@aaa-sentinel/iac-cost 0.4.0 → 0.4.1

package/README.md

@@ -175,19 +175,19 @@ value from the plan: a variable is named (`DB_PASSWORD`), its value is not read.
 
 | Cloud | Terraform resources | Rules |
 | --- | --- | --- |
-| AWS | `aws_security_group`, `aws_default_security_group`, `aws_security_group_rule`, `aws_vpc_security_group_ingress_rule` (+ `aws_ec2_managed_prefix_list`) | Admin ports (22/3389) open to the internet, directly or through a prefix list |
+| AWS | `aws_security_group`, `aws_default_security_group`, `aws_security_group_rule`, `aws_vpc_security_group_ingress_rule` (+ `aws_ec2_managed_prefix_list`) | Admin ports (22/3389) open to the internet, directly or through a prefix list; database ports (SQL Server, Oracle, MySQL, PostgreSQL, Redis, Elasticsearch, MongoDB) open to the internet over TCP |
 | AWS | `aws_s3_bucket` + `aws_s3_bucket_public_access_block`, `aws_s3_account_public_access_block`, `aws_s3_bucket_acl`, `aws_s3_bucket_policy` | Public bucket |
-| AWS | `aws_db_instance`, `aws_rds_cluster_instance` (+ `aws_rds_cluster`) | Unencrypted storage |
+| AWS | `aws_db_instance`, `aws_rds_cluster_instance` (+ `aws_rds_cluster`) | Unencrypted storage; publicly accessible |
 | AWS | `aws_lambda_function` + `aws_lambda_function_url`, `aws_lambda_permission` | Invocable from the internet; secret-looking environment variable names |
 | AWS | `aws_cloudtrail` | Trail stopped; management events excluded |
 | AWS | `aws_kms_key` | Key rotation off |
 | AWS | `aws_vpc`, `aws_default_vpc` + `aws_flow_log` (+ `aws_subnet`) | VPC without flow logs; flow logs that miss part of the traffic |
-| Azure | `azurerm_network_security_group`, `azurerm_network_security_rule` | Admin ports open to the internet |
+| Azure | `azurerm_network_security_group`, `azurerm_network_security_rule` | Admin ports open to the internet; database ports open to the internet over TCP |
 | Azure | `azurerm_storage_account` | Public blobs allowed; weak TLS or HTTP |
 | Azure | `azurerm_mssql_server` + `azurerm_mssql_firewall_rule` | Public network access open to 0.0.0.0–255.255.255.255; weak TLS |
 | Azure | `azurerm_role_assignment` | Owner or User Access Administrator at any scope; Contributor at subscription scope (a Contributor at a management group or at `/` is not flagged, neither here nor in the live scan) |
-| Google Cloud | `google_compute_firewall` | Admin ports open to the internet |
-| Google Cloud | `google_sql_database_instance` | Authorized from 0.0.0.0/0; no CMEK |
+| Google Cloud | `google_compute_firewall` | Admin ports open to the internet; database ports open to the internet over TCP |
+| Google Cloud | `google_sql_database_instance` | Authorized from 0.0.0.0/0; no CMEK; unencrypted connections accepted (`ssl_mode`; not judged while the provider still has to compute it) |
 | Google Cloud | `google_cloudfunctions_function`, `google_cloudfunctions2_function` | Secret-looking environment variable names |
 | Google Cloud | `google_project_iam_member`, `_binding`, `_policy`; `google_service_account_key` | Primitive Owner/Editor role; user-managed key |
 

