@aaa-sentinel/iac-cost 0.4.0 → 0.5.0

package/README.md

@@ -139,8 +139,32 @@ or account ids. The JSON output does not: it is the complete evidence (see `--fo
   `provider` block rather than the resource, so `terraform show -json` often leaves it unknown.
   We say we do not know rather than substituting another region's price.
 
-Currently priced: **AWS** (EC2 on demand) and **Azure** (virtual machines). Anything else is
-reported as not priced, never as free.
+- **Usage is not guessed.** Only what the plan fixes is priced: the instance hours (730 a month)
+  and, for RDS, the allocated storage plus the IOPS and throughput provisioned above what the
+  volume includes. Usage-based charges — data transfer, backups beyond the allocated size, I/O
+  requests, CPU credits of burstable classes — are not added, nor storage growth from autoscaling
+  (`max_allocated_storage`), and neither are RDS Extended
+  Support (engine versions past standard support) or paid Performance Insights retention.
+- **Every price-moving attribute must be known.** An `aws_db_instance` is priced only when the
+  plan resolves its engine, Multi-AZ, allocated storage, storage type (and IOPS/throughput where
+  they are billed, and the license model for Oracle SE2). An attribute you leave out of the
+  configuration shows as "known after apply"; the CLI reads the plan's `configuration` (modules,
+  `count` and `for_each` included) and, only when the attribute is not written at all, the AWS
+  default is applied: `multi_az` (optional in the RDS API, which creates a Single-AZ instance when
+  it is not sent), `storage_type` (`io1` with `iops`, otherwise `gp3`
+  per the RDS API; because the provider docs still say `gp2`, it is priced only where gp2 and gp3
+  cost the same) and the included gp3 baseline IOPS/throughput. Such rows are marked † in the
+  comment with the attributes assumed. Nothing is assumed on updates, when the instance is
+  restored from a snapshot or replica (its storage comes from the source), or when `iops` is an
+  expression. An attribute written as an expression that is only known after apply is never
+  guessed.
+
+Currently priced: **AWS** (EC2 on demand and RDS `aws_db_instance`: MySQL, PostgreSQL, MariaDB,
+Oracle and SQL Server, Single-AZ or Multi-AZ, gp2/gp3/io1/io2) and **Azure** (virtual machines).
+Aurora (`aws_rds_cluster`, `aws_rds_cluster_instance`) is not priced: its instance price depends on
+the cluster's storage configuration and its storage and I/O are billed by use. Anything else is
+reported as not priced, never as free. Versions of the CLI before 0.5.0 do not send the RDS
+storage attributes, so their RDS instances stay not priced.
 
 ## Security before deploy
 
@@ -175,19 +199,19 @@ value from the plan: a variable is named (`DB_PASSWORD`), its value is not read.
 
 | Cloud | Terraform resources | Rules |
 | --- | --- | --- |
-| AWS | `aws_security_group`, `aws_default_security_group`, `aws_security_group_rule`, `aws_vpc_security_group_ingress_rule` (+ `aws_ec2_managed_prefix_list`) | Admin ports (22/3389) open to the internet, directly or through a prefix list |
+| AWS | `aws_security_group`, `aws_default_security_group`, `aws_security_group_rule`, `aws_vpc_security_group_ingress_rule` (+ `aws_ec2_managed_prefix_list`) | Admin ports (22/3389) open to the internet, directly or through a prefix list; database ports (SQL Server, Oracle, MySQL, PostgreSQL, Redis, Elasticsearch, MongoDB) open to the internet over TCP |
 | AWS | `aws_s3_bucket` + `aws_s3_bucket_public_access_block`, `aws_s3_account_public_access_block`, `aws_s3_bucket_acl`, `aws_s3_bucket_policy` | Public bucket |
-| AWS | `aws_db_instance`, `aws_rds_cluster_instance` (+ `aws_rds_cluster`) | Unencrypted storage |
+| AWS | `aws_db_instance`, `aws_rds_cluster_instance` (+ `aws_rds_cluster`) | Unencrypted storage; publicly accessible |
 | AWS | `aws_lambda_function` + `aws_lambda_function_url`, `aws_lambda_permission` | Invocable from the internet; secret-looking environment variable names |
 | AWS | `aws_cloudtrail` | Trail stopped; management events excluded |
 | AWS | `aws_kms_key` | Key rotation off |
 | AWS | `aws_vpc`, `aws_default_vpc` + `aws_flow_log` (+ `aws_subnet`) | VPC without flow logs; flow logs that miss part of the traffic |
-| Azure | `azurerm_network_security_group`, `azurerm_network_security_rule` | Admin ports open to the internet |
+| Azure | `azurerm_network_security_group`, `azurerm_network_security_rule` | Admin ports open to the internet; database ports open to the internet over TCP |
 | Azure | `azurerm_storage_account` | Public blobs allowed; weak TLS or HTTP |
 | Azure | `azurerm_mssql_server` + `azurerm_mssql_firewall_rule` | Public network access open to 0.0.0.0–255.255.255.255; weak TLS |
 | Azure | `azurerm_role_assignment` | Owner or User Access Administrator at any scope; Contributor at subscription scope (a Contributor at a management group or at `/` is not flagged, neither here nor in the live scan) |
-| Google Cloud | `google_compute_firewall` | Admin ports open to the internet |
-| Google Cloud | `google_sql_database_instance` | Authorized from 0.0.0.0/0; no CMEK |
+| Google Cloud | `google_compute_firewall` | Admin ports open to the internet; database ports open to the internet over TCP |
+| Google Cloud | `google_sql_database_instance` | Authorized from 0.0.0.0/0; no CMEK; unencrypted connections accepted (`ssl_mode`; not judged while the provider still has to compute it) |
 | Google Cloud | `google_cloudfunctions_function`, `google_cloudfunctions2_function` | Secret-looking environment variable names |
 | Google Cloud | `google_project_iam_member`, `_binding`, `_policy`; `google_service_account_key` | Primitive Owner/Editor role; user-managed key |
 

