@prism-d1/cli 1.2.0 → 1.4.0

package/dist/assets/pentest-cdk/lib/pentest-target-stack.ts

@@ -0,0 +1,206 @@
+/**
+ * The temporary pentest TARGET environment, deployed per run by
+ * `prism-cli security pentest` (dockerfile adapter). Generalized from the
+ * hand-run spike stack (removed once this replaced it); see
+ * docs/DESIGN-prism-cli-pentest.md. Test target: cli/test/fixtures/pentest-sample.
+ *
+ * Private VPC only: private isolated subnets, no public subnet, no internet
+ * gateway, no NAT, no 0.0.0.0/0 ingress anywhere. The app runs on Fargate
+ * behind an INTERNAL ALB; the pentest agent's ENI reaches it over local VPC
+ * routing. VPC endpoints (ECR api+dkr, S3 gateway, CloudWatch Logs) let Fargate
+ * run with no internet path.
+ *
+ * Context (all from `cdk -c key=value`, set by the adapter):
+ *   slug        run id; names the stack's resources and the private zone
+ *   appDir      absolute path to the Docker build context -> image asset
+ *   dockerfile  Dockerfile path relative to appDir (default: Dockerfile)
+ *   port        container port the app listens on
+ *   healthPath  ALB health-check path
+ *   zoneName    private hosted-zone name (host is app.<zoneName>)
+ *   ttlHours    hours from synth for the prism:expires-at tag
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as ecrAssets from 'aws-cdk-lib/aws-ecr-assets';
+import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as route53 from 'aws-cdk-lib/aws-route53';
+import * as targets from 'aws-cdk-lib/aws-route53-targets';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { Construct } from 'constructs';
+
+const ALB_PORT = 80;
+
+/** A JSON context value (the adapter passes env, secrets and actor ARNs this way); absent = fallback. */
+function ctxJson<T>(scope: Construct, key: string, fallback: T): T {
+  const v = scope.node.tryGetContext(key);
+  if (v === undefined || v === null || v === '') return fallback;
+  return (typeof v === 'string' ? JSON.parse(v) : v) as T;
+}
+
+/** A Secrets Manager ARN with its random 6-character suffix is complete; without it, partial. */
+const isCompleteSecretArn = (arn: string) => /-[A-Za-z0-9]{6}$/.test(arn);
+
+function ctxStr(scope: Construct, key: string, fallback?: string): string {
+  const v = scope.node.tryGetContext(key);
+  if (v === undefined || v === null || v === '') {
+    if (fallback !== undefined) return fallback;
+    throw new Error(`pentest-cdk: required context "${key}" is not set`);
+  }
+  return String(v);
+}
+
+export class PentestTargetStack extends cdk.Stack {
+  constructor(scope: Construct, id: string, props: cdk.StackProps) {
+    super(scope, id, props);
+
+    const slug = ctxStr(this, 'slug');
+    const appDir = ctxStr(this, 'appDir');
+    const port = Number(ctxStr(this, 'port', '8080'));
+    const healthPath = ctxStr(this, 'healthPath', '/health');
+    const zoneName = ctxStr(this, 'zoneName', `${slug}.prism.internal`);
+    const ttlHours = Number(ctxStr(this, 'ttlHours', '24'));
+    const logGroupName = `/aws/securityagent/prism-pentest-${slug}`;
+
+    cdk.Tags.of(this).add('prism:purpose', 'pentest');
+    cdk.Tags.of(this).add('prism:pentest-run', slug);
+    cdk.Tags.of(this).add('prism:expires-at', new Date(Date.now() + ttlHours * 3_600_000).toISOString());
+
+    // --- Network: private isolated subnets only (no IGW, no NAT) ---------
+    const vpc = new ec2.Vpc(this, 'Vpc', {
+      ipAddresses: ec2.IpAddresses.cidr('10.80.0.0/16'),
+      maxAzs: 2,
+      natGateways: 0,
