {
   requires: [IAM_CHECKS.listUsers, IAM_CHECKS.loginProfile, IAM_CHECKS.mfaDevices],
   evaluate: usuarioSinMfaEvaluate
 };
+var ACCESS_KEY_MAX_AGE_DAYS = 90;
+var DIA_MS = 864e5;
+function claveAntiguaEvaluate(observation, ahora = Date.now()) {
+  const claves = observation.attributes.accessKeys;
+  if (!Array.isArray(claves)) return falta4(IAM_CHECKS.accessKeys, "accessKeys");
+  const viejas = [];
+  let indecisa = false;
+  for (const entrada of claves) {
+    if (typeof entrada !== "object" || entrada === null) {
+      indecisa = true;
+      continue;
+    }
+    const clave = entrada;
+    if (clave.active === false) continue;
+    const creada = typeof clave.createdAt === "string" ? Date.parse(clave.createdAt) : Number.NaN;
+    if (clave.active !== true || Number.isNaN(creada)) {
+      indecisa = true;
+      continue;
+    }
+    if (ahora - creada > ACCESS_KEY_MAX_AGE_DAYS * DIA_MS) viejas.push({ id: clave.id ?? null, createdAt: clave.createdAt });
+  }
+  if (viejas.length === 0) return indecisa ? falta4(IAM_CHECKS.accessKeys, "accessKeys") : { status: "ok" };
+  viejas.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  return { status: "finding", evidence: { oldActiveKeys: viejas, maxAgeDays: ACCESS_KEY_MAX_AGE_DAYS } };
+}
+var claveAntigua = {
+  id: "SEC_AWS_IAM_CLAVE_ANTIGUA",
+  scope: "resource",
+  category: "security_iam",
+  severity: "medium",
+  provider: "aws",
+  kinds: ["iam_user"],
+  requires: [IAM_CHECKS.listUsers, IAM_CHECKS.accessKeys],
+  evaluate: (observation) => claveAntiguaEvaluate(observation)
+};
+var PASSWORD_MIN_LENGTH = 14;
+var PASSWORD_REUSE_PREVENTION = 24;
+function politicaContrasenasEvaluate(observation) {
+  const usuarios = observation.attributes.userCount;
+  if (typeof usuarios !== "number") return falta4(IAM_CHECKS.accountSummary, "userCount");
+  if (usuarios === 0) return { status: "ok" };
+  if (!("passwordPolicy" in observation.attributes)) return falta4(IAM_CHECKS.passwordPolicy, "passwordPolicy");
+  const politica = observation.attributes.passwordPolicy;
+  if (politica === null) {
+    return { status: "finding", evidence: { passwordPolicy: null, userCount: usuarios } };
+  }
+  if (typeof politica !== "object" || Array.isArray(politica)) return falta4(IAM_CHECKS.passwordPolicy, "passwordPolicy");
+  const p = politica;
+  const longitud = typeof p.minimumLength === "number" ? p.minimumLength : null;
+  const reuso = typeof p.reusePrevention === "number" ? p.reusePrevention : null;
+  const corta = longitud === null || longitud < PASSWORD_MIN_LENGTH;
+  const reutilizable = reuso === null || reuso < PASSWORD_REUSE_PREVENTION;
+  if (!corta && !reutilizable) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: { minimumLength: longitud, reusePrevention: reuso, userCount: usuarios }
+  };
+}
+var politicaContrasenas = {
+  id: "SEC_AWS_IAM_POLITICA_CONTRASENAS",
+  scope: "resource",
+  category: "security_iam",
+  severity: "low",
+  provider: "aws",
+  kinds: ["iam_account"],
+  requires: [IAM_CHECKS.accountSummary, IAM_CHECKS.passwordPolicy],
+  evaluate: politicaContrasenasEvaluate
+};
 function exclusion(observation) {
   const value = observation.attributes.excluded;
   if (value === null) return { known: true, excluded: false };
@@ -10397,6 +10651,7 @@ var trailGestionIncompleta = {
 
 // ../../services/security/src/collectors/internet.ts
 var ADMIN_PORTS2 = [22, 3389];
+var DATABASE_PORTS = [1433, 1521, 2483, 2484, 3306, 5432, 6379, 9200, 9300, 27017, 27018, 27019];
 var ETIQUETAS_INTERNET = /* @__PURE__ */ new Set(["*", "internet", "any", "/0"]);
 function longitudPrefijo(cidr, maximo) {
   const partes = cidr.split("/");
@@ -10437,13 +10692,21 @@ function protocolName(protocol) {
   const p = protocol.trim().toLowerCase();
   return POR_NUMERO2[p] ?? p;
 }
-function adminPortsReached(protocol, portRanges) {
+function portsReached(ports, protocol, portRanges) {
   const p = protocolName(protocol);
   const todos = p === "*" || p === "any" || p === "all";
-  if (todos) return [...ADMIN_PORTS2];
+  if (todos) return [...ports];
   if (p !== "tcp" && p !== "udp") return [];
-  if (portRanges.length === 0) return [...ADMIN_PORTS2];
-  return ADMIN_PORTS2.filter((puerto) => portRanges.some((rango) => cubrePuerto(rango, puerto)));
+  if (portRanges.length === 0) return [...ports];
+  return ports.filter((puerto) => portRanges.some((rango) => cubrePuerto(rango, puerto)));
+}
+function adminPortsReached(protocol, portRanges) {
+  return portsReached(ADMIN_PORTS2, protocol, portRanges);