package/dist/cli.js

@@ -8153,6 +8153,8 @@ function sqlInstances(index) {
     const builder = new ObservationBuilder(index, sql, "cloud_sql_instance", "gcp").cloudId("name");
     const ip = ["settings", 0, "ip_configuration", 0];
     builder.from("ipv4Enabled", index.get(sql, ...ip, "ipv4_enabled"), Boolean, true);
+    builder.from("sslMode", index.get(sql, ...ip, "ssl_mode"), String, null);
+    builder.from("requireSsl", index.get(sql, ...ip, "require_ssl"), Boolean, null);
     const networks = index.get(sql, ...ip, "authorized_networks");
     if (networks.state === "unknown") builder.gap("authorizedNetworks", "known_after_apply");
     else {
@@ -8268,6 +8270,18 @@ var RULE_TITLES = {
   SEC_AWS_NETWORK_ADMIN_PREFIX_LIST: "Admin ports open to the internet through a prefix list",
   SEC_AWS_EXPOSURE_S3_PUBLICO: "Public S3 bucket",
   SEC_AWS_EXPOSURE_LAMBDA_PUBLICA: "Lambda invocable from the internet",
+  SEC_AZURE_ENCRYPTION_KEYVAULT_SIN_PURGA: "Key Vault without purge protection",
+  SEC_AZURE_ENCRYPTION_SQL_SIN_TDE: "SQL database without TDE encryption",
+  SEC_AZURE_LOGGING_VNET_SIN_FLOW_LOGS: "VNet without flow logs",
+  SEC_GCP_ENCRYPTION_KMS_SIN_ROTACION: "Cloud KMS key without 90-day rotation",
+  SEC_GCP_LOGGING_VPC_SIN_FLOW_LOGS: "VPC network with subnets without flow logs",
+  SEC_AWS_NETWORK_BD_ABIERTO: "Database ports open to the internet",
+  SEC_AZURE_NETWORK_BD_ABIERTO: "NSG with database ports open to the internet",
+  SEC_GCP_NETWORK_BD_ABIERTO: "Firewall with database ports open to the internet",
+  SEC_AWS_EXPOSURE_RDS_PUBLICA: "Publicly accessible RDS instance",
+  SEC_GCP_ENCRYPTION_SQL_SIN_SSL: "Cloud SQL accepts unencrypted connections",
+  SEC_AWS_IAM_CLAVE_ANTIGUA: "Active access key older than 90 days",
+  SEC_AWS_IAM_POLITICA_CONTRASENAS: "Weak or missing IAM password policy",
   SEC_AWS_ENCRYPTION_KMS_SIN_ROTACION: "KMS key without rotation",
   SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR: "Unencrypted RDS",
   SEC_AWS_LOGGING_TRAIL_PARADO: "CloudTrail stopped",
@@ -9540,8 +9554,6 @@ function publicVulnerable(input, provider) {
 }
 
 // ../../services/security/src/rules/aws/combos.ts
-var DIA_MS = 24 * 60 * 60 * 1e3;
-var OLD_ACCESS_KEY_DAYS = 90;
 function lambdaRef(resourceId, region) {
   const partes = resourceId.split(":");
   if (partes[0] === "arn" && partes[2] === "lambda" && partes[5] === "function" && partes[3] && partes[6]) {
@@ -9580,38 +9592,23 @@ var AWS_SECURITY_COMBOS = [
     id: "COMBO_AWS_PUBLIC_DB_UNENCRYPTED",
     provider: "aws",
     severity: "critical",
-    rules: ["SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR"],
-    detect: (input) => input.findings.filter((f) => f.ruleId === "SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR").flatMap((f) => {
-      const db = observationOf(input, "rds_instance", f.region, f.resourceId);
-      if (db?.attributes["publiclyAccessible"] !== true) return [];
-      return [{ region: f.region, resourceId: f.resourceId, resourceName: f.resourceName, findingIds: [f.id], evidence: { publiclyAccessible: true } }];
-    })
+    rules: ["SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR", "SEC_AWS_EXPOSURE_RDS_PUBLICA"],
+    detect: (input) => sameResource(input, "SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR", "SEC_AWS_EXPOSURE_RDS_PUBLICA").map((m) => ({ ...m, evidence: { publiclyAccessible: true } }))
   },
   {
     // Entra a la consola solo con contraseña y además tiene una clave de acceso vieja y activa: dos puertas sin segundo factor.
     id: "COMBO_AWS_USER_NO_MFA_OLD_KEY",
     provider: "aws",
     severity: "critical",
-    rules: ["SEC_AWS_IAM_USUARIO_SIN_MFA"],
-    detect: (input) => input.findings.filter((f) => f.ruleId === "SEC_AWS_IAM_USUARIO_SIN_MFA").flatMap((f) => {
-      const user = observationOf(input, "iam_user", f.region, f.resourceId);
-      const claves = Array.isArray(user?.attributes["accessKeys"]) ? user.attributes["accessKeys"] : [];
-      const viejas = claves.filter((k) => k["active"] === true && typeof k["createdAt"] === "string").map((k) => k["createdAt"]).filter((creada) => {
-        const dias = Math.floor((input.now.getTime() - Date.parse(creada)) / DIA_MS);
-        return Number.isFinite(dias) && dias > OLD_ACCESS_KEY_DAYS;
-      }).sort();
-      if (viejas.length === 0) return [];
-      return [
-        {
-          region: f.region,
-          resourceId: f.resourceId,
-          resourceName: f.resourceName,
-          findingIds: [f.id],
-          // La fecha y no la edad: la edad la calcula quien la enseña, si no se quedaría congelada el día del escaneo.
-          evidence: { oldActiveKeys: viejas.length, oldestKeyCreatedAt: viejas[0] }
-        }
-      ];
-    })
+    rules: ["SEC_AWS_IAM_USUARIO_SIN_MFA", "SEC_AWS_IAM_CLAVE_ANTIGUA"],
+    detect: (input) => {
+      const viejas = findingsByResource(input.findings, "SEC_AWS_IAM_CLAVE_ANTIGUA");
+      return sameResource(input, "SEC_AWS_IAM_USUARIO_SIN_MFA", "SEC_AWS_IAM_CLAVE_ANTIGUA").map((m) => {
+        const claves = viejas.get(`${m.region}::${m.resourceId}`)?.evidence["oldActiveKeys"];
+        const lista = Array.isArray(claves) ? claves : [];
+        return { ...m, evidence: { oldActiveKeys: lista.length, oldestKeyCreatedAt: lista[0]?.["createdAt"] ?? null } };
+      });
+    }
   },
   {
     // Alcanzable desde internet y con un CVE crítico o alto que ya tiene exploit público: el ataque está escrito.
@@ -10090,6 +10087,31 @@ var rdsClusterSnapshotPublico = {
   ],
   evaluate: (observation) => snapshotPublicoEvaluate(observation, RDS_CHECKS.clusterSnapshotAttributes)
 };
+function rdsPublicaEvaluate(observation) {
+  const publica = observation.attributes.publiclyAccessible;
+  if (typeof publica !== "boolean") {
+    return { status: "unknown", check: RDS_CHECKS.instances, attribute: "publiclyAccessible" };
+  }
+  if (!publica) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: {
+      publiclyAccessible: true,
+      engine: observation.attributes.engine ?? null,
+      securityGroupIds: observation.attributes.securityGroupIds ?? null
+    }
+  };
+}
+var rdsPublica = {
+  id: "SEC_AWS_EXPOSURE_RDS_PUBLICA",
+  scope: "resource",
+  category: "security_exposure",
+  severity: "high",
+  provider: "aws",
+  kinds: ["rds_instance"],
+  requires: [REGION_CHECKS.listRegions, RDS_CHECKS.instances],
+  evaluate: rdsPublicaEvaluate
+};
 