+      subnetConfiguration: [{ name: 'private', subnetType: ec2.SubnetType.PRIVATE_ISOLATED, cidrMask: 24 }],
+      restrictDefaultSecurityGroup: true,
+    });
+    const privateSubnets = { subnetType: ec2.SubnetType.PRIVATE_ISOLATED };
+
+    const sg = (name: string, description: string) => new ec2.SecurityGroup(this, name, { vpc, description, allowAllOutbound: false });
+    const agentSg = sg('AgentSg', 'Pentest agent ENI: may reach the internal ALB on 80 only');
+    const albSg = sg('AlbSg', 'Internal ALB: accepts the pentest agent only');
+    const appSg = sg('AppSg', 'App tasks: accept the ALB only');
+    const endpointSg = sg('EndpointSg', 'VPC interface endpoints: accept the app tasks only');
+
+    agentSg.addEgressRule(albSg, ec2.Port.tcp(ALB_PORT), 'to the internal ALB');
+    albSg.addIngressRule(agentSg, ec2.Port.tcp(ALB_PORT), 'from the pentest agent');
+    appSg.addEgressRule(endpointSg, ec2.Port.tcp(443), 'to VPC interface endpoints');
+    endpointSg.addIngressRule(appSg, ec2.Port.tcp(443), 'from the app tasks');
+
+    vpc.addGatewayEndpoint('S3', { service: ec2.GatewayVpcEndpointAwsService.S3, subnets: [privateSubnets] });
+    const s3PrefixList = ec2.PrefixList.fromLookup(this, 'S3PrefixList', { prefixListName: `com.amazonaws.${this.region}.s3` });
+    appSg.addEgressRule(ec2.Peer.prefixList(s3PrefixList.prefixListId), ec2.Port.tcp(443), 'to S3 (ECR image layers)');
+
+    const appEnv = ctxJson<Record<string, string>>(this, 'env', {});
+    const appSecrets = ctxJson<Record<string, string>>(this, 'secrets', {});
+    const actorSecrets = ctxJson<string[]>(this, 'actorSecrets', []);
+    const actorLambdas = ctxJson<string[]>(this, 'actorLambdas', []);
+
+    const endpoints: [string, ec2.InterfaceVpcEndpointAwsService][] = [
+      ['EcrApi', ec2.InterfaceVpcEndpointAwsService.ECR],
+      ['EcrDkr', ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER],
+      ['Logs', ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS],
+    ];
+    // With no internet path, a task reads its secrets at start through this endpoint.
+    if (Object.keys(appSecrets).length) endpoints.push(['SecretsManager', ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER]);
+    for (const [cid, service] of endpoints) {
+      vpc.addInterfaceEndpoint(cid, { service, subnets: privateSubnets, securityGroups: [endpointSg], open: false, privateDnsEnabled: true });
+    }
+
+    // --- App: Fargate behind an internal ALB -----------------------------
+    // dockerfile: path relative to appDir (the build context); may be in a subfolder.
+    const dockerfile = ctxStr(this, 'dockerfile', 'Dockerfile');
+    const image = new ecrAssets.DockerImageAsset(this, 'Image', { directory: appDir, file: dockerfile, platform: ecrAssets.Platform.LINUX_AMD64 });
+    const appLogs = new logs.LogGroup(this, 'AppLogs', { retention: logs.RetentionDays.ONE_WEEK, removalPolicy: cdk.RemovalPolicy.DESTROY });
+    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });
+    const task = new ecs.FargateTaskDefinition(this, 'Task', {
+      cpu: 256, memoryLimitMiB: 512,
+      runtimePlatform: { cpuArchitecture: ecs.CpuArchitecture.X86_64, operatingSystemFamily: ecs.OperatingSystemFamily.LINUX },
+    });
+    task.addContainer('app', {
+      image: ecs.ContainerImage.fromDockerImageAsset(image),
+      portMappings: [{ containerPort: port }],
+      environment: { ...appEnv, PORT: String(port) },
+      // Injected by ECS at task start; the execution role is granted read on exactly these secrets.