+}
+function databasePortsReached(protocol, portRanges) {
+  if (protocolName(protocol) === "udp") return [];
+  if (adminPortsReached(protocol, portRanges).length > 0) return [];
+  return portsReached(DATABASE_PORTS, protocol, portRanges);
 }
 function cadenas2(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
@@ -10679,6 +10942,67 @@ var adminAbiertoPorPrefixList = {
   requires: [REGION_CHECKS.listRegions, EC2_CHECKS.securityGroups, EC2_CHECKS.prefixListEntries],
   evaluate: prefixListEvaluate
 };
+function puertosDeBaseDeDatos(regla) {
+  if (typeof regla.protocol !== "string") return void 0;
+  const protocolo = protocolName(regla.protocol);
+  if (protocolo !== "tcp") return [];
+  const desde = regla.fromPort;
+  const hasta = regla.toPort;
+  if (typeof desde !== "number" || typeof hasta !== "number") return void 0;
+  if (ADMIN_PORTS2.some((puerto) => desde <= puerto && puerto <= hasta)) return [];
+  return DATABASE_PORTS.filter((puerto) => desde <= puerto && puerto <= hasta);
+}
+function bdAbiertaEvaluate(observation) {
+  const ingress = observation.attributes.ingressRules;
+  if (!Array.isArray(ingress)) {
+    return { status: "unknown", check: EC2_CHECKS.securityGroups, attribute: "ingressRules" };
+  }
+  const aperturas = [];
+  const puertos = /* @__PURE__ */ new Set();
+  let indecisa = false;
+  for (const entrada of ingress) {
+    if (typeof entrada !== "object" || entrada === null) {
+      indecisa = true;
+      continue;
+    }
+    const regla = entrada;
+    const origenes = [...cadenas2(regla.cidrs), ...cadenas2(regla.ipv6Cidrs)];
+    const abierto = anySourceOpensToInternet(origenes);
+    if (abierto === void 0) {
+      indecisa = true;
+      continue;
+    }
+    if (!abierto) continue;
+    const alcanzados = puertosDeBaseDeDatos(regla);
+    if (alcanzados === void 0) {
+      indecisa = true;
+      continue;
+    }
+    if (alcanzados.length === 0) continue;
+    for (const puerto of alcanzados) puertos.add(puerto);
+    aperturas.push({
+      protocol: regla.protocol,
+      fromPort: regla.fromPort ?? null,
+      toPort: regla.toPort ?? null,
+      cidr: origenes.find((cidr) => sourceOpensToInternet(cidr) === true) ?? null
+    });
+  }
+  if (aperturas.length > 0) {
+    return { status: "finding", evidence: { ports: [...puertos].sort((a, b) => a - b), openings: aperturas } };
+  }
+  if (indecisa) return { status: "unknown", check: EC2_CHECKS.securityGroups, attribute: "ingressRules" };
+  return { status: "ok" };
+}
+var bdAbiertaAInternet = {
+  id: "SEC_AWS_NETWORK_BD_ABIERTO",
+  scope: "resource",
+  category: "security_network",
+  severity: "high",
+  provider: "aws",
+  kinds: ["security_group"],
+  requires: [REGION_CHECKS.listRegions, EC2_CHECKS.securityGroups],
+  evaluate: bdAbiertaEvaluate
+};
 
 // ../../services/security/src/rules/aws/monitoring.ts
 var evento = (...nombres) => nombres.map((n) => `$.eventName=${n}`);
@@ -11010,17 +11334,21 @@ var secretoEnVariableDeEntorno = {
 var AWS_SECURITY_RULES = [
   adminAbiertoAInternet,
   adminAbiertoPorPrefixList,
+  bdAbiertaAInternet,
   lightsailAdminAbierto,
   nlbAdminAbierto,
   bucketPublico,
   ebsSnapshotPublico,
   rdsSnapshotPublico,
   rdsClusterSnapshotPublico,
+  rdsPublica,
   lambdaPublica,
   kmsSinRotacion,
   rdsSinCifrar,
   rootSinMfa,
   usuarioSinMfa,
+  claveAntigua,
+  politicaContrasenas,
   adminEfectivo,
   identidadSinUso,
   claveSinUso,
@@ -11073,7 +11401,18 @@ var AZURE_STORAGE_CHECKS = {
 };
 var AZURE_SQL_CHECKS = {
   list: "azure:sql:list",
-  firewallRules: "azure:sql:firewallRules"
+  firewallRules: "azure:sql:firewallRules",
+  databases: "azure:sql:databases",
+  transparentDataEncryption: "azure:sql:transparentDataEncryption"
+};
+var AZURE_KEYVAULT_CHECKS = {
+  vaults: "azure:keyvault:vaults"
+};
+var AZURE_NETWORK_CHECKS = {
+  virtualNetworks: "azure:network:virtualNetworks",
+  networkWatchers: "azure:network:networkWatchers",
+  flowLogs: "azure:network:flowLogs",
+  networkInterfaces: "azure:network:networkInterfaces"
 };
 var AZURE_IAM_CHECKS = {
   roleAssignments: "azure:iam:roleAssignments",
@@ -11132,6 +11471,44 @@ var sqlTlsDebil = {
   requires: [AZURE_SQL_CHECKS.list],
   evaluate: sqlTlsEvaluate
 };
+function keyVaultSinPurgaEvaluate(observation) {
+  if (!("purgeProtection" in observation.attributes)) {
+    return { status: "unknown", check: AZURE_KEYVAULT_CHECKS.vaults, attribute: "purgeProtection" };
+  }