package/dist/cli.js

@@ -2351,18 +2351,18 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
   capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
-  const isPresent = key in input;
+  const isPresent2 = key in input;
   const isOptionalOut = optout === "optional";
-  if (!isPresent && isOptionalOut && optin === "optional") {
+  if (!isPresent2 && isOptionalOut && optin === "optional") {
     return;
   }
   if (result.issues.length) {
-    if (optin !== void 0 && isOptionalOut && !isPresent) {
+    if (optin !== void 0 && isOptionalOut && !isPresent2) {
       return;
     }
     final.issues.push(...prefixIssues(key, result.issues));
   }
-  if (!isPresent && optin === void 0) {
+  if (!isPresent2 && optin === void 0) {
     if (!result.issues.length) {
       final.issues.push({
         code: "invalid_type",
@@ -2374,7 +2374,7 @@ function handlePropertyResult(result, final, key, input, optin, optout) {
     return;
   }
   if (result.value === void 0) {
-    if (isPresent || optin === "defaulted" && !isOptionalOut) {
+    if (isPresent2 || optin === "defaulted" && !isOptionalOut) {
       final.value[key] = void 0;
     }
   } else {
@@ -2563,7 +2563,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
         continue;
       const id = ids[key];
       const k = typeof key === "symbol" ? `syms[${syms.indexOf(key)}]` : esc(key);
-      const isPresent = `${k} in input`;
+      const isPresent2 = `${k} in input`;
       const schema = shape[key];
       const optin = schema?._zod?.optin;
       const isOptionalIn = optin !== void 0;
@@ -2572,7 +2572,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
       if (isOptionalIn && isOptionalOut) {
         const assign = optin === "optional" ? `${id}_present` : `${id}.value !== undefined || ${id}_present`;
         doc.write(`
-        const ${id}_present = ${isPresent};
+        const ${id}_present = ${isPresent2};
         if (!${id}.issues.length || ${id}_present) {
           if (${id}.issues.length) {${prefixStr(id, k)}
           }
@@ -2585,7 +2585,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
       `);
       } else if (!isOptionalIn) {
         doc.write(`
-        const ${id}_present = ${isPresent};
+        const ${id}_present = ${isPresent2};
         if (${id}.issues.length) {${prefixStr(id, k)}
         }
         if (!${id}_present && !${id}.issues.length) {
@@ -2615,7 +2615,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
           doc.write(`newResult[${k}] = ${id}.value;`);
         } else {
           doc.write(`
-        if (${id}.value !== undefined || ${isPresent}) {
+        if (${id}.value !== undefined || ${isPresent2}) {
           newResult[${k}] = ${id}.value;
         }
       `);
@@ -6265,6 +6265,8 @@ function iacProviderOf(resourceType) {
     billing: !NON_BILLING_PROVIDERS.has(name)
   };
 }
+var IAC_UNSET_IN_CONFIG = "unset_in_config";
+var IAC_UNKNOWN_IN_PLAN = "unknown_in_plan";
 var IAC_RESOURCE_SPECS = {
   // ── Azure ──
   azurerm_linux_virtual_machine: {
@@ -6295,16 +6297,35 @@ var IAC_RESOURCE_SPECS = {
     instancesAttribute: "instances",
     os: "windows"
   },
-  // ── AWS: reconocidos y proyectados, todavía sin catálogo de precios ──
+  // ── AWS ──
+  // hashicorp/aws 6.x admite `region` por recurso; sin escribirla el plan trae la del provider.
   aws_instance: {
     provider: "aws",
-    attributes: ["instance_type"],
-    sizeAttribute: "instance_type"
+    attributes: ["instance_type", "region"],
+    sizeAttribute: "instance_type",
+    regionAttribute: "region",
+    regionPlannedByProvider: true
   },
+  // Aurora (`aws_rds_cluster*`) no está: el precio de su instancia depende del `storage_type` del clúster, que es otro recurso.
   aws_db_instance: {
     provider: "aws",
-    attributes: ["instance_class", "engine", "multi_az", "allocated_storage"],
-    sizeAttribute: "instance_class"
+    attributes: [
+      "instance_class",
+      "engine",
+      "license_model",
+      "multi_az",
+      "allocated_storage",
+      "storage_type",
+      "iops",
+      "storage_throughput",
+      "region"
+    ],
+    sizeAttribute: "instance_class",
+    regionAttribute: "region",
+    regionPlannedByProvider: true,
+    unsetReportable: ["multi_az", "storage_type", "iops", "storage_throughput"],
+    unsetBlockedBy: ["snapshot_identifier", "replicate_source_db"],
+    unsetBlockedByBlocks: ["restore_to_point_in_time", "s3_import"]
   },
   // ── GCP: ídem ──
   google_compute_instance: {
@@ -6378,7 +6399,7 @@ function aggregateEstimates(estimates) {
   const pricedProviders = /* @__PURE__ */ new Set();
   for (const estimate of estimates) {
     for (const item of estimate.priced) {
-      const key = keyOf(item);
+      const key = `${keyOf(item)}#${(item.assumedDefaults ?? []).join(",")}`;
       const found = priced.get(key);
       if (!found) priced.set(key, { ...item });
       else {
@@ -8153,6 +8174,8 @@ function sqlInstances(index) {
     const builder = new ObservationBuilder(index, sql, "cloud_sql_instance", "gcp").cloudId("name");
     const ip = ["settings", 0, "ip_configuration", 0];
     builder.from("ipv4Enabled", index.get(sql, ...ip, "ipv4_enabled"), Boolean, true);
+    builder.from("sslMode", index.get(sql, ...ip, "ssl_mode"), String, null);
+    builder.from("requireSsl", index.get(sql, ...ip, "require_ssl"), Boolean, null);
     const networks = index.get(sql, ...ip, "authorized_networks");
     if (networks.state === "unknown") builder.gap("authorizedNetworks", "known_after_apply");
     else {
@@ -8268,6 +8291,18 @@ var RULE_TITLES = {
   SEC_AWS_NETWORK_ADMIN_PREFIX_LIST: "Admin ports open to the internet through a prefix list",
   SEC_AWS_EXPOSURE_S3_PUBLICO: "Public S3 bucket",
   SEC_AWS_EXPOSURE_LAMBDA_PUBLICA: "Lambda invocable from the internet",
+  SEC_AZURE_ENCRYPTION_KEYVAULT_SIN_PURGA: "Key Vault without purge protection",
+  SEC_AZURE_ENCRYPTION_SQL_SIN_TDE: "SQL database without TDE encryption",
+  SEC_AZURE_LOGGING_VNET_SIN_FLOW_LOGS: "VNet without flow logs",
+  SEC_GCP_ENCRYPTION_KMS_SIN_ROTACION: "Cloud KMS key without 90-day rotation",
+  SEC_GCP_LOGGING_VPC_SIN_FLOW_LOGS: "VPC network with subnets without flow logs",
+  SEC_AWS_NETWORK_BD_ABIERTO: "Database ports open to the internet",
+  SEC_AZURE_NETWORK_BD_ABIERTO: "NSG with database ports open to the internet",
+  SEC_GCP_NETWORK_BD_ABIERTO: "Firewall with database ports open to the internet",
+  SEC_AWS_EXPOSURE_RDS_PUBLICA: "Publicly accessible RDS instance",
+  SEC_GCP_ENCRYPTION_SQL_SIN_SSL: "Cloud SQL accepts unencrypted connections",
+  SEC_AWS_IAM_CLAVE_ANTIGUA: "Active access key older than 90 days",
+  SEC_AWS_IAM_POLITICA_CONTRASENAS: "Weak or missing IAM password policy",
   SEC_AWS_ENCRYPTION_KMS_SIN_ROTACION: "KMS key without rotation",
   SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR: "Unencrypted RDS",
   SEC_AWS_LOGGING_TRAIL_PARADO: "CloudTrail stopped",
@@ -9269,6 +9304,62 @@ function extractDefaultRegions(plan) {
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
+function moduleNames(moduleAddress) {
+  if (!moduleAddress) return [];
+  const parts = moduleAddress.replace(/\[(?:\d+|"(?:[^"\\]|\\.)*")\]/g, "").split(".");
+  if (parts.length % 2 !== 0) return null;
+  const names = [];
+  for (let i = 0; i < parts.length; i += 2) {
+    if (parts[i] !== "module" || !/^[A-Za-z0-9_-]+$/.test(parts[i + 1] ?? "")) return null;
+    names.push(parts[i + 1]);
+  }
+  return names;
+}
+function configExpressions(plan, change) {
+  return configResource(plan, change)?.expressions;
+}
+function configResource(plan, change) {
+  if (!change.name) return void 0;
+  const path3 = moduleNames(change.module_address);
+  if (path3 === null) return void 0;
+  let module = plan.configuration?.root_module;
+  for (const name of path3) module = module?.module_calls?.[name]?.module;
+  const address = `${change.type}.${change.name}`;
+  return module?.resources?.find((r) => r.address === address && (r.mode ?? "managed") === "managed");
+}
+function knownAtPlan(expression, inRoot) {
+  if ("constant_value" in expression) return true;
+  const references = Array.isArray(expression.references) ? expression.references : [];
+  return inRoot && references.length > 0 && references.every((r) => typeof r === "string" && r.startsWith("var."));
+}
+function hasUnknown(value) {
+  if (value === true) return true;
+  if (Array.isArray(value)) return value.some(hasUnknown);
+  if (typeof value === "object" && value !== null) return Object.values(value).some(hasUnknown);
+  return false;
+}
+var isPresent = (value) => Array.isArray(value) ? value.length > 0 : value !== null && value !== void 0 && value !== "";
+function unsetInConfig(change, expressions, names, blockedBy = [], blockedByBlocks = []) {
+  const unknownSide = change.after_unknown;
+  if (!names || !unknownSide || !expressions) return void 0;
+  if (blockedBy.some((name) => name in expressions || isPresent(change.after?.[name]))) return void 0;
+  if (blockedByBlocks.some((name) => name in expressions || isPresent(change.after?.[name]) || hasUnknown(unknownSide[name]))) return void 0;
+  const unset = names.filter((name) => unknownSide[name] === true && !(name in expressions));
+  return unset.length > 0 ? unset.join(",") : void 0;
+}
+function regionUntrusted(plan, change, regionAttribute) {
+  if (change.change.after_unknown?.[regionAttribute] === true) return true;
+  if (!isPresent(change.change.after?.[regionAttribute])) return false;
+  const resource = configResource(plan, change);
+  if (!resource?.expressions) return true;
+  const expression = resource.expressions[regionAttribute];
+  if (expression !== void 0) return !knownAtPlan(expression, (moduleNames(change.module_address) ?? ["?"]).length === 0);
+  const key = resource.provider_config_key;
+  const provider = key === void 0 ? void 0 : plan.configuration?.provider_config?.[key];
+  if (!provider) return true;
+  const providerRegion = provider.expressions?.["region"];
+  return providerRegion !== void 0 && !knownAtPlan(providerRegion, provider.module_address === void 0);
+}
 function pickAttributes(side, unknownSide, attributeNames) {
   if (!side) return void 0;
   const attrs = {};
@@ -9276,6 +9367,7 @@ function pickAttributes(side, unknownSide, attributeNames) {
     if (unknownSide?.[name] === true) continue;
     const value = side[name];
     if (typeof value === "string" || typeof value === "number") attrs[name] = value;
+    else if (typeof value === "boolean") attrs[name] = String(value);
   }
   return Object.keys(attrs).length > 0 ? attrs : void 0;
 }
@@ -9288,7 +9380,17 @@ function parseTerraformPlan(plan) {
     if (!action) continue;
     const spec = IAC_RESOURCE_SPECS[resourceChange.type];
     const attributesBefore = spec ? pickAttributes(resourceChange.change.before, void 0, spec.attributes) : void 0;
-    const attributesAfter = spec ? pickAttributes(resourceChange.change.after, resourceChange.change.after_unknown, spec.attributes) : void 0;
+    const picked = spec ? pickAttributes(resourceChange.change.after, resourceChange.change.after_unknown, spec.attributes) : void 0;
+    const expressions = spec?.unsetReportable || spec?.regionPlannedByProvider ? configExpressions(plan, resourceChange) : void 0;
+    const creates = action === "create" || action === "replace";
+    const unset = creates ? unsetInConfig(resourceChange.change, expressions, spec?.unsetReportable, spec?.unsetBlockedBy, spec?.unsetBlockedByBlocks) : void 0;
+    const regionAttribute = spec?.regionPlannedByProvider ? spec.regionAttribute : void 0;
+    const untrusted = picked !== void 0 && regionAttribute !== void 0 && regionUntrusted(plan, resourceChange, regionAttribute);
+    let attributesAfter = unset === void 0 ? picked : { ...picked, [IAC_UNSET_IN_CONFIG]: unset };
+    if (untrusted && attributesAfter) {
+      const { [regionAttribute]: _dropped, ...rest } = attributesAfter;
+      attributesAfter = { ...rest, [IAC_UNKNOWN_IN_PLAN]: regionAttribute };
+    }
     const change = {
       type: resourceChange.type,
       action,
@@ -9319,6 +9421,9 @@ var REASON_TEXT = {
   region_not_supported: "region not in the price catalog",
   size_unknown: "size/SKU could not be resolved from the plan",
   instance_count_unknown: "instance count could not be resolved from the plan",
+  attribute_unknown: "a price-relevant attribute (engine, Multi-AZ, storage\u2026) could not be resolved from the plan",
+  price_unavailable: "the price catalog did not answer this time; a later run retries",
+  price_lookup_limit: "too many distinct database configurations in one plan to look up in a single request",
   price_not_found: "no matching price found in the catalog"
 };
 var fmtUsd = (n) => `${n < 0 ? "-" : "+"}$${Math.abs(n).toFixed(2)}/mo`;
@@ -9326,7 +9431,7 @@ function fmtConverted(n, currency) {
   const amount = new Intl.NumberFormat("en-US", { style: "currency", currency }).format(Math.abs(n));
   return `\u2248 ${n < 0 ? "-" : "+"}${amount}/mo`;
 }
-var LIST_PRICE_CAVEAT = "They also do not reflect committed-use discounts (EDP/EA/CUD) or existing reservations/Savings Plans that may already cover a resource.";
+var LIST_PRICE_CAVEAT = "They also do not reflect committed-use discounts (EDP/EA/CUD) or existing reservations/Savings Plans that may already cover a resource. Usage-based charges (data transfer, backups beyond the allocated storage, I/O requests, CPU credits), storage growth from autoscaling (`max_allocated_storage`), RDS Extended Support and paid Performance Insights retention are not included.";
 var reasonText = (reason) => REASON_TEXT[reason] ?? reason;
 function actionVerb(action) {
   return action === "create" ? "new" : action === "delete" ? "removed" : action;
@@ -9357,8 +9462,16 @@ function renderComment(estimate) {
   if (estimate.priced.length > 0) {
     lines2.push("", "| Resource | Change | Qty | Delta |", "|---|---|---|---|");
     for (const item of estimate.priced) {
+      const assumed = item.assumedDefaults?.length ? " \u2020" : "";
       lines2.push(
-        `| \`${item.type}\` | ${actionVerb(item.action)} | ${item.count} | ${delta(item.monthlyDeltaUsd, item.monthlyDelta)} |`
+        `| \`${item.type}\`${assumed} | ${actionVerb(item.action)} | ${item.count} | ${delta(item.monthlyDeltaUsd, item.monthlyDelta)} |`
+      );
+    }
+    const assumedNames = [...new Set(estimate.priced.flatMap((i) => i.assumedDefaults ?? []))].sort();
+    if (assumedNames.length > 0) {
+      lines2.push(
+        "",
+        `\u2020 Not set in the Terraform configuration, so the AWS default was assumed for: ${assumedNames.map((n) => `\`${n}\``).join(", ")}. Set them explicitly if your deployment differs.`
       );
     }
   }
@@ -9540,8 +9653,6 @@ function publicVulnerable(input, provider) {
 }
 