 // ../../services/security/src/rules/aws/iam.ts
 function falta4(check, attribute) {
@@ -10143,6 +10165,74 @@ var usuarioSinMfa = {
   requires: [IAM_CHECKS.listUsers, IAM_CHECKS.loginProfile, IAM_CHECKS.mfaDevices],
   evaluate: usuarioSinMfaEvaluate
 };
+var ACCESS_KEY_MAX_AGE_DAYS = 90;
+var DIA_MS = 864e5;
+function claveAntiguaEvaluate(observation, ahora = Date.now()) {
+  const claves = observation.attributes.accessKeys;
+  if (!Array.isArray(claves)) return falta4(IAM_CHECKS.accessKeys, "accessKeys");
+  const viejas = [];
+  let indecisa = false;
+  for (const entrada of claves) {
+    if (typeof entrada !== "object" || entrada === null) {
+      indecisa = true;
+      continue;
+    }
+    const clave = entrada;
+    if (clave.active === false) continue;
+    const creada = typeof clave.createdAt === "string" ? Date.parse(clave.createdAt) : Number.NaN;
+    if (clave.active !== true || Number.isNaN(creada)) {
+      indecisa = true;
+      continue;
+    }
+    if (ahora - creada > ACCESS_KEY_MAX_AGE_DAYS * DIA_MS) viejas.push({ id: clave.id ?? null, createdAt: clave.createdAt });
+  }
+  if (viejas.length === 0) return indecisa ? falta4(IAM_CHECKS.accessKeys, "accessKeys") : { status: "ok" };
+  viejas.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  return { status: "finding", evidence: { oldActiveKeys: viejas, maxAgeDays: ACCESS_KEY_MAX_AGE_DAYS } };
+}
+var claveAntigua = {
+  id: "SEC_AWS_IAM_CLAVE_ANTIGUA",
+  scope: "resource",
+  category: "security_iam",
+  severity: "medium",
+  provider: "aws",
+  kinds: ["iam_user"],
+  requires: [IAM_CHECKS.listUsers, IAM_CHECKS.accessKeys],
+  evaluate: (observation) => claveAntiguaEvaluate(observation)
+};
+var PASSWORD_MIN_LENGTH = 14;
+var PASSWORD_REUSE_PREVENTION = 24;
+function politicaContrasenasEvaluate(observation) {
+  const usuarios = observation.attributes.userCount;
+  if (typeof usuarios !== "number") return falta4(IAM_CHECKS.accountSummary, "userCount");
+  if (usuarios === 0) return { status: "ok" };
+  if (!("passwordPolicy" in observation.attributes)) return falta4(IAM_CHECKS.passwordPolicy, "passwordPolicy");
+  const politica = observation.attributes.passwordPolicy;
+  if (politica === null) {
+    return { status: "finding", evidence: { passwordPolicy: null, userCount: usuarios } };
+  }
+  if (typeof politica !== "object" || Array.isArray(politica)) return falta4(IAM_CHECKS.passwordPolicy, "passwordPolicy");
+  const p = politica;
+  const longitud = typeof p.minimumLength === "number" ? p.minimumLength : null;
+  const reuso = typeof p.reusePrevention === "number" ? p.reusePrevention : null;
+  const corta = longitud === null || longitud < PASSWORD_MIN_LENGTH;
+  const reutilizable = reuso === null || reuso < PASSWORD_REUSE_PREVENTION;
+  if (!corta && !reutilizable) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: { minimumLength: longitud, reusePrevention: reuso, userCount: usuarios }
+  };
+}
+var politicaContrasenas = {
+  id: "SEC_AWS_IAM_POLITICA_CONTRASENAS",
+  scope: "resource",
+  category: "security_iam",
+  severity: "low",
+  provider: "aws",
+  kinds: ["iam_account"],
+  requires: [IAM_CHECKS.accountSummary, IAM_CHECKS.passwordPolicy],
+  evaluate: politicaContrasenasEvaluate
+};
 function exclusion(observation) {
   const value = observation.attributes.excluded;
   if (value === null) return { known: true, excluded: false };
@@ -10561,6 +10651,7 @@ var trailGestionIncompleta = {
 
