@aaa-sentinel/iac-cost 0.4.1 → 0.5.0

package/README.md

@@ -139,8 +139,32 @@ or account ids. The JSON output does not: it is the complete evidence (see `--fo
   `provider` block rather than the resource, so `terraform show -json` often leaves it unknown.
   We say we do not know rather than substituting another region's price.
 
-Currently priced: **AWS** (EC2 on demand) and **Azure** (virtual machines). Anything else is
-reported as not priced, never as free.
+- **Usage is not guessed.** Only what the plan fixes is priced: the instance hours (730 a month)
+  and, for RDS, the allocated storage plus the IOPS and throughput provisioned above what the
+  volume includes. Usage-based charges — data transfer, backups beyond the allocated size, I/O
+  requests, CPU credits of burstable classes — are not added, nor storage growth from autoscaling
+  (`max_allocated_storage`), and neither are RDS Extended
+  Support (engine versions past standard support) or paid Performance Insights retention.
+- **Every price-moving attribute must be known.** An `aws_db_instance` is priced only when the
+  plan resolves its engine, Multi-AZ, allocated storage, storage type (and IOPS/throughput where
+  they are billed, and the license model for Oracle SE2). An attribute you leave out of the
+  configuration shows as "known after apply"; the CLI reads the plan's `configuration` (modules,
+  `count` and `for_each` included) and, only when the attribute is not written at all, the AWS
+  default is applied: `multi_az` (optional in the RDS API, which creates a Single-AZ instance when
+  it is not sent), `storage_type` (`io1` with `iops`, otherwise `gp3`
+  per the RDS API; because the provider docs still say `gp2`, it is priced only where gp2 and gp3
+  cost the same) and the included gp3 baseline IOPS/throughput. Such rows are marked † in the
+  comment with the attributes assumed. Nothing is assumed on updates, when the instance is
+  restored from a snapshot or replica (its storage comes from the source), or when `iops` is an
+  expression. An attribute written as an expression that is only known after apply is never
+  guessed.
+
+Currently priced: **AWS** (EC2 on demand and RDS `aws_db_instance`: MySQL, PostgreSQL, MariaDB,
+Oracle and SQL Server, Single-AZ or Multi-AZ, gp2/gp3/io1/io2) and **Azure** (virtual machines).
+Aurora (`aws_rds_cluster`, `aws_rds_cluster_instance`) is not priced: its instance price depends on
+the cluster's storage configuration and its storage and I/O are billed by use. Anything else is
+reported as not priced, never as free. Versions of the CLI before 0.5.0 do not send the RDS
+storage attributes, so their RDS instances stay not priced.
 
 ## Security before deploy
 

package/dist/cli.js

@@ -2351,18 +2351,18 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
   capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
-  const isPresent = key in input;
+  const isPresent2 = key in input;
   const isOptionalOut = optout === "optional";
-  if (!isPresent && isOptionalOut && optin === "optional") {
+  if (!isPresent2 && isOptionalOut && optin === "optional") {
     return;
   }
   if (result.issues.length) {
-    if (optin !== void 0 && isOptionalOut && !isPresent) {
+    if (optin !== void 0 && isOptionalOut && !isPresent2) {
       return;
     }
     final.issues.push(...prefixIssues(key, result.issues));
   }
-  if (!isPresent && optin === void 0) {
+  if (!isPresent2 && optin === void 0) {
     if (!result.issues.length) {
       final.issues.push({
         code: "invalid_type",
@@ -2374,7 +2374,7 @@ function handlePropertyResult(result, final, key, input, optin, optout) {