 // ../../services/security/src/rules/aws/combos.ts
-var DIA_MS = 24 * 60 * 60 * 1e3;
-var OLD_ACCESS_KEY_DAYS = 90;
 function lambdaRef(resourceId, region) {
   const partes = resourceId.split(":");
   if (partes[0] === "arn" && partes[2] === "lambda" && partes[5] === "function" && partes[3] && partes[6]) {
@@ -9580,38 +9691,23 @@ var AWS_SECURITY_COMBOS = [
     id: "COMBO_AWS_PUBLIC_DB_UNENCRYPTED",
     provider: "aws",
     severity: "critical",
-    rules: ["SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR"],
-    detect: (input) => input.findings.filter((f) => f.ruleId === "SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR").flatMap((f) => {
-      const db = observationOf(input, "rds_instance", f.region, f.resourceId);
-      if (db?.attributes["publiclyAccessible"] !== true) return [];
-      return [{ region: f.region, resourceId: f.resourceId, resourceName: f.resourceName, findingIds: [f.id], evidence: { publiclyAccessible: true } }];
-    })
+    rules: ["SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR", "SEC_AWS_EXPOSURE_RDS_PUBLICA"],
+    detect: (input) => sameResource(input, "SEC_AWS_ENCRYPTION_RDS_SIN_CIFRAR", "SEC_AWS_EXPOSURE_RDS_PUBLICA").map((m) => ({ ...m, evidence: { publiclyAccessible: true } }))
   },
   {
     // Entra a la consola solo con contraseña y además tiene una clave de acceso vieja y activa: dos puertas sin segundo factor.
     id: "COMBO_AWS_USER_NO_MFA_OLD_KEY",
     provider: "aws",
     severity: "critical",
-    rules: ["SEC_AWS_IAM_USUARIO_SIN_MFA"],
-    detect: (input) => input.findings.filter((f) => f.ruleId === "SEC_AWS_IAM_USUARIO_SIN_MFA").flatMap((f) => {
-      const user = observationOf(input, "iam_user", f.region, f.resourceId);
-      const claves = Array.isArray(user?.attributes["accessKeys"]) ? user.attributes["accessKeys"] : [];
-      const viejas = claves.filter((k) => k["active"] === true && typeof k["createdAt"] === "string").map((k) => k["createdAt"]).filter((creada) => {
-        const dias = Math.floor((input.now.getTime() - Date.parse(creada)) / DIA_MS);
-        return Number.isFinite(dias) && dias > OLD_ACCESS_KEY_DAYS;
-      }).sort();
-      if (viejas.length === 0) return [];
-      return [
-        {
-          region: f.region,
-          resourceId: f.resourceId,
-          resourceName: f.resourceName,
-          findingIds: [f.id],
-          // La fecha y no la edad: la edad la calcula quien la enseña, si no se quedaría congelada el día del escaneo.
-          evidence: { oldActiveKeys: viejas.length, oldestKeyCreatedAt: viejas[0] }
-        }
-      ];
-    })
+    rules: ["SEC_AWS_IAM_USUARIO_SIN_MFA", "SEC_AWS_IAM_CLAVE_ANTIGUA"],
+    detect: (input) => {
+      const viejas = findingsByResource(input.findings, "SEC_AWS_IAM_CLAVE_ANTIGUA");
+      return sameResource(input, "SEC_AWS_IAM_USUARIO_SIN_MFA", "SEC_AWS_IAM_CLAVE_ANTIGUA").map((m) => {
+        const claves = viejas.get(`${m.region}::${m.resourceId}`)?.evidence["oldActiveKeys"];
+        const lista = Array.isArray(claves) ? claves : [];
+        return { ...m, evidence: { oldActiveKeys: lista.length, oldestKeyCreatedAt: lista[0]?.["createdAt"] ?? null } };
+      });
+    }
   },
   {
     // Alcanzable desde internet y con un CVE crítico o alto que ya tiene exploit público: el ataque está escrito.
@@ -10090,6 +10186,31 @@ var rdsClusterSnapshotPublico = {
   ],
   evaluate: (observation) => snapshotPublicoEvaluate(observation, RDS_CHECKS.clusterSnapshotAttributes)
 };
+function rdsPublicaEvaluate(observation) {
+  const publica = observation.attributes.publiclyAccessible;
+  if (typeof publica !== "boolean") {
+    return { status: "unknown", check: RDS_CHECKS.instances, attribute: "publiclyAccessible" };
+  }
+  if (!publica) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: {
+      publiclyAccessible: true,
+      engine: observation.attributes.engine ?? null,
+      securityGroupIds: observation.attributes.securityGroupIds ?? null
+    }
+  };
+}
+var rdsPublica = {
+  id: "SEC_AWS_EXPOSURE_RDS_PUBLICA",
+  scope: "resource",
+  category: "security_exposure",
+  severity: "high",
+  provider: "aws",
+  kinds: ["rds_instance"],
+  requires: [REGION_CHECKS.listRegions, RDS_CHECKS.instances],
+  evaluate: rdsPublicaEvaluate
+};
 