 // ../../services/security/src/collectors/internet.ts
 var ADMIN_PORTS2 = [22, 3389];
+var DATABASE_PORTS = [1433, 1521, 2483, 2484, 3306, 5432, 6379, 9200, 9300, 27017, 27018, 27019];
 var ETIQUETAS_INTERNET = /* @__PURE__ */ new Set(["*", "internet", "any", "/0"]);
 function longitudPrefijo(cidr, maximo) {
   const partes = cidr.split("/");
@@ -10601,13 +10692,21 @@ function protocolName(protocol) {
   const p = protocol.trim().toLowerCase();
   return POR_NUMERO2[p] ?? p;
 }
-function adminPortsReached(protocol, portRanges) {
+function portsReached(ports, protocol, portRanges) {
   const p = protocolName(protocol);
   const todos = p === "*" || p === "any" || p === "all";
-  if (todos) return [...ADMIN_PORTS2];
+  if (todos) return [...ports];
   if (p !== "tcp" && p !== "udp") return [];
-  if (portRanges.length === 0) return [...ADMIN_PORTS2];
-  return ADMIN_PORTS2.filter((puerto) => portRanges.some((rango) => cubrePuerto(rango, puerto)));
+  if (portRanges.length === 0) return [...ports];
+  return ports.filter((puerto) => portRanges.some((rango) => cubrePuerto(rango, puerto)));
+}
+function adminPortsReached(protocol, portRanges) {
+  return portsReached(ADMIN_PORTS2, protocol, portRanges);
+}
+function databasePortsReached(protocol, portRanges) {
+  if (protocolName(protocol) === "udp") return [];
+  if (adminPortsReached(protocol, portRanges).length > 0) return [];
+  return portsReached(DATABASE_PORTS, protocol, portRanges);
 }
 function cadenas2(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
@@ -10843,6 +10942,67 @@ var adminAbiertoPorPrefixList = {
   requires: [REGION_CHECKS.listRegions, EC2_CHECKS.securityGroups, EC2_CHECKS.prefixListEntries],
   evaluate: prefixListEvaluate
 };
+function puertosDeBaseDeDatos(regla) {
+  if (typeof regla.protocol !== "string") return void 0;
+  const protocolo = protocolName(regla.protocol);
+  if (protocolo !== "tcp") return [];
+  const desde = regla.fromPort;
+  const hasta = regla.toPort;
+  if (typeof desde !== "number" || typeof hasta !== "number") return void 0;
+  if (ADMIN_PORTS2.some((puerto) => desde <= puerto && puerto <= hasta)) return [];
+  return DATABASE_PORTS.filter((puerto) => desde <= puerto && puerto <= hasta);
+}
+function bdAbiertaEvaluate(observation) {
+  const ingress = observation.attributes.ingressRules;
+  if (!Array.isArray(ingress)) {
+    return { status: "unknown", check: EC2_CHECKS.securityGroups, attribute: "ingressRules" };
+  }
+  const aperturas = [];
+  const puertos = /* @__PURE__ */ new Set();
+  let indecisa = false;
+  for (const entrada of ingress) {
+    if (typeof entrada !== "object" || entrada === null) {
+      indecisa = true;
+      continue;
+    }
+    const regla = entrada;
+    const origenes = [...cadenas2(regla.cidrs), ...cadenas2(regla.ipv6Cidrs)];
+    const abierto = anySourceOpensToInternet(origenes);
+    if (abierto === void 0) {
+      indecisa = true;
+      continue;
+    }
+    if (!abierto) continue;
+    const alcanzados = puertosDeBaseDeDatos(regla);
+    if (alcanzados === void 0) {
+      indecisa = true;
+      continue;
+    }
+    if (alcanzados.length === 0) continue;
+    for (const puerto of alcanzados) puertos.add(puerto);
+    aperturas.push({
+      protocol: regla.protocol,
+      fromPort: regla.fromPort ?? null,
+      toPort: regla.toPort ?? null,
+      cidr: origenes.find((cidr) => sourceOpensToInternet(cidr) === true) ?? null
+    });
+  }
+  if (aperturas.length > 0) {
+    return { status: "finding", evidence: { ports: [...puertos].sort((a, b) => a - b), openings: aperturas } };
+  }
+  if (indecisa) return { status: "unknown", check: EC2_CHECKS.securityGroups, attribute: "ingressRules" };
+  return { status: "ok" };
+}
+var bdAbiertaAInternet = {
+  id: "SEC_AWS_NETWORK_BD_ABIERTO",
+  scope: "resource",
+  category: "security_network",
+  severity: "high",
+  provider: "aws",
+  kinds: ["security_group"],
+  requires: [REGION_CHECKS.listRegions, EC2_CHECKS.securityGroups],
+  evaluate: bdAbiertaEvaluate
+};
 