+  if (observation.attributes.purgeProtection === true) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: { purgeProtection: false, softDelete: observation.attributes.softDelete ?? null }
+  };
+}
+var keyVaultSinPurga = {
+  id: "SEC_AZURE_ENCRYPTION_KEYVAULT_SIN_PURGA",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "medium",
+  provider: "azure",
+  kinds: ["key_vault"],
+  requires: [AZURE_KEYVAULT_CHECKS.vaults],
+  evaluate: keyVaultSinPurgaEvaluate
+};
+function sqlSinTdeEvaluate(observation) {
+  const estado = observation.attributes.tdeState;
+  if (typeof estado !== "string") {
+    return { status: "unknown", check: AZURE_SQL_CHECKS.transparentDataEncryption, attribute: "tdeState" };
+  }
+  if (estado.toLowerCase() === "enabled") return { status: "ok" };
+  return { status: "finding", evidence: { tdeState: estado } };
+}
+var sqlSinTde = {
+  id: "SEC_AZURE_ENCRYPTION_SQL_SIN_TDE",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "high",
+  provider: "azure",
+  kinds: ["sql_database"],
+  requires: [AZURE_SQL_CHECKS.list, AZURE_SQL_CHECKS.databases, AZURE_SQL_CHECKS.transparentDataEncryption],
+  evaluate: sqlSinTdeEvaluate
+};
 
 // ../../services/security/src/rules/azure/exposure.ts
 function blobPublicoEvaluate(observation) {
@@ -11286,9 +11663,35 @@ var sinDiagnosticSettings = {
   requires: [AZURE_LOGGING_CHECKS.diagnosticSettings],
   evaluate: evaluate5
 };
+function vnetSinFlowLogsEvaluate(observation) {
+  const vnet = observation.attributes.vnetFlowLog;
+  if (typeof vnet !== "boolean") {
+    return { status: "unknown", check: AZURE_NETWORK_CHECKS.flowLogs, attribute: "vnetFlowLog" };
+  }
+  if (vnet) return { status: "ok" };
+  const subnets = observation.attributes.subnets;
+  if (!Array.isArray(subnets)) {
+    return { status: "unknown", check: AZURE_NETWORK_CHECKS.networkInterfaces, attribute: "subnets" };
+  }
+  const sinRegistro = subnets.filter((subnet) => subnet.covered !== true && subnet.platform !== true).map((subnet) => subnet.name);
+  if (sinRegistro.length === 0) return { status: "ok" };
+  return { status: "finding", evidence: { unloggedSubnets: sinRegistro, subnetCount: subnets.length } };
+}
+var vnetSinFlowLogs = {
+  id: "SEC_AZURE_LOGGING_VNET_SIN_FLOW_LOGS",
+  scope: "resource",
+  category: "security_logging",
+  severity: "medium",
+  provider: "azure",
+  kinds: ["virtual_network"],
+  // Las interfaces no van aquí: solo cuentan para subredes sin log propio, y su falta ya sale como `unknown` de esa VNet.
+  requires: [AZURE_NETWORK_CHECKS.virtualNetworks, AZURE_NETWORK_CHECKS.networkWatchers, AZURE_NETWORK_CHECKS.flowLogs],
+  evaluate: vnetSinFlowLogsEvaluate
+};
 
 // ../../services/security/src/rules/azure/network.ts
-function evaluate6(observation) {
+var evaluate6 = (observation) => nsgAbierto(observation, adminPortsReached);
+function nsgAbierto(observation, reached) {
   const ingress = observation.attributes.ingressRules;
   if (!Array.isArray(ingress)) {
     return { status: "unknown", check: AZURE_NSG_CHECKS.list, attribute: "ingressRules" };
@@ -11310,7 +11713,7 @@ function evaluate6(observation) {
     }
     if (!abierto) continue;
     const protocol = typeof regla.protocol === "string" ? regla.protocol : "";
-    const alcanzados = adminPortsReached(protocol, cadenas2(regla.ports));
+    const alcanzados = reached(protocol, cadenas2(regla.ports));
     if (alcanzados.length === 0) continue;
     for (const puerto of alcanzados) puertos.add(puerto);
     openings.push({ protocol: regla.protocol, ports: alcanzados, sources: regla.sources });
@@ -11333,24 +11736,38 @@ var nsgAdminAbierto = {
   requires: [AZURE_NSG_CHECKS.list],
   evaluate: evaluate6
 };
+var nsgBdAbierto = {
+  id: "SEC_AZURE_NETWORK_BD_ABIERTO",
+  scope: "resource",
+  category: "security_network",
+  severity: "high",
+  provider: "azure",
+  kinds: ["nsg"],
+  requires: [AZURE_NSG_CHECKS.list],
+  evaluate: (observation) => nsgAbierto(observation, databasePortsReached)
+};
 
 // ../../services/security/src/rules/azure/index.ts
 var AZURE_SECURITY_RULES = [
   nsgAdminAbierto,
+  nsgBdAbierto,
   storageBlobPublico,
   sqlPublico,
   storageTlsDebil,
   sqlTlsDebil,
+  keyVaultSinPurga,
+  sqlSinTde,
   rolPrivilegiado,
   asignacionHuerfana,
-  sinDiagnosticSettings
+  sinDiagnosticSettings,
+  vnetSinFlowLogs
 ];
 
 // ../../services/security/src/rules/gcp/combos.ts
 var minus = (s) => typeof s === "string" ? s.toLowerCase() : "";
 var GCP_SECURITY_COMBOS = [
   {
-    // Abierta a internet, sin una conexión en 7 días y facturando: se paga por una puerta que nadie usa.