+      secrets: Object.fromEntries(Object.entries(appSecrets).map(([name, arn], i) => [name, ecs.Secret.fromSecretsManager(
+        isCompleteSecretArn(arn) ? secretsmanager.Secret.fromSecretCompleteArn(this, `AppSecret${i}`, arn) : secretsmanager.Secret.fromSecretPartialArn(this, `AppSecret${i}`, arn),
+      )])),
+      logging: ecs.LogDrivers.awsLogs({ logGroup: appLogs, streamPrefix: 'app' }),
+    });
+    const service = new ecs.FargateService(this, 'Service', {
+      cluster, taskDefinition: task, desiredCount: 1, minHealthyPercent: 100,
+      assignPublicIp: false, vpcSubnets: privateSubnets, securityGroups: [appSg], circuitBreaker: { rollback: true },
+    });
+
+    const alb = new elbv2.ApplicationLoadBalancer(this, 'Alb', {
+      vpc, internetFacing: false, vpcSubnets: privateSubnets, securityGroup: albSg, dropInvalidHeaderFields: true,
+    });
+    const listener = alb.addListener('Http', { port: ALB_PORT, protocol: elbv2.ApplicationProtocol.HTTP, open: false });
+    // Faster than the 5 x 30s default, so a new task turns healthy in ~20s; the
+    // command waits for a healthy target before starting the pentest.
+    const targetGroup = listener.addTargets('App', {
+      port, protocol: elbv2.ApplicationProtocol.HTTP, targets: [service],
+      healthCheck: { path: healthPath, interval: cdk.Duration.seconds(10), timeout: cdk.Duration.seconds(5), healthyThresholdCount: 2, unhealthyThresholdCount: 3 },
+      deregistrationDelay: cdk.Duration.seconds(10),
+    });
+
+    // --- Private hostname -------------------------------------------------
+    const zone = new route53.PrivateHostedZone(this, 'Zone', { zoneName, vpc });
+    new route53.ARecord(this, 'AppRecord', { zone, recordName: 'app', target: route53.RecordTarget.fromAlias(new targets.LoadBalancerTarget(alb)) });
+
+    // --- Source zip bucket and agent log group ---------------------------
+    const source = new s3.Bucket(this, 'Source', {
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL, encryption: s3.BucketEncryption.S3_MANAGED,
+      enforceSSL: true, removalPolicy: cdk.RemovalPolicy.DESTROY, autoDeleteObjects: true,
+    });
+    const agentLogs = new logs.LogGroup(this, 'AgentLogs', { logGroupName, retention: logs.RetentionDays.ONE_WEEK, removalPolicy: cdk.RemovalPolicy.DESTROY });
+
+    // --- Pentest service role (scoped ENI permissions; spike-confirmed) ---
+    const subnetArns = vpc.isolatedSubnets.map((s) => this.formatArn({ service: 'ec2', resource: 'subnet', resourceName: s.subnetId }));
+    const agentSgArn = this.formatArn({ service: 'ec2', resource: 'security-group', resourceName: agentSg.securityGroupId });
+    const eniArn = this.formatArn({ service: 'ec2', resource: 'network-interface', resourceName: '*' });
+
+    const role = new iam.Role(this, 'ServiceRole', {
+      assumedBy: new iam.ServicePrincipal('securityagent.amazonaws.com', { conditions: { StringEquals: { 'aws:SourceAccount': this.account } } }),
+      description: 'prism-cli security pentest: Security Agent service role for one private VPC pentest',
+    });
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: 'DescribeNetwork',
+      actions: ['ec2:DescribeDhcpOptions', 'ec2:DescribeNetworkInterfaces', 'ec2:DescribeNetworkInterfaceAttribute', 'ec2:DescribeSubnets', 'ec2:DescribeSecurityGroups', 'ec2:DescribeVpcs'],
+      resources: ['*'],
+    }));
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'EniCreateScoped', actions: ['ec2:CreateNetworkInterface'], resources: [eniArn, agentSgArn, ...subnetArns] }));
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'EniManageScoped', actions: ['ec2:ModifyNetworkInterfaceAttribute', 'ec2:DeleteNetworkInterface'], resources: [eniArn, agentSgArn], conditions: { StringEquals: { 'ec2:Vpc': vpc.vpcArn } } }));
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'EniPermission', actions: ['ec2:CreateNetworkInterfacePermission'], resources: [eniArn], conditions: { ArnEquals: { 'ec2:Subnet': subnetArns } } }));
+    // Logs: create/describe the configured group (spike: PREFLIGHT fails CLIENT_ERROR without CreateLogGroup on the group ARN).