     return;
   }
   if (result.value === void 0) {
-    if (isPresent || optin === "defaulted" && !isOptionalOut) {
+    if (isPresent2 || optin === "defaulted" && !isOptionalOut) {
       final.value[key] = void 0;
     }
   } else {
@@ -2563,7 +2563,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
         continue;
       const id = ids[key];
       const k = typeof key === "symbol" ? `syms[${syms.indexOf(key)}]` : esc(key);
-      const isPresent = `${k} in input`;
+      const isPresent2 = `${k} in input`;
       const schema = shape[key];
       const optin = schema?._zod?.optin;
       const isOptionalIn = optin !== void 0;
@@ -2572,7 +2572,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
       if (isOptionalIn && isOptionalOut) {
         const assign = optin === "optional" ? `${id}_present` : `${id}.value !== undefined || ${id}_present`;
         doc.write(`
-        const ${id}_present = ${isPresent};
+        const ${id}_present = ${isPresent2};
         if (!${id}.issues.length || ${id}_present) {
           if (${id}.issues.length) {${prefixStr(id, k)}
           }
@@ -2585,7 +2585,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
       `);
       } else if (!isOptionalIn) {
         doc.write(`
-        const ${id}_present = ${isPresent};
+        const ${id}_present = ${isPresent2};
         if (${id}.issues.length) {${prefixStr(id, k)}
         }
         if (!${id}_present && !${id}.issues.length) {
@@ -2615,7 +2615,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
           doc.write(`newResult[${k}] = ${id}.value;`);
         } else {
           doc.write(`
-        if (${id}.value !== undefined || ${isPresent}) {
+        if (${id}.value !== undefined || ${isPresent2}) {
           newResult[${k}] = ${id}.value;
         }
       `);
@@ -6265,6 +6265,8 @@ function iacProviderOf(resourceType) {
     billing: !NON_BILLING_PROVIDERS.has(name)
   };
 }
+var IAC_UNSET_IN_CONFIG = "unset_in_config";
+var IAC_UNKNOWN_IN_PLAN = "unknown_in_plan";
 var IAC_RESOURCE_SPECS = {
   // ── Azure ──
   azurerm_linux_virtual_machine: {
@@ -6295,16 +6297,35 @@ var IAC_RESOURCE_SPECS = {
     instancesAttribute: "instances",
     os: "windows"
   },
-  // ── AWS: reconocidos y proyectados, todavía sin catálogo de precios ──
+  // ── AWS ──
+  // hashicorp/aws 6.x admite `region` por recurso; sin escribirla el plan trae la del provider.
   aws_instance: {
     provider: "aws",
-    attributes: ["instance_type"],
-    sizeAttribute: "instance_type"
+    attributes: ["instance_type", "region"],
+    sizeAttribute: "instance_type",
+    regionAttribute: "region",
+    regionPlannedByProvider: true
   },
+  // Aurora (`aws_rds_cluster*`) no está: el precio de su instancia depende del `storage_type` del clúster, que es otro recurso.
   aws_db_instance: {
     provider: "aws",
-    attributes: ["instance_class", "engine", "multi_az", "allocated_storage"],
-    sizeAttribute: "instance_class"
+    attributes: [
+      "instance_class",
+      "engine",
+      "license_model",
+      "multi_az",
+      "allocated_storage",
+      "storage_type",
+      "iops",
+      "storage_throughput",
+      "region"
+    ],
+    sizeAttribute: "instance_class",
+    regionAttribute: "region",
+    regionPlannedByProvider: true,
+    unsetReportable: ["multi_az", "storage_type", "iops", "storage_throughput"],
+    unsetBlockedBy: ["snapshot_identifier", "replicate_source_db"],
+    unsetBlockedByBlocks: ["restore_to_point_in_time", "s3_import"]
   },
   // ── GCP: ídem ──
   google_compute_instance: {
@@ -6378,7 +6399,7 @@ function aggregateEstimates(estimates) {