+    // Abierta a internet, sin uso en 7 días y facturando: se paga por una puerta que nadie usa.
     id: "COMBO_GCP_PUBLIC_SQL_IDLE",
     provider: "gcp",
     severity: "high",
@@ -11415,11 +11832,25 @@ var GCP_COMPUTE_CHECKS = {
   effectiveFirewalls: "gcp:compute:networks.getEffectiveFirewalls",
   regions: "gcp:compute:regions",
   regionFirewallPolicies: "gcp:compute:regionNetworkFirewallPolicies",
-  sharedVpcHost: "gcp:compute:sharedVpcHostFirewalls"
+  sharedVpcHost: "gcp:compute:sharedVpcHostFirewalls",
+  subnetworks: "gcp:compute:subnetworks"
+};
+var GCP_NETWORK_MANAGEMENT_CHECKS = {
+  vpcFlowLogsConfigs: "gcp:networkmanagement:vpcFlowLogsConfigs"
+};
+var GCP_KMS_CHECKS = {
+  locations: "gcp:kms:locations",
+  keyRings: "gcp:kms:keyRings",
+  cryptoKeys: "gcp:kms:cryptoKeys"
 };
 var GCP_SQL_CHECKS = {
   instances: "gcp:sql:instances"
 };
+var GCP_STORAGE_CHECKS = {
+  buckets: "gcp:storage:buckets",
+  // storage.buckets.getIamPolicy no está en roles/viewer ni en roles/storage.viewer: lo trae roles/iam.securityReviewer.
+  iamPolicy: "gcp:storage:buckets.getIamPolicy"
+};
 var GCP_FUNCTIONS_CHECKS = {
   list: "gcp:functions:list"
 };
@@ -11480,6 +11911,63 @@ var sqlSinCmek = {
   requires: [GCP_SQL_CHECKS.instances],
   evaluate: sqlSinCmekEvaluate
 };
+var SOLO_CIFRADO = /* @__PURE__ */ new Set(["ENCRYPTED_ONLY", "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"]);
+function sqlSinSslEvaluate(observation) {
+  const modo = observation.attributes.sslMode;
+  if (typeof modo === "string" && modo.length > 0) {
+    if (SOLO_CIFRADO.has(modo)) return { status: "ok" };
+    return { status: "finding", evidence: { sslMode: modo, ipv4Enabled: observation.attributes.ipv4Enabled ?? null } };
+  }
+  const requiere = observation.attributes.requireSsl;
+  if (requiere === true) return { status: "ok" };
+  if (!("sslMode" in observation.attributes)) {
+    return { status: "unknown", check: GCP_SQL_CHECKS.instances, attribute: "sslMode" };
+  }
+  if (requiere !== false && requiere !== null) {
+    return { status: "unknown", check: GCP_SQL_CHECKS.instances, attribute: "requireSsl" };
+  }
+  return { status: "finding", evidence: { sslMode: null, requireSsl: requiere, ipv4Enabled: observation.attributes.ipv4Enabled ?? null } };
+}
+var sqlSinSsl = {
+  id: "SEC_GCP_ENCRYPTION_SQL_SIN_SSL",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "medium",
+  provider: "gcp",
+  kinds: ["cloud_sql_instance"],
+  requires: [GCP_SQL_CHECKS.instances],
+  evaluate: sqlSinSslEvaluate
+};
+var KMS_MAX_ROTATION_DAYS = 90;
+function segundos(periodo) {
+  const m = /^(\d+(?:\.\d+)?)s$/.exec(periodo);
+  return m ? Number(m[1]) : void 0;
+}
+function kmsSinRotacionEvaluate2(observation) {
+  const a = observation.attributes;
+  if (!("purpose" in a) || !("primaryState" in a) || !("rotationPeriod" in a)) {
+    return { status: "unknown", check: GCP_KMS_CHECKS.cryptoKeys, attribute: "rotationPeriod" };
+  }
+  if (a.purpose !== "ENCRYPT_DECRYPT" || a.primaryState !== "ENABLED") return { status: "ok" };
+  if (a.importOnly === true || typeof a.protectionLevel === "string" && a.protectionLevel.startsWith("EXTERNAL")) {
+    return { status: "ok" };
+  }