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'LogsGroup', actions: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents', 'logs:DescribeLogStreams'], resources: [
+      // logGroupArn already ends in ':*', which does NOT match the bare group ARN
+      // CreateLogGroup is authorized against (the spike's second PREFLIGHT failure).
+      this.formatArn({ service: 'logs', resource: 'log-group', resourceName: logGroupName, arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME }),
+      agentLogs.logGroupArn,
+    ] }));
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'LogsDescribe', actions: ['logs:DescribeLogGroups'], resources: ['*'] }));
+    source.grantRead(role);
+    // Test actors (.prism/pentest.json "actors"): the agent reads their credentials with this role.
+    actorSecrets.forEach((arn, i) => (isCompleteSecretArn(arn)
+      ? secretsmanager.Secret.fromSecretCompleteArn(this, `ActorSecret${i}`, arn)
+      : secretsmanager.Secret.fromSecretPartialArn(this, `ActorSecret${i}`, arn)).grantRead(role));
+    if (actorLambdas.length) role.addToPolicy(new iam.PolicyStatement({ sid: 'ActorCredentials', actions: ['lambda:InvokeFunction'], resources: actorLambdas }));
+
+    const out = (oid: string, value: string) => new cdk.CfnOutput(this, oid, { value });
+    out('VpcArn', vpc.vpcArn);
+    out('SubnetArns', cdk.Fn.join(',', subnetArns));
+    out('AgentSecurityGroupArn', agentSgArn);
+    out('AlbDnsName', alb.loadBalancerDnsName);
+    out('PrivateHost', `app.${zoneName}`);
+    out('ServiceRoleArn', role.roleArn);
+    out('SourceBucket', source.bucketName);
+    out('AgentLogGroup', agentLogs.logGroupName);
+    out('TargetGroupArn', targetGroup.targetGroupArn);
+    out('AppLogGroup', appLogs.logGroupName);
+    out('ExpiresAt', new Date(Date.now() + ttlHours * 3_600_000).toISOString());
+  }
+}

package/dist/assets/pentest-cdk/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "prism-pentest-target-cdk",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "cdk": "cdk"
+  },
+  "dependencies": {
+    "aws-cdk-lib": "^2.265.0",
+    "constructs": "^10.4.2"
+  },
+  "devDependencies": {
+    "@types/node": "^20.17.0",
+    "aws-cdk": "^2.1000.0",
+    "ts-node": "^10.9.2",
+    "typescript": "~5.6.0"
+  }
+}

package/dist/assets/pentest-cdk/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "commonjs",
+    "moduleResolution": "node",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["bin/**/*.ts", "lib/**/*.ts"]
+}

package/dist/src/aws/advice.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The fixed mapping behind `prism-cli aws recommend`: one entry per check id
+ * aws check can return. A test fails when a check id has no entry.
+ *
+ * effort: quick = one command or console toggle; medium = a setup step that
+ * takes some decisions; large = a project (migrating users, redesigning access).