   const pricedProviders = /* @__PURE__ */ new Set();
   for (const estimate of estimates) {
     for (const item of estimate.priced) {
-      const key = keyOf(item);
+      const key = `${keyOf(item)}#${(item.assumedDefaults ?? []).join(",")}`;
       const found = priced.get(key);
       if (!found) priced.set(key, { ...item });
       else {
@@ -9283,6 +9304,62 @@ function extractDefaultRegions(plan) {
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
+function moduleNames(moduleAddress) {
+  if (!moduleAddress) return [];
+  const parts = moduleAddress.replace(/\[(?:\d+|"(?:[^"\\]|\\.)*")\]/g, "").split(".");
+  if (parts.length % 2 !== 0) return null;
+  const names = [];
+  for (let i = 0; i < parts.length; i += 2) {
+    if (parts[i] !== "module" || !/^[A-Za-z0-9_-]+$/.test(parts[i + 1] ?? "")) return null;
+    names.push(parts[i + 1]);
+  }
+  return names;
+}
+function configExpressions(plan, change) {
+  return configResource(plan, change)?.expressions;
+}
+function configResource(plan, change) {
+  if (!change.name) return void 0;
+  const path3 = moduleNames(change.module_address);
+  if (path3 === null) return void 0;
+  let module = plan.configuration?.root_module;
+  for (const name of path3) module = module?.module_calls?.[name]?.module;
+  const address = `${change.type}.${change.name}`;
+  return module?.resources?.find((r) => r.address === address && (r.mode ?? "managed") === "managed");
+}
+function knownAtPlan(expression, inRoot) {
+  if ("constant_value" in expression) return true;
+  const references = Array.isArray(expression.references) ? expression.references : [];
+  return inRoot && references.length > 0 && references.every((r) => typeof r === "string" && r.startsWith("var."));
+}
+function hasUnknown(value) {
+  if (value === true) return true;
+  if (Array.isArray(value)) return value.some(hasUnknown);
+  if (typeof value === "object" && value !== null) return Object.values(value).some(hasUnknown);
+  return false;
+}
+var isPresent = (value) => Array.isArray(value) ? value.length > 0 : value !== null && value !== void 0 && value !== "";
+function unsetInConfig(change, expressions, names, blockedBy = [], blockedByBlocks = []) {
+  const unknownSide = change.after_unknown;
+  if (!names || !unknownSide || !expressions) return void 0;
+  if (blockedBy.some((name) => name in expressions || isPresent(change.after?.[name]))) return void 0;
+  if (blockedByBlocks.some((name) => name in expressions || isPresent(change.after?.[name]) || hasUnknown(unknownSide[name]))) return void 0;
+  const unset = names.filter((name) => unknownSide[name] === true && !(name in expressions));
+  return unset.length > 0 ? unset.join(",") : void 0;
+}
+function regionUntrusted(plan, change, regionAttribute) {
+  if (change.change.after_unknown?.[regionAttribute] === true) return true;
+  if (!isPresent(change.change.after?.[regionAttribute])) return false;
+  const resource = configResource(plan, change);
+  if (!resource?.expressions) return true;
+  const expression = resource.expressions[regionAttribute];
+  if (expression !== void 0) return !knownAtPlan(expression, (moduleNames(change.module_address) ?? ["?"]).length === 0);
+  const key = resource.provider_config_key;
+  const provider = key === void 0 ? void 0 : plan.configuration?.provider_config?.[key];
+  if (!provider) return true;
+  const providerRegion = provider.expressions?.["region"];
+  return providerRegion !== void 0 && !knownAtPlan(providerRegion, provider.module_address === void 0);
+}
 function pickAttributes(side, unknownSide, attributeNames) {
   if (!side) return void 0;
   const attrs = {};