+  if (a.rotationPeriod === null) return { status: "finding", evidence: { rotationPeriod: null } };
+  const s = typeof a.rotationPeriod === "string" ? segundos(a.rotationPeriod) : void 0;
+  if (s === void 0) return { status: "unknown", check: GCP_KMS_CHECKS.cryptoKeys, attribute: "rotationPeriod" };
+  if (s <= KMS_MAX_ROTATION_DAYS * 86400) return { status: "ok" };
+  return { status: "finding", evidence: { rotationPeriodDays: Math.round(s / 86400) } };
+}
+var kmsSinRotacion2 = {
+  id: "SEC_GCP_ENCRYPTION_KMS_SIN_ROTACION",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "medium",
+  provider: "gcp",
+  kinds: ["kms_key"],
+  requires: [GCP_KMS_CHECKS.locations, GCP_KMS_CHECKS.keyRings, GCP_KMS_CHECKS.cryptoKeys],
+  evaluate: kmsSinRotacionEvaluate2
+};
 
 // ../../services/security/src/rules/gcp/exposure.ts
 function evaluate7(observation) {
@@ -11494,6 +11982,28 @@ function evaluate7(observation) {
     evidence: { authorizedNetworks: nets }
   };
 }
+function gcsPublicoEvaluate(observation) {
+  if (observation.attributes.publicAccessPrevention === "enforced") return { status: "ok" };
+  const bindings = observation.attributes.publicBindings;
+  if (!Array.isArray(bindings)) {
+    return { status: "unknown", check: GCP_STORAGE_CHECKS.iamPolicy, attribute: "publicBindings" };
+  }
+  if (bindings.length === 0) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: { publicBindings: bindings, publicAccessPrevention: observation.attributes.publicAccessPrevention ?? null }
+  };
+}
+var gcsPublico = {
+  id: "SEC_GCP_EXPOSURE_GCS_PUBLICO",
+  scope: "resource",
+  category: "security_exposure",
+  severity: "critical",
+  provider: "gcp",
+  kinds: ["gcs_bucket"],
+  requires: [GCP_STORAGE_CHECKS.buckets, GCP_STORAGE_CHECKS.iamPolicy],
+  evaluate: gcsPublicoEvaluate
+};
 var sqlPublico2 = {
   id: "SEC_GCP_EXPOSURE_SQL_PUBLICO",
   scope: "resource",
@@ -11693,9 +12203,42 @@ var sinExportSink = {
   requires: [GCP_LOGGING_CHECKS.sinks],
   evaluate: evaluate8
 };
+function vpcSinFlowLogsEvaluate(observation) {
+  const subnets = observation.attributes.subnets;
+  if (!Array.isArray(subnets)) {
+    return { status: "unknown", check: GCP_COMPUTE_CHECKS.subnetworks, attribute: "subnets" };
+  }
+  const lista = subnets;
+  const sinRegistro = lista.filter((subnet) => subnet.covered === false);
+  if (sinRegistro.length > 0) {
+    return {
+      status: "finding",
+      evidence: { unloggedSubnets: sinRegistro.map((subnet) => `${String(subnet.region)}/${String(subnet.name)}`), subnetCount: lista.length }
+    };
+  }
+  if (lista.some((subnet) => subnet.covered !== true)) {
+    return { status: "unknown", check: GCP_NETWORK_MANAGEMENT_CHECKS.vpcFlowLogsConfigs, attribute: "subnets" };
+  }
+  if (observation.attributes.subnetsComplete !== true) {
+    return { status: "unknown", check: GCP_COMPUTE_CHECKS.subnetworks, attribute: "subnets" };
+  }
+  return { status: "ok" };
+}
+var vpcSinFlowLogs = {
+  id: "SEC_GCP_LOGGING_VPC_SIN_FLOW_LOGS",
+  scope: "resource",
+  category: "security_logging",
+  severity: "medium",
+  provider: "gcp",
+  kinds: ["vpc_network"],
+  // Las configs de Network Management no van aquí: una red con `logConfig` en cada subred ya está bien sin ellas.