+ */
+export type Effort = 'quick' | 'medium' | 'large';
+export interface Advice {
+    title: string;
+    why: string;
+    steps: string[];
+    /** The prism-cli command that fixes it, when there is one. */
+    command?: string;
+    doc: string;
+    effort: Effort;
+    /** IAM actions the check reads; shown when the check was INDETERMINATE. */
+    needs?: string[];
+    /** Replaces the generic "grant read access" item when INDETERMINATE means something else. */
+    indeterminate?: string;
+    /** Checks with the same key are one fix in aws recommend (default: the check id). */
+    key?: string;
+    /** The key of a fix this check can only be judged after (INDETERMINATE for that reason points at it). */
+    prerequisite?: string;
+}
+/** Title and wording for a key that several checks share. `first` names the fix when another check waits on it. */
+export declare const GROUPS: Record<string, {
+    title: string;
+    why: string;
+    first: string;
+}>;
+export declare const ADVICE: Record<string, Advice>;
+//# sourceMappingURL=advice.d.ts.map

package/dist/src/aws/advice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advice.d.ts","sourceRoot":"","sources":["../../../src/aws/advice.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAElD,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,mHAAmH;AACnH,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAMhF,CAAC;AAiBF,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA0JzC,CAAC"}

package/dist/src/aws/advice.js

@@ -0,0 +1,174 @@
+/** Title and wording for a key that several checks share. `first` names the fix when another check waits on it. */
+export const GROUPS = {
+    budgets: {
+        title: 'Create AWS Budgets: one for all spend, plus filters for Bedrock and AWS Marketplace',
+        why: 'Without budgets unexpected spend raises no alert, and Bedrock\'s third-party models bill under Marketplace, so a Bedrock-only filter misses them.',
+        first: 'Create the budgets',
+    },
+};
+const IAM = 'https://docs.aws.amazon.com/IAM/latest/UserGuide';
+const COST = 'https://docs.aws.amazon.com/cost-management/latest/userguide';
+const BEDROCK = 'https://docs.aws.amazon.com/bedrock/latest/userguide';
+const GUIDE = 'https://github.com/aws-samples/sample-prism-d1-velocity/blob/main/USER_GUIDE.md';
+const CREDENTIAL_REPORT = ['iam:GetCredentialReport (the report must exist: run aws iam generate-credential-report once, or prism-cli bedrock-protection scan-account)'];
+const rootMfa = {
+    title: 'Add MFA to the root user', why: 'Root cannot be limited by SCPs or permission boundaries; without MFA a leaked root password is a full account takeover.',
+    steps: [
+        'Sign in as the root user.', 'Security credentials > Assign MFA device; prefer a FIDO2 security key.',
+        'In some managed or organization accounts the root user is controlled centrally; check with your account owner.',
+    ],
+    doc: `${IAM}/enable-mfa-for-root.html`, effort: 'quick', needs: ['iam:GetAccountSummary'],
+};
+export const ADVICE = {
+    // -- bedrock (bedrock-protection scan-account) ---------------------------------
+    'bedrock.root-mfa': rootMfa,
+    'bedrock.root-access-keys': {
+        title: 'Delete the root access keys', why: 'Root keys are long-lived and unconstrainable: the worst credential to leak.',
+        steps: ['Sign in as root > Security credentials > Access keys > Delete.', 'Move any automation that used them to an IAM role.'],
+        doc: `${IAM}/root-user-best-practices.html`, effort: 'quick', needs: ['iam:GetAccountSummary'],
+    },
+    'bedrock.password-policy': {
+        title: 'Set an account password policy', why: 'Without one only the AWS defaults apply (8 characters, no reuse rules).',
+        steps: ['aws iam update-account-password-policy --minimum-password-length 14 --require-symbols --require-numbers --password-reuse-prevention 24', 'Better: move console users to IAM Identity Center.'],
+        doc: `${IAM}/id_credentials_passwords_account-policy.html`, effort: 'quick', needs: ['iam:GetAccountPasswordPolicy'],
+    },
+    'bedrock.access-key-age': {
+        title: 'Rotate or remove long-lived access keys', why: 'Old static keys are what LLMjacking attackers steal and burn on Bedrock.',
+        steps: ['List the flagged keys (prism-cli bedrock-protection scan-account).', 'Replace each with a role (SSO, OIDC, instance profile), or rotate and delete the old key.'],