 // ../../services/security/src/rules/aws/monitoring.ts
 var evento = (...nombres) => nombres.map((n) => `$.eventName=${n}`);
@@ -11174,17 +11334,21 @@ var secretoEnVariableDeEntorno = {
 var AWS_SECURITY_RULES = [
   adminAbiertoAInternet,
   adminAbiertoPorPrefixList,
+  bdAbiertaAInternet,
   lightsailAdminAbierto,
   nlbAdminAbierto,
   bucketPublico,
   ebsSnapshotPublico,
   rdsSnapshotPublico,
   rdsClusterSnapshotPublico,
+  rdsPublica,
   lambdaPublica,
   kmsSinRotacion,
   rdsSinCifrar,
   rootSinMfa,
   usuarioSinMfa,
+  claveAntigua,
+  politicaContrasenas,
   adminEfectivo,
   identidadSinUso,
   claveSinUso,
@@ -11237,7 +11401,18 @@ var AZURE_STORAGE_CHECKS = {
 };
 var AZURE_SQL_CHECKS = {
   list: "azure:sql:list",
-  firewallRules: "azure:sql:firewallRules"
+  firewallRules: "azure:sql:firewallRules",
+  databases: "azure:sql:databases",
+  transparentDataEncryption: "azure:sql:transparentDataEncryption"
+};
+var AZURE_KEYVAULT_CHECKS = {
+  vaults: "azure:keyvault:vaults"
+};
+var AZURE_NETWORK_CHECKS = {
+  virtualNetworks: "azure:network:virtualNetworks",
+  networkWatchers: "azure:network:networkWatchers",
+  flowLogs: "azure:network:flowLogs",
+  networkInterfaces: "azure:network:networkInterfaces"
 };
 var AZURE_IAM_CHECKS = {
   roleAssignments: "azure:iam:roleAssignments",
@@ -11296,6 +11471,44 @@ var sqlTlsDebil = {
   requires: [AZURE_SQL_CHECKS.list],
   evaluate: sqlTlsEvaluate
 };
+function keyVaultSinPurgaEvaluate(observation) {
+  if (!("purgeProtection" in observation.attributes)) {
+    return { status: "unknown", check: AZURE_KEYVAULT_CHECKS.vaults, attribute: "purgeProtection" };
+  }
+  if (observation.attributes.purgeProtection === true) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: { purgeProtection: false, softDelete: observation.attributes.softDelete ?? null }
+  };
+}
+var keyVaultSinPurga = {
+  id: "SEC_AZURE_ENCRYPTION_KEYVAULT_SIN_PURGA",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "medium",
+  provider: "azure",
+  kinds: ["key_vault"],
+  requires: [AZURE_KEYVAULT_CHECKS.vaults],
+  evaluate: keyVaultSinPurgaEvaluate
+};
+function sqlSinTdeEvaluate(observation) {
+  const estado = observation.attributes.tdeState;
+  if (typeof estado !== "string") {
+    return { status: "unknown", check: AZURE_SQL_CHECKS.transparentDataEncryption, attribute: "tdeState" };
+  }
+  if (estado.toLowerCase() === "enabled") return { status: "ok" };
+  return { status: "finding", evidence: { tdeState: estado } };
+}
+var sqlSinTde = {
+  id: "SEC_AZURE_ENCRYPTION_SQL_SIN_TDE",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "high",
+  provider: "azure",
+  kinds: ["sql_database"],
+  requires: [AZURE_SQL_CHECKS.list, AZURE_SQL_CHECKS.databases, AZURE_SQL_CHECKS.transparentDataEncryption],
+  evaluate: sqlSinTdeEvaluate
+};
 