 // ../../services/security/src/rules/aws/iam.ts
 function falta4(check, attribute) {
@@ -10143,6 +10264,74 @@ var usuarioSinMfa = {
   requires: [IAM_CHECKS.listUsers, IAM_CHECKS.loginProfile, IAM_CHECKS.mfaDevices],
   evaluate: usuarioSinMfaEvaluate
 };
+var ACCESS_KEY_MAX_AGE_DAYS = 90;
+var DIA_MS = 864e5;
+function claveAntiguaEvaluate(observation, ahora = Date.now()) {
+  const claves = observation.attributes.accessKeys;
+  if (!Array.isArray(claves)) return falta4(IAM_CHECKS.accessKeys, "accessKeys");
+  const viejas = [];
+  let indecisa = false;
+  for (const entrada of claves) {
+    if (typeof entrada !== "object" || entrada === null) {
+      indecisa = true;
+      continue;
+    }
+    const clave = entrada;
+    if (clave.active === false) continue;
+    const creada = typeof clave.createdAt === "string" ? Date.parse(clave.createdAt) : Number.NaN;
+    if (clave.active !== true || Number.isNaN(creada)) {
+      indecisa = true;
+      continue;
+    }
+    if (ahora - creada > ACCESS_KEY_MAX_AGE_DAYS * DIA_MS) viejas.push({ id: clave.id ?? null, createdAt: clave.createdAt });
+  }
+  if (viejas.length === 0) return indecisa ? falta4(IAM_CHECKS.accessKeys, "accessKeys") : { status: "ok" };
+  viejas.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  return { status: "finding", evidence: { oldActiveKeys: viejas, maxAgeDays: ACCESS_KEY_MAX_AGE_DAYS } };
+}
+var claveAntigua = {
+  id: "SEC_AWS_IAM_CLAVE_ANTIGUA",
+  scope: "resource",
+  category: "security_iam",
+  severity: "medium",
+  provider: "aws",
+  kinds: ["iam_user"],
+  requires: [IAM_CHECKS.listUsers, IAM_CHECKS.accessKeys],
+  evaluate: (observation) => claveAntiguaEvaluate(observation)
+};
+var PASSWORD_MIN_LENGTH = 14;
+var PASSWORD_REUSE_PREVENTION = 24;
+function politicaContrasenasEvaluate(observation) {
+  const usuarios = observation.attributes.userCount;
+  if (typeof usuarios !== "number") return falta4(IAM_CHECKS.accountSummary, "userCount");
+  if (usuarios === 0) return { status: "ok" };
+  if (!("passwordPolicy" in observation.attributes)) return falta4(IAM_CHECKS.passwordPolicy, "passwordPolicy");
+  const politica = observation.attributes.passwordPolicy;
+  if (politica === null) {
+    return { status: "finding", evidence: { passwordPolicy: null, userCount: usuarios } };
+  }
+  if (typeof politica !== "object" || Array.isArray(politica)) return falta4(IAM_CHECKS.passwordPolicy, "passwordPolicy");
+  const p = politica;
+  const longitud = typeof p.minimumLength === "number" ? p.minimumLength : null;
+  const reuso = typeof p.reusePrevention === "number" ? p.reusePrevention : null;
+  const corta = longitud === null || longitud < PASSWORD_MIN_LENGTH;
+  const reutilizable = reuso === null || reuso < PASSWORD_REUSE_PREVENTION;
+  if (!corta && !reutilizable) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: { minimumLength: longitud, reusePrevention: reuso, userCount: usuarios }
+  };
+}
+var politicaContrasenas = {
+  id: "SEC_AWS_IAM_POLITICA_CONTRASENAS",
+  scope: "resource",
+  category: "security_iam",
+  severity: "low",
+  provider: "aws",
+  kinds: ["iam_account"],
+  requires: [IAM_CHECKS.accountSummary, IAM_CHECKS.passwordPolicy],
+  evaluate: politicaContrasenasEvaluate
+};
 function exclusion(observation) {
   const value = observation.attributes.excluded;
   if (value === null) return { known: true, excluded: false };
@@ -10559,8 +10748,9 @@ var trailGestionIncompleta = {
   evaluate: gestionIncompletaEvaluate
 };
 