+        doc: `${IAM}/id_credentials_access-keys.html`, effort: 'medium', needs: CREDENTIAL_REPORT,
+    },
+    'bedrock.console-user-no-mfa': {
+        title: 'Require MFA for console users', why: 'A console password without MFA falls to phishing or reuse.',
+        steps: ['Assign an MFA device to each flagged user, or move them to IAM Identity Center.'],
+        doc: `${IAM}/id_credentials_mfa_enable.html`, effort: 'medium', needs: CREDENTIAL_REPORT,
+    },
+    'bedrock.unused-credentials': {
+        title: 'Remove unused credentials', why: 'Idle passwords and keys are attack surface nobody watches.',
+        steps: ['Deactivate the flagged passwords and keys, wait a week, then delete them.'],
+        doc: `${IAM}/id_credentials_finding-unused.html`, effort: 'quick', needs: CREDENTIAL_REPORT,
+    },
+    'bedrock.user-admin-policy': {
+        title: 'Take AdministratorAccess off IAM users', why: 'Any access key of such a user is an unbounded credential.',
+        steps: ['Create an admin role gated on MFA (or an Identity Center permission set).', 'Detach AdministratorAccess from the users.'],
+        doc: `${IAM}/best-practices.html`, effort: 'large', needs: ['iam:ListUsers', 'iam:ListAttachedUserPolicies'],
+    },
+    'bedrock.bedrock-budget': {
+        title: 'Add a budget that covers Bedrock', why: 'Runaway inference from a stolen key has no ceiling and raises no alert.',
+        steps: ['Billing > Budgets > Create a monthly COST budget filtered on Service contains "Bedrock".', 'Alert at 50/80/100% to an SNS topic.'],
+        doc: `${COST}/budgets-create.html`, effort: 'quick', needs: ['budgets:ViewBudget'], key: 'budgets',
+    },
+    'bedrock.marketplace-budget': {
+        title: 'Add a budget that covers AWS Marketplace (Bedrock Edition models)', why: 'Third-party models bill under Marketplace, so a Bedrock-only budget misses them.',
+        steps: ['Create a second COST budget filtered on Service = AWS Marketplace, or one Cost Category covering both.'],
+        doc: `${COST}/budgets-create.html`, effort: 'quick', needs: ['budgets:ViewBudget'], key: 'budgets',
+    },
+    'bedrock.budget-alerting': {
+        title: 'Make the Bedrock budgets notify someone', why: 'A budget with no subscriber records the overspend without telling anyone.',
+        steps: ['Add 50/80/100% notification thresholds with an SNS topic (or email) subscriber to each covering budget.'],
+        doc: `${COST}/budgets-sns-policy.html`, effort: 'quick', needs: ['budgets:ViewBudget'], prerequisite: 'budgets',
+    },
+    'bedrock.cost-explorer-enabled': {
+        title: 'Enable Cost Explorer', why: 'Anomaly detection and cost checks need it, and it stays off until someone turns it on.',
+        steps: ['Billing > Cost Explorer > Enable (data appears within 24 hours).'],
+        doc: `${COST}/ce-enable.html`, effort: 'quick', needs: ['ce:GetAnomalyMonitors'],
+    },
+    'bedrock.anomaly-monitor': {
+        title: 'Add a cost anomaly monitor with an alert subscription', why: 'It catches spend spikes a fixed budget threshold misses.',
+        steps: ['Billing > Cost Anomaly Detection > Create an AWS services monitor.', 'Add an alert subscription (SNS or email).'],
+        doc: `${COST}/getting-started-ad.html`, effort: 'quick', needs: ['ce:GetAnomalyMonitors', 'ce:GetAnomalySubscriptions'],
+    },
+    'bedrock.bedrock-invocation-alarm': {
+        title: 'Alarm on Bedrock invocation volume', why: 'Cost data lags up to a day; the AWS/Bedrock metrics are the only fast signal.',
+        steps: ['Create CloudWatch alarms on AWS/Bedrock Invocations and InputTokenCount above normal peak.'],
+        doc: `${BEDROCK}/monitoring.html`, effort: 'medium', needs: ['cloudwatch:DescribeAlarms'],
+    },
+    'bedrock.guardduty-ai-protection': {
+        title: 'Enable GuardDuty AI Protection', why: 'It detects cost-harvesting patterns against Bedrock.',
+        steps: ['Enable GuardDuty in the region if needed, then the AI_PROTECTION feature on the detector (org-wide from the delegated administrator if you can).'],
+        doc: 'https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html', effort: 'quick', needs: ['guardduty:ListDetectors', 'guardduty:GetDetector'],
+    },
+    'bedrock.provisioned-throughput': {
+        title: 'Review Provisioned Throughput commitments', why: 'A commitment bills whether or not it is used, and is a target for misuse.',