 // ../../services/security/src/rules/azure/exposure.ts
 function blobPublicoEvaluate(observation) {
@@ -11450,9 +11663,35 @@ var sinDiagnosticSettings = {
   requires: [AZURE_LOGGING_CHECKS.diagnosticSettings],
   evaluate: evaluate5
 };
+function vnetSinFlowLogsEvaluate(observation) {
+  const vnet = observation.attributes.vnetFlowLog;
+  if (typeof vnet !== "boolean") {
+    return { status: "unknown", check: AZURE_NETWORK_CHECKS.flowLogs, attribute: "vnetFlowLog" };
+  }
+  if (vnet) return { status: "ok" };
+  const subnets = observation.attributes.subnets;
+  if (!Array.isArray(subnets)) {
+    return { status: "unknown", check: AZURE_NETWORK_CHECKS.networkInterfaces, attribute: "subnets" };
+  }
+  const sinRegistro = subnets.filter((subnet) => subnet.covered !== true && subnet.platform !== true).map((subnet) => subnet.name);
+  if (sinRegistro.length === 0) return { status: "ok" };
+  return { status: "finding", evidence: { unloggedSubnets: sinRegistro, subnetCount: subnets.length } };
+}
+var vnetSinFlowLogs = {
+  id: "SEC_AZURE_LOGGING_VNET_SIN_FLOW_LOGS",
+  scope: "resource",
+  category: "security_logging",
+  severity: "medium",
+  provider: "azure",
+  kinds: ["virtual_network"],
+  // Las interfaces no van aquí: solo cuentan para subredes sin log propio, y su falta ya sale como `unknown` de esa VNet.
+  requires: [AZURE_NETWORK_CHECKS.virtualNetworks, AZURE_NETWORK_CHECKS.networkWatchers, AZURE_NETWORK_CHECKS.flowLogs],
+  evaluate: vnetSinFlowLogsEvaluate
+};
 
 // ../../services/security/src/rules/azure/network.ts
-function evaluate6(observation) {
+var evaluate6 = (observation) => nsgAbierto(observation, adminPortsReached);
+function nsgAbierto(observation, reached) {
   const ingress = observation.attributes.ingressRules;
   if (!Array.isArray(ingress)) {
     return { status: "unknown", check: AZURE_NSG_CHECKS.list, attribute: "ingressRules" };
@@ -11474,7 +11713,7 @@ function evaluate6(observation) {
     }
     if (!abierto) continue;
     const protocol = typeof regla.protocol === "string" ? regla.protocol : "";
-    const alcanzados = adminPortsReached(protocol, cadenas2(regla.ports));
+    const alcanzados = reached(protocol, cadenas2(regla.ports));
     if (alcanzados.length === 0) continue;
     for (const puerto of alcanzados) puertos.add(puerto);
     openings.push({ protocol: regla.protocol, ports: alcanzados, sources: regla.sources });
@@ -11497,17 +11736,31 @@ var nsgAdminAbierto = {
   requires: [AZURE_NSG_CHECKS.list],
   evaluate: evaluate6
 };
+var nsgBdAbierto = {
+  id: "SEC_AZURE_NETWORK_BD_ABIERTO",
+  scope: "resource",
+  category: "security_network",
+  severity: "high",
+  provider: "azure",
+  kinds: ["nsg"],
+  requires: [AZURE_NSG_CHECKS.list],
+  evaluate: (observation) => nsgAbierto(observation, databasePortsReached)
+};
 
 // ../../services/security/src/rules/azure/index.ts
 var AZURE_SECURITY_RULES = [
   nsgAdminAbierto,
+  nsgBdAbierto,
   storageBlobPublico,
   sqlPublico,
   storageTlsDebil,
   sqlTlsDebil,
+  keyVaultSinPurga,
+  sqlSinTde,
   rolPrivilegiado,
   asignacionHuerfana,
-  sinDiagnosticSettings
+  sinDiagnosticSettings,
+  vnetSinFlowLogs
 ];
 