-// ../../services/security/src/collectors/internet.ts
+// ../../shared/src/internet-exposure.ts
 var ADMIN_PORTS2 = [22, 3389];
+var DATABASE_PORTS = [1433, 1521, 2483, 2484, 3306, 5432, 6379, 9200, 9300, 27017, 27018, 27019];
 var ETIQUETAS_INTERNET = /* @__PURE__ */ new Set(["*", "internet", "any", "/0"]);
 function longitudPrefijo(cidr, maximo) {
   const partes = cidr.split("/");
@@ -10601,13 +10791,57 @@ function protocolName(protocol) {
   const p = protocol.trim().toLowerCase();
   return POR_NUMERO2[p] ?? p;
 }
-function adminPortsReached(protocol, portRanges) {
+function portsReached(ports, protocol, portRanges) {
   const p = protocolName(protocol);
   const todos = p === "*" || p === "any" || p === "all";
-  if (todos) return [...ADMIN_PORTS2];
+  if (todos) return [...ports];
   if (p !== "tcp" && p !== "udp") return [];
-  if (portRanges.length === 0) return [...ADMIN_PORTS2];
-  return ADMIN_PORTS2.filter((puerto) => portRanges.some((rango) => cubrePuerto(rango, puerto)));
+  if (portRanges.length === 0) return [...ports];
+  return ports.filter((puerto) => portRanges.some((rango) => cubrePuerto(rango, puerto)));
+}
+function adminPortsReached(protocol, portRanges) {
+  return portsReached(ADMIN_PORTS2, protocol, portRanges);
+}
+function databasePortsReached(protocol, portRanges) {
+  if (protocolName(protocol) === "udp") return [];
+  if (adminPortsReached(protocol, portRanges).length > 0) return [];
+  return portsReached(DATABASE_PORTS, protocol, portRanges);
+}
+var TODO_INTERNET = /* @__PURE__ */ new Set(["*", "internet", "any"]);
+function sourceCoversInternet(source) {
+  return TODO_INTERNET.has(source.trim().toLowerCase());
+}
+function ipFamily(source) {
+  const ip = source.trim().split("/")[0] ?? "";
+  if (ip.includes(":")) return "v6";
+  return /^\d{1,3}(\.\d{1,3}){3}$/.test(ip) ? "v4" : void 0;
+}
+function denySourceCovers(denySource, allowSource) {
+  if (sourceCoversInternet(denySource)) return true;
+  const partes = denySource.trim().split("/");
+  if (partes.length !== 2 || partes[1] !== "0") return false;
+  const familia = ipFamily(denySource);
+  return familia !== void 0 && familia === ipFamily(allowSource);
+}
+function denyCoversEveryTarget(deny) {
+  if ((deny.destinationAsgs ?? 0) > 0) return false;
+  if ((deny.destinations ?? []).some((d) => !["*", "any"].includes(d.trim().toLowerCase()))) return false;
+  return (deny.sourcePorts ?? []).every((p) => p.trim() === "*");
+}
+function deniedBeforeAllow(denies, allow, port) {
+  const allowPriority = allow.priority;
+  if (typeof allowPriority !== "number") return false;
+  const abiertos = allow.sources.filter((s) => sourceOpensToInternet(s) === true);
+  if (abiertos.length === 0) return false;
+  const allowProtocol = protocolName(allow.protocol);
+  return denies.some((deny) => {
+    if (typeof deny.priority !== "number" || deny.priority >= allowPriority) return false;
+    if (!denyCoversEveryTarget(deny)) return false;
+    if (!abiertos.every((a) => deny.sources.some((d) => denySourceCovers(d, a)))) return false;
+    const p = protocolName(deny.protocol);
+    if (p !== "*" && p !== "any" && p !== "all" && p !== allowProtocol) return false;
+    return deny.ports.length === 0 || deny.ports.some((rango) => cubrePuerto(rango, port));
+  });
 }
 function cadenas2(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
@@ -10843,6 +11077,67 @@ var adminAbiertoPorPrefixList = {
   requires: [REGION_CHECKS.listRegions, EC2_CHECKS.securityGroups, EC2_CHECKS.prefixListEntries],
   evaluate: prefixListEvaluate
 };
+function puertosDeBaseDeDatos(regla) {
+  if (typeof regla.protocol !== "string") return void 0;
+  const protocolo = protocolName(regla.protocol);
+  if (protocolo !== "tcp") return [];
+  const desde = regla.fromPort;
+  const hasta = regla.toPort;
+  if (typeof desde !== "number" || typeof hasta !== "number") return void 0;
+  if (ADMIN_PORTS2.some((puerto) => desde <= puerto && puerto <= hasta)) return [];
+  return DATABASE_PORTS.filter((puerto) => desde <= puerto && puerto <= hasta);
+}
+function bdAbiertaEvaluate(observation) {
+  const ingress = observation.attributes.ingressRules;
+  if (!Array.isArray(ingress)) {
+    return { status: "unknown", check: EC2_CHECKS.securityGroups, attribute: "ingressRules" };
+  }
+  const aperturas = [];
+  const puertos = /* @__PURE__ */ new Set();
+  let indecisa = false;
+  for (const entrada of ingress) {
+    if (typeof entrada !== "object" || entrada === null) {
+      indecisa = true;
+      continue;
+    }
+    const regla = entrada;
+    const origenes = [...cadenas2(regla.cidrs), ...cadenas2(regla.ipv6Cidrs)];
+    const abierto = anySourceOpensToInternet(origenes);
+    if (abierto === void 0) {
+      indecisa = true;
+      continue;
+    }
+    if (!abierto) continue;
+    const alcanzados = puertosDeBaseDeDatos(regla);
+    if (alcanzados === void 0) {
+      indecisa = true;
+      continue;
+    }
+    if (alcanzados.length === 0) continue;
+    for (const puerto of alcanzados) puertos.add(puerto);
+    aperturas.push({
+      protocol: regla.protocol,
+      fromPort: regla.fromPort ?? null,
+      toPort: regla.toPort ?? null,
+      cidr: origenes.find((cidr) => sourceOpensToInternet(cidr) === true) ?? null
+    });
+  }
+  if (aperturas.length > 0) {
+    return { status: "finding", evidence: { ports: [...puertos].sort((a, b) => a - b), openings: aperturas } };
+  }
+  if (indecisa) return { status: "unknown", check: EC2_CHECKS.securityGroups, attribute: "ingressRules" };
+  return { status: "ok" };
+}
+var bdAbiertaAInternet = {
+  id: "SEC_AWS_NETWORK_BD_ABIERTO",
+  scope: "resource",
+  category: "security_network",
+  severity: "high",
+  provider: "aws",
+  kinds: ["security_group"],
+  requires: [REGION_CHECKS.listRegions, EC2_CHECKS.securityGroups],
+  evaluate: bdAbiertaEvaluate
+};
 