@@ -9290,6 +9367,7 @@ function pickAttributes(side, unknownSide, attributeNames) {
     if (unknownSide?.[name] === true) continue;
     const value = side[name];
     if (typeof value === "string" || typeof value === "number") attrs[name] = value;
+    else if (typeof value === "boolean") attrs[name] = String(value);
   }
   return Object.keys(attrs).length > 0 ? attrs : void 0;
 }
@@ -9302,7 +9380,17 @@ function parseTerraformPlan(plan) {
     if (!action) continue;
     const spec = IAC_RESOURCE_SPECS[resourceChange.type];
     const attributesBefore = spec ? pickAttributes(resourceChange.change.before, void 0, spec.attributes) : void 0;
-    const attributesAfter = spec ? pickAttributes(resourceChange.change.after, resourceChange.change.after_unknown, spec.attributes) : void 0;
+    const picked = spec ? pickAttributes(resourceChange.change.after, resourceChange.change.after_unknown, spec.attributes) : void 0;
+    const expressions = spec?.unsetReportable || spec?.regionPlannedByProvider ? configExpressions(plan, resourceChange) : void 0;
+    const creates = action === "create" || action === "replace";
+    const unset = creates ? unsetInConfig(resourceChange.change, expressions, spec?.unsetReportable, spec?.unsetBlockedBy, spec?.unsetBlockedByBlocks) : void 0;
+    const regionAttribute = spec?.regionPlannedByProvider ? spec.regionAttribute : void 0;
+    const untrusted = picked !== void 0 && regionAttribute !== void 0 && regionUntrusted(plan, resourceChange, regionAttribute);
+    let attributesAfter = unset === void 0 ? picked : { ...picked, [IAC_UNSET_IN_CONFIG]: unset };
+    if (untrusted && attributesAfter) {
+      const { [regionAttribute]: _dropped, ...rest } = attributesAfter;
+      attributesAfter = { ...rest, [IAC_UNKNOWN_IN_PLAN]: regionAttribute };
+    }
     const change = {
       type: resourceChange.type,
       action,
@@ -9333,6 +9421,9 @@ var REASON_TEXT = {
   region_not_supported: "region not in the price catalog",
   size_unknown: "size/SKU could not be resolved from the plan",
   instance_count_unknown: "instance count could not be resolved from the plan",
+  attribute_unknown: "a price-relevant attribute (engine, Multi-AZ, storage\u2026) could not be resolved from the plan",
+  price_unavailable: "the price catalog did not answer this time; a later run retries",
+  price_lookup_limit: "too many distinct database configurations in one plan to look up in a single request",
   price_not_found: "no matching price found in the catalog"
 };
 var fmtUsd = (n) => `${n < 0 ? "-" : "+"}$${Math.abs(n).toFixed(2)}/mo`;
@@ -9340,7 +9431,7 @@ function fmtConverted(n, currency) {
   const amount = new Intl.NumberFormat("en-US", { style: "currency", currency }).format(Math.abs(n));
   return `\u2248 ${n < 0 ? "-" : "+"}${amount}/mo`;
 }
-var LIST_PRICE_CAVEAT = "They also do not reflect committed-use discounts (EDP/EA/CUD) or existing reservations/Savings Plans that may already cover a resource.";
+var LIST_PRICE_CAVEAT = "They also do not reflect committed-use discounts (EDP/EA/CUD) or existing reservations/Savings Plans that may already cover a resource. Usage-based charges (data transfer, backups beyond the allocated storage, I/O requests, CPU credits), storage growth from autoscaling (`max_allocated_storage`), RDS Extended Support and paid Performance Insights retention are not included.";
 var reasonText = (reason) => REASON_TEXT[reason] ?? reason;
 function actionVerb(action) {
   return action === "create" ? "new" : action === "delete" ? "removed" : action;
@@ -9371,8 +9462,16 @@ function renderComment(estimate) {
   if (estimate.priced.length > 0) {