+  requires: [GCP_COMPUTE_CHECKS.subnetworks],
+  evaluate: vpcSinFlowLogsEvaluate
+};
 
 // ../../services/security/src/rules/gcp/network.ts
-function evaluate9(observation) {
+var evaluate9 = (observation) => firewallAbierto(observation, adminPortsReached);
+function firewallAbierto(observation, reached) {
   const direction = observation.attributes.direction;
   const disabled = observation.attributes.disabled;
   const sources = observation.attributes.sourceRanges;
@@ -11714,7 +12257,7 @@ function evaluate9(observation) {
     if (typeof entry !== "object" || entry === null) continue;
     const rule = entry;
     const protocol = typeof rule.protocol === "string" ? rule.protocol : "";
-    for (const puerto of adminPortsReached(protocol, cadenas2(rule.ports))) puertos.add(puerto);
+    for (const puerto of reached(protocol, cadenas2(rule.ports))) puertos.add(puerto);
   }
   if (puertos.size === 0) return { status: "ok" };
   return {
@@ -11874,6 +12417,16 @@ var firewallAdminAbierto = {
   requires: [GCP_COMPUTE_CHECKS.firewalls],
   evaluate: evaluate9
 };
+var firewallBdAbierto = {
+  id: "SEC_GCP_NETWORK_BD_ABIERTO",
+  scope: "resource",
+  category: "security_network",
+  severity: "high",
+  provider: "gcp",
+  kinds: ["firewall"],
+  requires: [GCP_COMPUTE_CHECKS.firewalls],
+  evaluate: (observation) => firewallAbierto(observation, databasePortsReached)
+};
 
 // ../../services/security/src/rules/gcp/secrets.ts
 var SOSPECHOSAS2 = ["PASSWORD", "PASSWD", "SECRET", "TOKEN", "APIKEY", "API_KEY", "PRIVATE_KEY", "CREDENTIAL"];
@@ -11908,10 +12461,14 @@ var secretoEnFunction = {
 // ../../services/security/src/rules/gcp/index.ts
 var GCP_SECURITY_RULES = [
   firewallAdminAbierto,
+  firewallBdAbierto,
   politicaAdminAbierta,
   sqlPublico2,
+  gcsPublico,
   discoSinCmek,
   sqlSinCmek,
+  sqlSinSsl,
+  kmsSinRotacion2,
   secretoEnFunction,
   rolPrimitivo,
   claveSaUserManaged,
@@ -11919,7 +12476,8 @@ var GCP_SECURITY_RULES = [
   claveSaSinUso,
   permisosSinUso2,
   auditIncompleto,
-  sinExportSink
+  sinExportSink,
+  vpcSinFlowLogs
 ];
 
 // src/security/evaluate.ts
@@ -11953,7 +12511,8 @@ var UNCOVERED_TYPES = /* @__PURE__ */ new Set([
   "google_compute_region_network_firewall_policy_rule",
   "google_logging_project_sink",
   "google_project_iam_audit_config",
-  // Sin regla viva todavía: un bucket de GCS público no se juzga ni antes ni después de desplegar.
+  // SEC_GCP_EXPOSURE_GCS_PUBLICO juzga el bucket desplegado; el plan reparte su política en tres tipos que aún no se cruzan.
+  "google_storage_bucket",
   "google_storage_bucket_iam_member",
   "google_storage_bucket_iam_binding",
   "google_storage_bucket_iam_policy"
@@ -12030,14 +12589,14 @@ function evaluatePlan(plan) {
   }))].sort();
   const accountRules = ALL_RULES.filter((rule) => rule.scope === "account" && providers.includes(rule.provider)).map((rule) => rule.id);
   const uncoveredTypes = [...new Set(index.resources.map((resource) => resource.type).filter((type) => UNCOVERED_TYPES.has(type)))].sort();
-  const bySeverity = (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] || a.address.localeCompare(b.address);
+  const bySeverity2 = (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] || a.address.localeCompare(b.address);
   return {
     report: {
       providers,
       resourcesEvaluated: new Set(observations.map((observation) => observation.address)).size,
-      findings: planFindings.sort(bySeverity),
-      combos: combos.sort(bySeverity),
-      notEvaluable: notEvaluable.sort(bySeverity),
+      findings: planFindings.sort(bySeverity2),
+      combos: combos.sort(bySeverity2),
+      notEvaluable: notEvaluable.sort(bySeverity2),
       accountRules,
       uncoveredTypes,
       passed
@@ -12053,7 +12612,7 @@ function blockingCount(report, threshold) {
 
 // src/security/render.ts
 import { createHash as createHash2 } from "node:crypto";
-var SEVERITIES2 = ["critical", "high", "medium", "low"];
+var SEVERITIES3 = ["critical", "high", "medium", "low"];
 var BADGE = { critical: "\u{1F534} critical", high: "\u{1F7E0} high", medium: "\u{1F7E1} medium", low: "\u26AA low" };
 var GAP_TEXT = {
   known_after_apply: "value only known after apply",
@@ -12085,7 +12644,7 @@ function evidenceSummary(finding) {
   return parts.join("; ");
 }
 function counts(report) {
-  return SEVERITIES2.map((severity) => `${report.findings.filter((f) => f.severity === severity).length} ${severity}`).join(", ");
+  return SEVERITIES3.map((severity) => `${report.findings.filter((f) => f.severity === severity).length} ${severity}`).join(", ");
 }
 function displayAddress(address) {
   return address.replace(/\["((?:[^"\\]|\\.)*)"\]/g, (_, key) => `[#${createHash2("sha256").update(key).digest("hex").slice(0, 8)}]`);
@@ -12104,18 +12663,18 @@ function groupedGaps(items) {
 function renderSecurityMarkdown(report) {
   const drift = report.drift?.items ?? [];
   if (report.resourcesEvaluated === 0 && report.uncoveredTypes.length === 0 && drift.length === 0) return null;
-  const lines = ["### \u{1F512} Security", ""];
+  const lines2 = ["### \u{1F512} Security", ""];
   if (report.resourcesEvaluated === 0) {
-    lines.push("_No resource in this plan is covered by the security rules yet._");
+    lines2.push("_No resource in this plan is covered by the security rules yet._");
   } else if (report.findings.length === 0) {
-    lines.push(
+    lines2.push(
       `**No findings** on the ${report.resourcesEvaluated} resources checked` + (report.notEvaluable.length > 0 ? `, but ${groupedGaps(report.notEvaluable).length} checks could not be decided before apply (below).` : ".")