 // ../../services/security/src/rules/aws/monitoring.ts
 var evento = (...nombres) => nombres.map((n) => `$.eventName=${n}`);
@@ -11174,17 +11469,21 @@ var secretoEnVariableDeEntorno = {
 var AWS_SECURITY_RULES = [
   adminAbiertoAInternet,
   adminAbiertoPorPrefixList,
+  bdAbiertaAInternet,
   lightsailAdminAbierto,
   nlbAdminAbierto,
   bucketPublico,
   ebsSnapshotPublico,
   rdsSnapshotPublico,
   rdsClusterSnapshotPublico,
+  rdsPublica,
   lambdaPublica,
   kmsSinRotacion,
   rdsSinCifrar,
   rootSinMfa,
   usuarioSinMfa,
+  claveAntigua,
+  politicaContrasenas,
   adminEfectivo,
   identidadSinUso,
   claveSinUso,
@@ -11233,17 +11532,35 @@ var AZURE_NSG_CHECKS = {
   list: "azure:nsg:list"
 };
 var AZURE_STORAGE_CHECKS = {
-  list: "azure:storage:list"
+  list: "azure:storage:list",
+  // Solo de las cuentas que permiten blobs públicos: dice a quien aprueba cerrarlo qué contenedores dejan de servirse.
+  containers: "azure:storage:containers"
 };
 var AZURE_SQL_CHECKS = {
   list: "azure:sql:list",
-  firewallRules: "azure:sql:firewallRules"
+  firewallRules: "azure:sql:firewallRules",
+  databases: "azure:sql:databases",
+  transparentDataEncryption: "azure:sql:transparentDataEncryption"
+};
+var AZURE_KEYVAULT_CHECKS = {
+  vaults: "azure:keyvault:vaults"
+};
+var AZURE_NETWORK_CHECKS = {
+  virtualNetworks: "azure:network:virtualNetworks",
+  networkWatchers: "azure:network:networkWatchers",
+  flowLogs: "azure:network:flowLogs",
+  networkInterfaces: "azure:network:networkInterfaces"
 };
 var AZURE_IAM_CHECKS = {
   roleAssignments: "azure:iam:roleAssignments",
   // Microsoft Graph, opcional: `Directory.Read.All` de aplicación (§16.7, F4).
   principals: "azure:graph:directoryObjects.getByIds",
-  groupMembers: "azure:graph:groups.members"
+  groupMembers: "azure:graph:groups.members",
+  // Tipo, estado y dominio de los usuarios con rol privilegiado, y los dominios federados: también con `Directory.Read.All`.
+  users: "azure:graph:users",
+  domains: "azure:graph:domains",
+  // Métodos de autenticación registrados: `UserAuthenticationMethod.Read.All` de aplicación, opcional.
+  authMethods: "azure:graph:users.authentication.methods"
 };
 var AZURE_LOGGING_CHECKS = {
   diagnosticSettings: "azure:insights:diagnosticSettings"
@@ -11296,6 +11613,44 @@ var sqlTlsDebil = {
   requires: [AZURE_SQL_CHECKS.list],
   evaluate: sqlTlsEvaluate
 };
+function keyVaultSinPurgaEvaluate(observation) {
+  if (!("purgeProtection" in observation.attributes)) {
+    return { status: "unknown", check: AZURE_KEYVAULT_CHECKS.vaults, attribute: "purgeProtection" };
+  }
+  if (observation.attributes.purgeProtection === true) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: { purgeProtection: false, softDelete: observation.attributes.softDelete ?? null }
+  };
+}
+var keyVaultSinPurga = {
+  id: "SEC_AZURE_ENCRYPTION_KEYVAULT_SIN_PURGA",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "medium",
+  provider: "azure",
+  kinds: ["key_vault"],
+  requires: [AZURE_KEYVAULT_CHECKS.vaults],
+  evaluate: keyVaultSinPurgaEvaluate
+};
+function sqlSinTdeEvaluate(observation) {
+  const estado = observation.attributes.tdeState;
+  if (typeof estado !== "string") {
+    return { status: "unknown", check: AZURE_SQL_CHECKS.transparentDataEncryption, attribute: "tdeState" };
+  }
+  if (estado.toLowerCase() === "enabled") return { status: "ok" };
+  return { status: "finding", evidence: { tdeState: estado } };
+}
+var sqlSinTde = {
+  id: "SEC_AZURE_ENCRYPTION_SQL_SIN_TDE",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "high",
+  provider: "azure",
+  kinds: ["sql_database"],
+  requires: [AZURE_SQL_CHECKS.list, AZURE_SQL_CHECKS.databases, AZURE_SQL_CHECKS.transparentDataEncryption],
+  evaluate: sqlSinTdeEvaluate
+};
 
 // ../../services/security/src/rules/azure/exposure.ts
 function blobPublicoEvaluate(observation) {
@@ -11304,7 +11659,15 @@ function blobPublicoEvaluate(observation) {
     return { status: "unknown", check: AZURE_STORAGE_CHECKS.list, attribute: "allowBlobPublicAccess" };
   }
   if (!permitido) return { status: "ok" };
-  return { status: "finding", evidence: { allowBlobPublicAccess: true } };
+  const contenedores = observation.attributes.publicContainers;
+  const lista = Array.isArray(contenedores) ? contenedores.filter((c) => typeof c === "string") : void 0;
+  return {
+    status: "finding",
+    evidence: {
+      allowBlobPublicAccess: true,
+      ...lista ? { publicContainers: lista, publicContainersTruncated: observation.attributes.publicContainersTruncated === true } : {}
+    }
+  };
 }
 var storageBlobPublico = {
   id: "SEC_AZURE_EXPOSURE_BLOB_PUBLICO",
@@ -11377,6 +11740,44 @@ var rolPrivilegiado = {
   requires: [AZURE_IAM_CHECKS.roleAssignments],
   evaluate: evaluate4
 };
+function sinMfaEvaluate(observation) {
+  const role = observation.attributes.role;
+  const atSubscription = observation.attributes.subscriptionScope;
+  if (typeof role !== "string") return { status: "unknown", check: AZURE_IAM_CHECKS.roleAssignments, attribute: "role" };
+  if (typeof atSubscription !== "boolean") return { status: "unknown", check: AZURE_IAM_CHECKS.roleAssignments, attribute: "subscriptionScope" };
+  const privilegiado = role === "Owner" || role === "UserAccessAdministrator" || role === "Contributor" && atSubscription;
+  if (!privilegiado || observation.attributes.principalType !== "User") return { status: "ok" };
+  if (observation.attributes.principalExists === false) return { status: "ok" };
+  if (observation.attributes.mfaSampled === false) {
+    return { status: "unknown", check: AZURE_IAM_CHECKS.users, attribute: "mfaScope", reason: "sample_capped" };
+  }
+  const alcance = observation.attributes.mfaScope;
+  if (typeof alcance !== "string") return { status: "unknown", check: AZURE_IAM_CHECKS.users, attribute: "mfaScope" };
+  if (alcance !== "checked") return { status: "ok" };
+  const segundo = observation.attributes.secondFactor;
+  if (typeof segundo !== "boolean") return { status: "unknown", check: AZURE_IAM_CHECKS.authMethods, attribute: "secondFactor" };
+  if (segundo) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: {
+      role,
+      scope: observation.attributes.scope ?? null,
+      authMethods: observation.attributes.authMethods ?? [],
+      ...pick2(observation, ["principalName"])
+    }
+  };
+}
+var adminSinMfa = {
+  id: "SEC_AZURE_IAM_ADMIN_SIN_MFA",
+  scope: "resource",
+  category: "security_iam",
+  severity: "high",
+  provider: "azure",
+  kinds: ["role_assignment"],
+  requires: [AZURE_IAM_CHECKS.roleAssignments, AZURE_IAM_CHECKS.domains, AZURE_IAM_CHECKS.users, AZURE_IAM_CHECKS.authMethods],
+  runtimeOnly: true,
+  evaluate: sinMfaEvaluate
+};
 function huerfanaEvaluate(observation) {
   if (observation.attributes.orphanApplicable === false) return { status: "ok" };
   const exists = observation.attributes.principalExists;
@@ -11450,9 +11851,52 @@ var sinDiagnosticSettings = {
   requires: [AZURE_LOGGING_CHECKS.diagnosticSettings],
   evaluate: evaluate5
 };
+function vnetSinFlowLogsEvaluate(observation) {
+  const vnet = observation.attributes.vnetFlowLog;
+  if (typeof vnet !== "boolean") {
+    return { status: "unknown", check: AZURE_NETWORK_CHECKS.flowLogs, attribute: "vnetFlowLog" };
+  }
+  if (vnet) return { status: "ok" };
+  const subnets = observation.attributes.subnets;
+  if (!Array.isArray(subnets)) {
+    return { status: "unknown", check: AZURE_NETWORK_CHECKS.networkInterfaces, attribute: "subnets" };
+  }
+  const sinRegistro = subnets.filter((subnet) => subnet.covered !== true && subnet.platform !== true).map((subnet) => subnet.name);
+  if (sinRegistro.length === 0) return { status: "ok" };
+  return { status: "finding", evidence: { unloggedSubnets: sinRegistro, subnetCount: subnets.length } };
+}
+var vnetSinFlowLogs = {
+  id: "SEC_AZURE_LOGGING_VNET_SIN_FLOW_LOGS",
+  scope: "resource",
+  category: "security_logging",
+  severity: "medium",
+  provider: "azure",
+  kinds: ["virtual_network"],
+  // Las interfaces no van aquí: solo cuentan para subredes sin log propio, y su falta ya sale como `unknown` de esa VNet.
+  requires: [AZURE_NETWORK_CHECKS.virtualNetworks, AZURE_NETWORK_CHECKS.networkWatchers, AZURE_NETWORK_CHECKS.flowLogs],
+  evaluate: vnetSinFlowLogsEvaluate
+};
 