     lines2.push("", "| Resource | Change | Qty | Delta |", "|---|---|---|---|");
     for (const item of estimate.priced) {
+      const assumed = item.assumedDefaults?.length ? " \u2020" : "";
       lines2.push(
-        `| \`${item.type}\` | ${actionVerb(item.action)} | ${item.count} | ${delta(item.monthlyDeltaUsd, item.monthlyDelta)} |`
+        `| \`${item.type}\`${assumed} | ${actionVerb(item.action)} | ${item.count} | ${delta(item.monthlyDeltaUsd, item.monthlyDelta)} |`
+      );
+    }
+    const assumedNames = [...new Set(estimate.priced.flatMap((i) => i.assumedDefaults ?? []))].sort();
+    if (assumedNames.length > 0) {
+      lines2.push(
+        "",
+        `\u2020 Not set in the Terraform configuration, so the AWS default was assumed for: ${assumedNames.map((n) => `\`${n}\``).join(", ")}. Set them explicitly if your deployment differs.`
       );
     }
   }
@@ -10649,7 +10748,7 @@ var trailGestionIncompleta = {
   evaluate: gestionIncompletaEvaluate
 };
 
-// ../../services/security/src/collectors/internet.ts
+// ../../shared/src/internet-exposure.ts
 var ADMIN_PORTS2 = [22, 3389];
 var DATABASE_PORTS = [1433, 1521, 2483, 2484, 3306, 5432, 6379, 9200, 9300, 27017, 27018, 27019];
 var ETIQUETAS_INTERNET = /* @__PURE__ */ new Set(["*", "internet", "any", "/0"]);
@@ -10708,6 +10807,42 @@ function databasePortsReached(protocol, portRanges) {
   if (adminPortsReached(protocol, portRanges).length > 0) return [];
   return portsReached(DATABASE_PORTS, protocol, portRanges);
 }
+var TODO_INTERNET = /* @__PURE__ */ new Set(["*", "internet", "any"]);
+function sourceCoversInternet(source) {
+  return TODO_INTERNET.has(source.trim().toLowerCase());
+}
+function ipFamily(source) {
+  const ip = source.trim().split("/")[0] ?? "";
+  if (ip.includes(":")) return "v6";
+  return /^\d{1,3}(\.\d{1,3}){3}$/.test(ip) ? "v4" : void 0;
+}
+function denySourceCovers(denySource, allowSource) {
+  if (sourceCoversInternet(denySource)) return true;
+  const partes = denySource.trim().split("/");
+  if (partes.length !== 2 || partes[1] !== "0") return false;
+  const familia = ipFamily(denySource);
+  return familia !== void 0 && familia === ipFamily(allowSource);
+}
+function denyCoversEveryTarget(deny) {
+  if ((deny.destinationAsgs ?? 0) > 0) return false;
+  if ((deny.destinations ?? []).some((d) => !["*", "any"].includes(d.trim().toLowerCase()))) return false;
+  return (deny.sourcePorts ?? []).every((p) => p.trim() === "*");
+}
+function deniedBeforeAllow(denies, allow, port) {
+  const allowPriority = allow.priority;
+  if (typeof allowPriority !== "number") return false;
+  const abiertos = allow.sources.filter((s) => sourceOpensToInternet(s) === true);
+  if (abiertos.length === 0) return false;
+  const allowProtocol = protocolName(allow.protocol);
+  return denies.some((deny) => {
+    if (typeof deny.priority !== "number" || deny.priority >= allowPriority) return false;
+    if (!denyCoversEveryTarget(deny)) return false;
+    if (!abiertos.every((a) => deny.sources.some((d) => denySourceCovers(d, a)))) return false;
+    const p = protocolName(deny.protocol);
+    if (p !== "*" && p !== "any" && p !== "all" && p !== allowProtocol) return false;
+    return deny.ports.length === 0 || deny.ports.some((rango) => cubrePuerto(rango, port));
+  });
+}
 function cadenas2(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
@@ -11397,7 +11532,9 @@ var AZURE_NSG_CHECKS = {
   list: "azure:nsg:list"
 };
 var AZURE_STORAGE_CHECKS = {
-  list: "azure:storage:list"
+  list: "azure:storage:list",
+  // Solo de las cuentas que permiten blobs públicos: dice a quien aprueba cerrarlo qué contenedores dejan de servirse.