     );
   } else {
-    lines.push(`**Findings: ${counts(report)}** on ${report.resourcesEvaluated} resources checked.`);
+    lines2.push(`**Findings: ${counts(report)}** on ${report.resourcesEvaluated} resources checked.`);
   }
   if (report.findings.length > 0) {
-    lines.push("", "| Severity | Rule | Resource | Change | Detail |", "|---|---|---|---|---|");
+    lines2.push("", "| Severity | Rule | Resource | Change | Detail |", "|---|---|---|---|---|");
     const rows = /* @__PURE__ */ new Map();
     for (const finding of report.findings) {
       const key = `${finding.ruleId}#${finding.address}`;
@@ -12125,35 +12684,35 @@ function renderSecurityMarkdown(report) {
     }
     for (const { finding, count } of rows.values()) {
       const detail = [evidenceSummary(finding), count > 1 ? `\xD7${count}` : ""].filter(Boolean).join(" ");
-      lines.push(
+      lines2.push(
         `| ${BADGE[finding.severity]} | ${cell(ruleTitle(finding.ruleId))} | ${code(finding.address)} | ${ACTION[finding.action] ?? finding.action} | ${cell(detail) || "\u2014"} |`
       );
     }
   }
   if (report.combos.length > 0) {
-    lines.push("", "**Toxic combinations** \u2014 findings that are worse together, fix these first:", "");
-    lines.push("| Severity | Combination | Resource |", "|---|---|---|");
+    lines2.push("", "**Toxic combinations** \u2014 findings that are worse together, fix these first:", "");
+    lines2.push("| Severity | Combination | Resource |", "|---|---|---|");
     for (const combo of report.combos) {
-      lines.push(`| ${BADGE[combo.severity]} | ${cell(comboTitle(combo.comboId))} | ${code(combo.address)} |`);
+      lines2.push(`| ${BADGE[combo.severity]} | ${cell(comboTitle(combo.comboId))} | ${code(combo.address)} |`);
     }
   }
   if (drift.length > 0) {
     const when = report.drift?.scanAt ? ` of ${report.drift.scanAt.slice(0, 10)}` : "";
-    lines.push("", `**Last scan vs. this plan** (AAA Sentinel scan${when}):`, "");
-    lines.push("| Severity | Rule | Resource | What it means |", "|---|---|---|---|");
+    lines2.push("", `**Last scan vs. this plan** (AAA Sentinel scan${when}):`, "");
+    lines2.push("| Severity | Rule | Resource | What it means |", "|---|---|---|---|");
     for (const item of drift) {
-      lines.push(`| ${BADGE[item.severity]} | ${cell(ruleTitle(item.ruleId))} | ${code(item.address)} | ${DRIFT_TEXT[item.status]} |`);
+      lines2.push(`| ${BADGE[item.severity]} | ${cell(ruleTitle(item.ruleId))} | ${code(item.address)} | ${DRIFT_TEXT[item.status]} |`);
     }
   }
   if (report.drift?.truncated) {
-    lines.push("", "_The live scan returned only its 500 most severe findings: drift on lower ones may be missing._");
+    lines2.push("", "_The live scan returned only its 500 most severe findings: drift on lower ones may be missing._");
   }
   const gaps = groupedGaps(report.notEvaluable);
   if (gaps.length > 0) {
-    lines.push("", `<details><summary>Not evaluable before apply (${gaps.length})</summary>`, "");
-    lines.push("| Rule | Resource | Why |", "|---|---|---|");
-    for (const gap of gaps) lines.push(`| ${cell(ruleTitle(gap.ruleId))} | ${code(gap.address)} | ${GAP_TEXT[gap.reason]} |`);
-    lines.push("", "</details>");
+    lines2.push("", `<details><summary>Not evaluable before apply (${gaps.length})</summary>`, "");
+    lines2.push("| Rule | Resource | Why |", "|---|---|---|");
+    for (const gap of gaps) lines2.push(`| ${cell(ruleTitle(gap.ruleId))} | ${code(gap.address)} | ${GAP_TEXT[gap.reason]} |`);
+    lines2.push("", "</details>");
   }
   const notes = [];
   if (report.accountRules.length > 0) {
@@ -12163,31 +12722,31 @@ function renderSecurityMarkdown(report) {
     notes.push(`Present in this plan but not checked before deploy: ${report.uncoveredTypes.map(code).join(", ")}.`);
   }
   notes.push("Evaluated on your machine with the same rules as the AAA Sentinel posture scan; the plan is not sent anywhere for this.");
-  lines.push("", ...notes.map((note) => `> ${note}`));
-  return lines.join("\n");
+  lines2.push("", ...notes.map((note) => `> ${note}`));
+  return lines2.join("\n");
 }
 function renderSecurityText(report) {