 // ../../services/security/src/rules/azure/network.ts
-function evaluate6(observation) {
+function denyEntries(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entrada) => {
+    if (typeof entrada !== "object" || entrada === null) return [];
+    const regla = entrada;
+    if (typeof regla.priority !== "number" || !Array.isArray(regla.destinations) || !Array.isArray(regla.sourcePorts)) return [];
+    return [{
+      protocol: typeof regla.protocol === "string" ? regla.protocol : "",
+      sources: cadenas2(regla.sources),
+      ports: cadenas2(regla.ports),
+      priority: regla.priority,
+      destinations: cadenas2(regla.destinations),
+      destinationAsgs: typeof regla.destinationAsgs === "number" ? regla.destinationAsgs : 0,
+      sourcePorts: cadenas2(regla.sourcePorts)
+    }];
+  });
+}
+var evaluate6 = (observation) => nsgAbierto(observation, adminPortsReached);
+function nsgAbierto(observation, reached) {
   const ingress = observation.attributes.ingressRules;
   if (!Array.isArray(ingress)) {
     return { status: "unknown", check: AZURE_NSG_CHECKS.list, attribute: "ingressRules" };
@@ -11460,6 +11904,7 @@ function evaluate6(observation) {
   const openings = [];
   const puertos = /* @__PURE__ */ new Set();
   let indecisa = false;
+  const denegaciones = denyEntries(observation.attributes.denyIngressRules);
   for (const entrada of ingress) {
     if (typeof entrada !== "object" || entrada === null) {
       indecisa = true;
@@ -11474,10 +11919,16 @@ function evaluate6(observation) {
     }
     if (!abierto) continue;
     const protocol = typeof regla.protocol === "string" ? regla.protocol : "";
-    const alcanzados = adminPortsReached(protocol, cadenas2(regla.ports));
+    const priority = typeof regla.priority === "number" ? regla.priority : void 0;
+    const alcanzados = reached(protocol, cadenas2(regla.ports)).filter((puerto) => !deniedBeforeAllow(denegaciones, { protocol, priority, sources }, puerto));
     if (alcanzados.length === 0) continue;
     for (const puerto of alcanzados) puertos.add(puerto);
-    openings.push({ protocol: regla.protocol, ports: alcanzados, sources: regla.sources });
+    openings.push({
+      protocol: regla.protocol,
+      ports: alcanzados,
+      sources: regla.sources,
+      ...typeof regla.name === "string" ? { ruleName: regla.name } : {}
+    });
   }
   if (openings.length > 0) {
     return { status: "finding", evidence: { ports: [...puertos].sort((a, b) => a - b), openings } };
@@ -11497,17 +11948,32 @@ var nsgAdminAbierto = {
   requires: [AZURE_NSG_CHECKS.list],
   evaluate: evaluate6
 };
+var nsgBdAbierto = {
+  id: "SEC_AZURE_NETWORK_BD_ABIERTO",
+  scope: "resource",
+  category: "security_network",
+  severity: "high",
+  provider: "azure",
+  kinds: ["nsg"],
+  requires: [AZURE_NSG_CHECKS.list],
+  evaluate: (observation) => nsgAbierto(observation, databasePortsReached)
+};
 
 // ../../services/security/src/rules/azure/index.ts
 var AZURE_SECURITY_RULES = [
   nsgAdminAbierto,
+  nsgBdAbierto,
   storageBlobPublico,
   sqlPublico,
   storageTlsDebil,
   sqlTlsDebil,
+  keyVaultSinPurga,
+  sqlSinTde,
   rolPrivilegiado,
   asignacionHuerfana,
-  sinDiagnosticSettings
+  adminSinMfa,
+  sinDiagnosticSettings,
+  vnetSinFlowLogs
 ];
 