+  containers: "azure:storage:containers"
 };
 var AZURE_SQL_CHECKS = {
   list: "azure:sql:list",
@@ -11418,7 +11555,12 @@ var AZURE_IAM_CHECKS = {
   roleAssignments: "azure:iam:roleAssignments",
   // Microsoft Graph, opcional: `Directory.Read.All` de aplicación (§16.7, F4).
   principals: "azure:graph:directoryObjects.getByIds",
-  groupMembers: "azure:graph:groups.members"
+  groupMembers: "azure:graph:groups.members",
+  // Tipo, estado y dominio de los usuarios con rol privilegiado, y los dominios federados: también con `Directory.Read.All`.
+  users: "azure:graph:users",
+  domains: "azure:graph:domains",
+  // Métodos de autenticación registrados: `UserAuthenticationMethod.Read.All` de aplicación, opcional.
+  authMethods: "azure:graph:users.authentication.methods"
 };
 var AZURE_LOGGING_CHECKS = {
   diagnosticSettings: "azure:insights:diagnosticSettings"
@@ -11517,7 +11659,15 @@ function blobPublicoEvaluate(observation) {
     return { status: "unknown", check: AZURE_STORAGE_CHECKS.list, attribute: "allowBlobPublicAccess" };
   }
   if (!permitido) return { status: "ok" };
-  return { status: "finding", evidence: { allowBlobPublicAccess: true } };
+  const contenedores = observation.attributes.publicContainers;
+  const lista = Array.isArray(contenedores) ? contenedores.filter((c) => typeof c === "string") : void 0;
+  return {
+    status: "finding",
+    evidence: {
+      allowBlobPublicAccess: true,
+      ...lista ? { publicContainers: lista, publicContainersTruncated: observation.attributes.publicContainersTruncated === true } : {}
+    }
+  };
 }
 var storageBlobPublico = {
   id: "SEC_AZURE_EXPOSURE_BLOB_PUBLICO",
@@ -11590,6 +11740,44 @@ var rolPrivilegiado = {
   requires: [AZURE_IAM_CHECKS.roleAssignments],
   evaluate: evaluate4
 };
+function sinMfaEvaluate(observation) {
+  const role = observation.attributes.role;
+  const atSubscription = observation.attributes.subscriptionScope;
+  if (typeof role !== "string") return { status: "unknown", check: AZURE_IAM_CHECKS.roleAssignments, attribute: "role" };
+  if (typeof atSubscription !== "boolean") return { status: "unknown", check: AZURE_IAM_CHECKS.roleAssignments, attribute: "subscriptionScope" };
+  const privilegiado = role === "Owner" || role === "UserAccessAdministrator" || role === "Contributor" && atSubscription;
+  if (!privilegiado || observation.attributes.principalType !== "User") return { status: "ok" };
+  if (observation.attributes.principalExists === false) return { status: "ok" };
+  if (observation.attributes.mfaSampled === false) {
+    return { status: "unknown", check: AZURE_IAM_CHECKS.users, attribute: "mfaScope", reason: "sample_capped" };
+  }
+  const alcance = observation.attributes.mfaScope;
+  if (typeof alcance !== "string") return { status: "unknown", check: AZURE_IAM_CHECKS.users, attribute: "mfaScope" };
+  if (alcance !== "checked") return { status: "ok" };
+  const segundo = observation.attributes.secondFactor;
+  if (typeof segundo !== "boolean") return { status: "unknown", check: AZURE_IAM_CHECKS.authMethods, attribute: "secondFactor" };
+  if (segundo) return { status: "ok" };
+  return {
+    status: "finding",
+    evidence: {
+      role,
+      scope: observation.attributes.scope ?? null,
+      authMethods: observation.attributes.authMethods ?? [],
+      ...pick2(observation, ["principalName"])
+    }
+  };
+}
+var adminSinMfa = {
+  id: "SEC_AZURE_IAM_ADMIN_SIN_MFA",