 // ../../services/security/src/rules/gcp/combos.ts
@@ -11579,7 +11832,16 @@ var GCP_COMPUTE_CHECKS = {
   effectiveFirewalls: "gcp:compute:networks.getEffectiveFirewalls",
   regions: "gcp:compute:regions",
   regionFirewallPolicies: "gcp:compute:regionNetworkFirewallPolicies",
-  sharedVpcHost: "gcp:compute:sharedVpcHostFirewalls"
+  sharedVpcHost: "gcp:compute:sharedVpcHostFirewalls",
+  subnetworks: "gcp:compute:subnetworks"
+};
+var GCP_NETWORK_MANAGEMENT_CHECKS = {
+  vpcFlowLogsConfigs: "gcp:networkmanagement:vpcFlowLogsConfigs"
+};
+var GCP_KMS_CHECKS = {
+  locations: "gcp:kms:locations",
+  keyRings: "gcp:kms:keyRings",
+  cryptoKeys: "gcp:kms:cryptoKeys"
 };
 var GCP_SQL_CHECKS = {
   instances: "gcp:sql:instances"
@@ -11649,6 +11911,63 @@ var sqlSinCmek = {
   requires: [GCP_SQL_CHECKS.instances],
   evaluate: sqlSinCmekEvaluate
 };
+var SOLO_CIFRADO = /* @__PURE__ */ new Set(["ENCRYPTED_ONLY", "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"]);
+function sqlSinSslEvaluate(observation) {
+  const modo = observation.attributes.sslMode;
+  if (typeof modo === "string" && modo.length > 0) {
+    if (SOLO_CIFRADO.has(modo)) return { status: "ok" };
+    return { status: "finding", evidence: { sslMode: modo, ipv4Enabled: observation.attributes.ipv4Enabled ?? null } };
+  }
+  const requiere = observation.attributes.requireSsl;
+  if (requiere === true) return { status: "ok" };
+  if (!("sslMode" in observation.attributes)) {
+    return { status: "unknown", check: GCP_SQL_CHECKS.instances, attribute: "sslMode" };
+  }
+  if (requiere !== false && requiere !== null) {
+    return { status: "unknown", check: GCP_SQL_CHECKS.instances, attribute: "requireSsl" };
+  }
+  return { status: "finding", evidence: { sslMode: null, requireSsl: requiere, ipv4Enabled: observation.attributes.ipv4Enabled ?? null } };
+}
+var sqlSinSsl = {
+  id: "SEC_GCP_ENCRYPTION_SQL_SIN_SSL",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "medium",
+  provider: "gcp",
+  kinds: ["cloud_sql_instance"],
+  requires: [GCP_SQL_CHECKS.instances],
+  evaluate: sqlSinSslEvaluate
+};
+var KMS_MAX_ROTATION_DAYS = 90;
+function segundos(periodo) {
+  const m = /^(\d+(?:\.\d+)?)s$/.exec(periodo);
+  return m ? Number(m[1]) : void 0;
+}
+function kmsSinRotacionEvaluate2(observation) {
+  const a = observation.attributes;
+  if (!("purpose" in a) || !("primaryState" in a) || !("rotationPeriod" in a)) {
+    return { status: "unknown", check: GCP_KMS_CHECKS.cryptoKeys, attribute: "rotationPeriod" };
+  }
+  if (a.purpose !== "ENCRYPT_DECRYPT" || a.primaryState !== "ENABLED") return { status: "ok" };
+  if (a.importOnly === true || typeof a.protectionLevel === "string" && a.protectionLevel.startsWith("EXTERNAL")) {
+    return { status: "ok" };
+  }
+  if (a.rotationPeriod === null) return { status: "finding", evidence: { rotationPeriod: null } };
+  const s = typeof a.rotationPeriod === "string" ? segundos(a.rotationPeriod) : void 0;
+  if (s === void 0) return { status: "unknown", check: GCP_KMS_CHECKS.cryptoKeys, attribute: "rotationPeriod" };
+  if (s <= KMS_MAX_ROTATION_DAYS * 86400) return { status: "ok" };
+  return { status: "finding", evidence: { rotationPeriodDays: Math.round(s / 86400) } };
+}
+var kmsSinRotacion2 = {
+  id: "SEC_GCP_ENCRYPTION_KMS_SIN_ROTACION",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "medium",
+  provider: "gcp",
+  kinds: ["kms_key"],
+  requires: [GCP_KMS_CHECKS.locations, GCP_KMS_CHECKS.keyRings, GCP_KMS_CHECKS.cryptoKeys],
+  evaluate: kmsSinRotacionEvaluate2
+};
 