-  const lines = ["Security"];
-  if (report.resourcesEvaluated === 0) lines.push("  No resource in this plan is covered by the security rules yet.");
-  else lines.push(`  ${report.resourcesEvaluated} resources checked: ${counts(report)}`);
+  const lines2 = ["Security"];
+  if (report.resourcesEvaluated === 0) lines2.push("  No resource in this plan is covered by the security rules yet.");
+  else lines2.push(`  ${report.resourcesEvaluated} resources checked: ${counts(report)}`);
   for (const finding of report.findings) {
     const detail = evidenceSummary(finding);
-    lines.push(`  [${finding.severity.toUpperCase()}] ${ruleTitle(finding.ruleId)} - ${displayAddress(finding.address)} (${ACTION[finding.action] ?? finding.action})${detail ? ` - ${detail.replace(/`/g, "")}` : ""}`);
+    lines2.push(`  [${finding.severity.toUpperCase()}] ${ruleTitle(finding.ruleId)} - ${displayAddress(finding.address)} (${ACTION[finding.action] ?? finding.action})${detail ? ` - ${detail.replace(/`/g, "")}` : ""}`);
   }
   for (const combo of report.combos) {
-    lines.push(`  [${combo.severity.toUpperCase()}] combination: ${comboTitle(combo.comboId)} - ${displayAddress(combo.address)}`);
+    lines2.push(`  [${combo.severity.toUpperCase()}] combination: ${comboTitle(combo.comboId)} - ${displayAddress(combo.address)}`);
   }
   for (const item of report.drift?.items ?? []) {
-    lines.push(`  [LAST SCAN] ${ruleTitle(item.ruleId)} - ${displayAddress(item.address)}: ${DRIFT_TEXT[item.status]}`);
+    lines2.push(`  [LAST SCAN] ${ruleTitle(item.ruleId)} - ${displayAddress(item.address)}: ${DRIFT_TEXT[item.status]}`);
   }
   const gaps = groupedGaps(report.notEvaluable);
   if (gaps.length > 0) {
-    lines.push(`  Not evaluable before apply (${gaps.length}):`);
-    for (const gap of gaps) lines.push(`    - ${ruleTitle(gap.ruleId)} - ${displayAddress(gap.address)}: ${GAP_TEXT[gap.reason]}`);
+    lines2.push(`  Not evaluable before apply (${gaps.length}):`);
+    for (const gap of gaps) lines2.push(`    - ${ruleTitle(gap.ruleId)} - ${displayAddress(gap.address)}: ${GAP_TEXT[gap.reason]}`);
   }
-  if (report.accountRules.length > 0) lines.push(`  ${report.accountRules.length} account-wide rules are only checked by the live scan.`);
-  if (report.uncoveredTypes.length > 0) lines.push(`  Not checked before deploy: ${report.uncoveredTypes.join(", ")}`);
-  return lines.join("\n");
+  if (report.accountRules.length > 0) lines2.push(`  ${report.accountRules.length} account-wide rules are only checked by the live scan.`);
+  if (report.uncoveredTypes.length > 0) lines2.push(`  Not checked before deploy: ${report.uncoveredTypes.join(", ")}`);
+  return lines2.join("\n");
 }
 
 // src/run.ts
@@ -12230,10 +12789,10 @@ function decodePlan(bytes) {
 var fmtUsd2 = (n) => `${n < 0 ? "-" : "+"}$${Math.abs(n).toFixed(2)}/mo`;
 function costText(estimate) {
   const { coverage } = estimate;
-  const total = estimate.totalMonthlyDeltaUsd === null ? "no total (coverage too low)" : `${fmtUsd2(estimate.totalMonthlyDeltaUsd)} (list price, USD)`;
+  const total2 = estimate.totalMonthlyDeltaUsd === null ? "no total (coverage too low)" : `${fmtUsd2(estimate.totalMonthlyDeltaUsd)} (list price, USD)`;
   return [
     "Cost",
-    `  Estimated change: ${total}`,
+    `  Estimated change: ${total2}`,
     `  Coverage: ${coverage.pricedResources} of ${coverage.pricedResources + coverage.unpricedResources} billable resources priced`
   ].join("\n");
 }
@@ -12331,8 +12890,15 @@ async function fix(argv) {
   if (outcome.stdout) console.log(outcome.stdout);
   process.exitCode = outcome.exitCode;
 }
+async function posture(argv) {
+  const outcome = await runPostureCli(argv, { env: process.env });
+  for (const warning of outcome.warnings) console.warn(`iac-cost: ${warning}`);
+  if (outcome.stdout) console.log(outcome.stdout);
+  process.exitCode = outcome.exitCode;
+}
 async function main() {
   if (process.argv[2] === "fix") return fix(process.argv.slice(3));
+  if (process.argv[2] === "posture") return posture(process.argv.slice(3));
   const options = parseCliArgs(process.argv.slice(2), process.env);
   if ("error" in options) {
     console.error(`iac-cost: ${options.error}