+  scope: "resource",
+  category: "security_iam",
+  severity: "high",
+  provider: "azure",
+  kinds: ["role_assignment"],
+  requires: [AZURE_IAM_CHECKS.roleAssignments, AZURE_IAM_CHECKS.domains, AZURE_IAM_CHECKS.users, AZURE_IAM_CHECKS.authMethods],
+  runtimeOnly: true,
+  evaluate: sinMfaEvaluate
+};
 function huerfanaEvaluate(observation) {
   if (observation.attributes.orphanApplicable === false) return { status: "ok" };
   const exists = observation.attributes.principalExists;
@@ -11690,6 +11878,23 @@ var vnetSinFlowLogs = {
 };
 
 // ../../services/security/src/rules/azure/network.ts
+function denyEntries(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entrada) => {
+    if (typeof entrada !== "object" || entrada === null) return [];
+    const regla = entrada;
+    if (typeof regla.priority !== "number" || !Array.isArray(regla.destinations) || !Array.isArray(regla.sourcePorts)) return [];
+    return [{
+      protocol: typeof regla.protocol === "string" ? regla.protocol : "",
+      sources: cadenas2(regla.sources),
+      ports: cadenas2(regla.ports),
+      priority: regla.priority,
+      destinations: cadenas2(regla.destinations),
+      destinationAsgs: typeof regla.destinationAsgs === "number" ? regla.destinationAsgs : 0,
+      sourcePorts: cadenas2(regla.sourcePorts)
+    }];
+  });
+}
 var evaluate6 = (observation) => nsgAbierto(observation, adminPortsReached);
 function nsgAbierto(observation, reached) {
   const ingress = observation.attributes.ingressRules;
@@ -11699,6 +11904,7 @@ function nsgAbierto(observation, reached) {
   const openings = [];
   const puertos = /* @__PURE__ */ new Set();
   let indecisa = false;
+  const denegaciones = denyEntries(observation.attributes.denyIngressRules);
   for (const entrada of ingress) {
     if (typeof entrada !== "object" || entrada === null) {
       indecisa = true;
@@ -11713,10 +11919,16 @@ function nsgAbierto(observation, reached) {
     }
     if (!abierto) continue;
     const protocol = typeof regla.protocol === "string" ? regla.protocol : "";
-    const alcanzados = reached(protocol, cadenas2(regla.ports));
+    const priority = typeof regla.priority === "number" ? regla.priority : void 0;
+    const alcanzados = reached(protocol, cadenas2(regla.ports)).filter((puerto) => !deniedBeforeAllow(denegaciones, { protocol, priority, sources }, puerto));
     if (alcanzados.length === 0) continue;
     for (const puerto of alcanzados) puertos.add(puerto);
-    openings.push({ protocol: regla.protocol, ports: alcanzados, sources: regla.sources });
+    openings.push({
+      protocol: regla.protocol,
+      ports: alcanzados,
+      sources: regla.sources,
+      ...typeof regla.name === "string" ? { ruleName: regla.name } : {}
+    });
   }
   if (openings.length > 0) {
     return { status: "finding", evidence: { ports: [...puertos].sort((a, b) => a - b), openings } };
@@ -11759,6 +11971,7 @@ var AZURE_SECURITY_RULES = [
   sqlSinTde,
   rolPrivilegiado,
   asignacionHuerfana,
+  adminSinMfa,
   sinDiagnosticSettings,
   vnetSinFlowLogs
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaa-sentinel/iac-cost",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Estimate the monthly cost delta of a Terraform plan, check it against the AAA Sentinel security rules, open security fixes as pull requests and report how the security posture changed, from your CI",
   "license": "MIT",
   "type": "module",