 // ../../services/security/src/rules/gcp/exposure.ts
 function evaluate7(observation) {
@@ -11884,9 +12203,42 @@ var sinExportSink = {
   requires: [GCP_LOGGING_CHECKS.sinks],
   evaluate: evaluate8
 };
+function vpcSinFlowLogsEvaluate(observation) {
+  const subnets = observation.attributes.subnets;
+  if (!Array.isArray(subnets)) {
+    return { status: "unknown", check: GCP_COMPUTE_CHECKS.subnetworks, attribute: "subnets" };
+  }
+  const lista = subnets;
+  const sinRegistro = lista.filter((subnet) => subnet.covered === false);
+  if (sinRegistro.length > 0) {
+    return {
+      status: "finding",
+      evidence: { unloggedSubnets: sinRegistro.map((subnet) => `${String(subnet.region)}/${String(subnet.name)}`), subnetCount: lista.length }
+    };
+  }
+  if (lista.some((subnet) => subnet.covered !== true)) {
+    return { status: "unknown", check: GCP_NETWORK_MANAGEMENT_CHECKS.vpcFlowLogsConfigs, attribute: "subnets" };
+  }
+  if (observation.attributes.subnetsComplete !== true) {
+    return { status: "unknown", check: GCP_COMPUTE_CHECKS.subnetworks, attribute: "subnets" };
+  }
+  return { status: "ok" };
+}
+var vpcSinFlowLogs = {
+  id: "SEC_GCP_LOGGING_VPC_SIN_FLOW_LOGS",
+  scope: "resource",
+  category: "security_logging",
+  severity: "medium",
+  provider: "gcp",
+  kinds: ["vpc_network"],
+  // Las configs de Network Management no van aquí: una red con `logConfig` en cada subred ya está bien sin ellas.
+  requires: [GCP_COMPUTE_CHECKS.subnetworks],
+  evaluate: vpcSinFlowLogsEvaluate
+};
 
 // ../../services/security/src/rules/gcp/network.ts
-function evaluate9(observation) {
+var evaluate9 = (observation) => firewallAbierto(observation, adminPortsReached);
+function firewallAbierto(observation, reached) {
   const direction = observation.attributes.direction;
   const disabled = observation.attributes.disabled;
   const sources = observation.attributes.sourceRanges;
@@ -11905,7 +12257,7 @@ function evaluate9(observation) {
     if (typeof entry !== "object" || entry === null) continue;
     const rule = entry;
     const protocol = typeof rule.protocol === "string" ? rule.protocol : "";
-    for (const puerto of adminPortsReached(protocol, cadenas2(rule.ports))) puertos.add(puerto);
+    for (const puerto of reached(protocol, cadenas2(rule.ports))) puertos.add(puerto);
   }
   if (puertos.size === 0) return { status: "ok" };
   return {
@@ -12065,6 +12417,16 @@ var firewallAdminAbierto = {
   requires: [GCP_COMPUTE_CHECKS.firewalls],
   evaluate: evaluate9
 };
+var firewallBdAbierto = {
+  id: "SEC_GCP_NETWORK_BD_ABIERTO",
+  scope: "resource",
+  category: "security_network",
+  severity: "high",
+  provider: "gcp",
+  kinds: ["firewall"],
+  requires: [GCP_COMPUTE_CHECKS.firewalls],
+  evaluate: (observation) => firewallAbierto(observation, databasePortsReached)
+};
 
 // ../../services/security/src/rules/gcp/secrets.ts
 var SOSPECHOSAS2 = ["PASSWORD", "PASSWD", "SECRET", "TOKEN", "APIKEY", "API_KEY", "PRIVATE_KEY", "CREDENTIAL"];
@@ -12099,11 +12461,14 @@ var secretoEnFunction = {
 // ../../services/security/src/rules/gcp/index.ts
 var GCP_SECURITY_RULES = [
   firewallAdminAbierto,
+  firewallBdAbierto,
   politicaAdminAbierta,
   sqlPublico2,
   gcsPublico,
   discoSinCmek,
   sqlSinCmek,
+  sqlSinSsl,
+  kmsSinRotacion2,
   secretoEnFunction,
   rolPrimitivo,
   claveSaUserManaged,
@@ -12111,7 +12476,8 @@ var GCP_SECURITY_RULES = [
   claveSaSinUso,
   permisosSinUso2,
   auditIncompleto,
-  sinExportSink
+  sinExportSink,
+  vpcSinFlowLogs
 ];
 
 // src/security/evaluate.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaa-sentinel/iac-cost",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Estimate the monthly cost delta of a Terraform plan, check it against the AAA Sentinel security rules, open security fixes as pull requests and report how the security posture changed, from your CI",
   "license": "MIT",
   "type": "module",