 // ../../services/security/src/rules/gcp/combos.ts
@@ -11579,7 +12045,16 @@ var GCP_COMPUTE_CHECKS = {
   effectiveFirewalls: "gcp:compute:networks.getEffectiveFirewalls",
   regions: "gcp:compute:regions",
   regionFirewallPolicies: "gcp:compute:regionNetworkFirewallPolicies",
-  sharedVpcHost: "gcp:compute:sharedVpcHostFirewalls"
+  sharedVpcHost: "gcp:compute:sharedVpcHostFirewalls",
+  subnetworks: "gcp:compute:subnetworks"
+};
+var GCP_NETWORK_MANAGEMENT_CHECKS = {
+  vpcFlowLogsConfigs: "gcp:networkmanagement:vpcFlowLogsConfigs"
+};
+var GCP_KMS_CHECKS = {
+  locations: "gcp:kms:locations",
+  keyRings: "gcp:kms:keyRings",
+  cryptoKeys: "gcp:kms:cryptoKeys"
 };
 var GCP_SQL_CHECKS = {
   instances: "gcp:sql:instances"
@@ -11649,6 +12124,63 @@ var sqlSinCmek = {
   requires: [GCP_SQL_CHECKS.instances],
   evaluate: sqlSinCmekEvaluate
 };
+var SOLO_CIFRADO = /* @__PURE__ */ new Set(["ENCRYPTED_ONLY", "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"]);
+function sqlSinSslEvaluate(observation) {
+  const modo = observation.attributes.sslMode;
+  if (typeof modo === "string" && modo.length > 0) {
+    if (SOLO_CIFRADO.has(modo)) return { status: "ok" };
+    return { status: "finding", evidence: { sslMode: modo, ipv4Enabled: observation.attributes.ipv4Enabled ?? null } };
+  }
+  const requiere = observation.attributes.requireSsl;
+  if (requiere === true) return { status: "ok" };
+  if (!("sslMode" in observation.attributes)) {
+    return { status: "unknown", check: GCP_SQL_CHECKS.instances, attribute: "sslMode" };
+  }
+  if (requiere !== false && requiere !== null) {
+    return { status: "unknown", check: GCP_SQL_CHECKS.instances, attribute: "requireSsl" };
+  }
+  return { status: "finding", evidence: { sslMode: null, requireSsl: requiere, ipv4Enabled: observation.attributes.ipv4Enabled ?? null } };
+}
+var sqlSinSsl = {
+  id: "SEC_GCP_ENCRYPTION_SQL_SIN_SSL",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "medium",
+  provider: "gcp",
+  kinds: ["cloud_sql_instance"],
+  requires: [GCP_SQL_CHECKS.instances],
+  evaluate: sqlSinSslEvaluate
+};
+var KMS_MAX_ROTATION_DAYS = 90;
+function segundos(periodo) {
+  const m = /^(\d+(?:\.\d+)?)s$/.exec(periodo);
+  return m ? Number(m[1]) : void 0;
+}
+function kmsSinRotacionEvaluate2(observation) {
+  const a = observation.attributes;
+  if (!("purpose" in a) || !("primaryState" in a) || !("rotationPeriod" in a)) {
+    return { status: "unknown", check: GCP_KMS_CHECKS.cryptoKeys, attribute: "rotationPeriod" };
+  }
+  if (a.purpose !== "ENCRYPT_DECRYPT" || a.primaryState !== "ENABLED") return { status: "ok" };
+  if (a.importOnly === true || typeof a.protectionLevel === "string" && a.protectionLevel.startsWith("EXTERNAL")) {
+    return { status: "ok" };
+  }
+  if (a.rotationPeriod === null) return { status: "finding", evidence: { rotationPeriod: null } };
+  const s = typeof a.rotationPeriod === "string" ? segundos(a.rotationPeriod) : void 0;
+  if (s === void 0) return { status: "unknown", check: GCP_KMS_CHECKS.cryptoKeys, attribute: "rotationPeriod" };
+  if (s <= KMS_MAX_ROTATION_DAYS * 86400) return { status: "ok" };
+  return { status: "finding", evidence: { rotationPeriodDays: Math.round(s / 86400) } };
+}
+var kmsSinRotacion2 = {
+  id: "SEC_GCP_ENCRYPTION_KMS_SIN_ROTACION",
+  scope: "resource",
+  category: "security_encryption",
+  severity: "medium",
+  provider: "gcp",
+  kinds: ["kms_key"],
+  requires: [GCP_KMS_CHECKS.locations, GCP_KMS_CHECKS.keyRings, GCP_KMS_CHECKS.cryptoKeys],
+  evaluate: kmsSinRotacionEvaluate2
+};
 
 // ../../services/security/src/rules/gcp/exposure.ts
 function evaluate7(observation) {
@@ -11884,9 +12416,42 @@ var sinExportSink = {
   requires: [GCP_LOGGING_CHECKS.sinks],
   evaluate: evaluate8
 };
+function vpcSinFlowLogsEvaluate(observation) {
+  const subnets = observation.attributes.subnets;
+  if (!Array.isArray(subnets)) {
+    return { status: "unknown", check: GCP_COMPUTE_CHECKS.subnetworks, attribute: "subnets" };
+  }
+  const lista = subnets;
+  const sinRegistro = lista.filter((subnet) => subnet.covered === false);
+  if (sinRegistro.length > 0) {
+    return {
+      status: "finding",
+      evidence: { unloggedSubnets: sinRegistro.map((subnet) => `${String(subnet.region)}/${String(subnet.name)}`), subnetCount: lista.length }
+    };
+  }
+  if (lista.some((subnet) => subnet.covered !== true)) {
+    return { status: "unknown", check: GCP_NETWORK_MANAGEMENT_CHECKS.vpcFlowLogsConfigs, attribute: "subnets" };
+  }
+  if (observation.attributes.subnetsComplete !== true) {
+    return { status: "unknown", check: GCP_COMPUTE_CHECKS.subnetworks, attribute: "subnets" };
+  }
+  return { status: "ok" };
+}
+var vpcSinFlowLogs = {
+  id: "SEC_GCP_LOGGING_VPC_SIN_FLOW_LOGS",
+  scope: "resource",
+  category: "security_logging",
+  severity: "medium",
+  provider: "gcp",
+  kinds: ["vpc_network"],
+  // Las configs de Network Management no van aquí: una red con `logConfig` en cada subred ya está bien sin ellas.
+  requires: [GCP_COMPUTE_CHECKS.subnetworks],
+  evaluate: vpcSinFlowLogsEvaluate
+};
 
 // ../../services/security/src/rules/gcp/network.ts
-function evaluate9(observation) {
+var evaluate9 = (observation) => firewallAbierto(observation, adminPortsReached);
+function firewallAbierto(observation, reached) {
   const direction = observation.attributes.direction;
   const disabled = observation.attributes.disabled;
   const sources = observation.attributes.sourceRanges;
@@ -11905,7 +12470,7 @@ function evaluate9(observation) {
     if (typeof entry !== "object" || entry === null) continue;
     const rule = entry;
     const protocol = typeof rule.protocol === "string" ? rule.protocol : "";
-    for (const puerto of adminPortsReached(protocol, cadenas2(rule.ports))) puertos.add(puerto);
+    for (const puerto of reached(protocol, cadenas2(rule.ports))) puertos.add(puerto);
   }
   if (puertos.size === 0) return { status: "ok" };
   return {
@@ -12065,6 +12630,16 @@ var firewallAdminAbierto = {
   requires: [GCP_COMPUTE_CHECKS.firewalls],
   evaluate: evaluate9
 };
+var firewallBdAbierto = {
+  id: "SEC_GCP_NETWORK_BD_ABIERTO",
+  scope: "resource",
+  category: "security_network",
+  severity: "high",
+  provider: "gcp",
+  kinds: ["firewall"],
+  requires: [GCP_COMPUTE_CHECKS.firewalls],
+  evaluate: (observation) => firewallAbierto(observation, databasePortsReached)
+};
 
 // ../../services/security/src/rules/gcp/secrets.ts
 var SOSPECHOSAS2 = ["PASSWORD", "PASSWD", "SECRET", "TOKEN", "APIKEY", "API_KEY", "PRIVATE_KEY", "CREDENTIAL"];
@@ -12099,11 +12674,14 @@ var secretoEnFunction = {
 // ../../services/security/src/rules/gcp/index.ts
 var GCP_SECURITY_RULES = [
   firewallAdminAbierto,
+  firewallBdAbierto,
   politicaAdminAbierta,
   sqlPublico2,
   gcsPublico,
   discoSinCmek,
   sqlSinCmek,
+  sqlSinSsl,
+  kmsSinRotacion2,
   secretoEnFunction,
   rolPrimitivo,
   claveSaUserManaged,
@@ -12111,7 +12689,8 @@ var GCP_SECURITY_RULES = [
   claveSaSinUso,
   permisosSinUso2,
   auditIncompleto,
-  sinExportSink
+  sinExportSink,
+  vpcSinFlowLogs
 ];
 
 // src/security/evaluate.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaa-sentinel/iac-cost",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Estimate the monthly cost delta of a Terraform plan, check it against the AAA Sentinel security rules, open security fixes as pull requests and report how the security posture changed, from your CI",
   "license": "MIT",
   "type": "module",