+        steps: ['Check each commitment is expected and owned; delete the ones nobody uses when their term allows.'],
+        doc: `${BEDROCK}/prov-throughput.html`, effort: 'medium', needs: ['bedrock:ListProvisionedModelThroughputs'],
+    },
+    'bedrock.model-invocation-logging': {
+        title: 'Turn on Bedrock model invocation logging', why: 'Without it you can see spend rose but not who or what caused it.',
+        steps: ['Bedrock console > Settings > Model invocation logging > CloudWatch Logs or S3.', 'Treat the destination as sensitive: it holds prompts and completions.'],
+        doc: `${BEDROCK}/model-invocation-logging.html`, effort: 'quick', needs: ['bedrock:GetModelInvocationLoggingConfiguration'],
+    },
+    // -- prism-setup -------------------------------------------------------------
+    'prism-setup.metrics-pipeline': {
+        title: 'Deploy the PRISM metrics pipeline', why: 'Without it CI and codeburn have nowhere to send PRISM metrics.',
+        steps: ['From the repo: cd infra && npm ci && npx cdk deploy PrismD1MetricsPipeline (see the workshop setup guide).'],
+        doc: `${GUIDE}`, effort: 'medium', needs: ['cloudformation:DescribeStacks'],
+    },
+    'prism-setup.security-agent-stack': {
+        title: 'Set up AWS Security Agent', why: 'The CI eval gate and the security commands need its stack.',
+        steps: ['Run the command below; it shows a diff and asks before any change.'], command: 'prism-cli enable security',
+        doc: `${GUIDE}#security-agent-setup-enable-security`, effort: 'quick', needs: ['cloudformation:DescribeStacks', 'cloudformation:GetTemplate'],
+    },
+    'prism-setup.security-agent-ssm': {
+        title: 'Restore the Security Agent SSM parameters', why: 'The CI gate and security commands find the agent space and scan bucket through /prism/continuum/*.',
+        steps: ['Run the command below (the stack owns these parameters; do not edit them by hand).'], command: 'prism-cli enable security',
+        doc: `${GUIDE}#security-agent-setup-enable-security`, effort: 'quick', needs: ['ssm:GetParameter', 'securityagent:ListAgentSpaces'],
+    },
+    'prism-setup.scan-bucket-listed': {
+        title: 'List the scan bucket on the Security Agent space', why: 'security threat-model fails when the agent space does not list the scan bucket.',
+        steps: ['Run the command below to update the stack.'], command: 'prism-cli enable security',
+        doc: `${GUIDE}#security-agent-setup-enable-security`, effort: 'quick', needs: ['securityagent:BatchGetAgentSpaces'],
+    },
+    'prism-setup.ci-oidc-role': {
+        title: 'Create the CI OIDC provider and role', why: 'CI should publish PRISM metrics with short-lived OIDC credentials, not stored keys.',
+        steps: ['Run the command below (or bootstrapper setup-gitlab-oidc for GitLab).', 'Set PRISM_METRICS_ROLE_ARN in the CI settings to the role it prints.'],
+        command: 'prism-cli bootstrapper setup-github-oidc', doc: GUIDE, effort: 'quick', needs: ['iam:ListOpenIDConnectProviders', 'iam:ListRoles'],
+    },
+    'prism-setup.codeburn-sync': {
+        title: 'Connect codeburn to the PRISM collector', why: 'This machine sends no AI usage telemetry to PRISM until codeburn sync is set up.',
+        steps: ['Run the command below; it installs codeburn if missing and schedules the sync.'], command: 'prism-cli enable codeburn',
+        doc: GUIDE, effort: 'quick', indeterminate: 'The codeburn sync config (~/.config/codeburn/sync.json) could not be read; check the file or re-run prism-cli enable codeburn.',
+    },
+    // -- baseline ----------------------------------------------------------------
+    'baseline.cloudtrail-multiregion': {
+        title: 'Log API activity in every region with a multi-region trail', why: 'Without it activity in other regions leaves no record for an investigation.',
+        steps: ['aws cloudtrail create-trail --name prism-audit --s3-bucket-name <bucket> --is-multi-region-trail', 'aws cloudtrail start-logging --name prism-audit', 'In an organization, prefer one organization trail from the management account.'],
+        doc: 'https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html', effort: 'medium', needs: ['cloudtrail:DescribeTrails', 'cloudtrail:GetTrailStatus'],
+    },
+    'baseline.guardduty': {
+        title: 'Enable GuardDuty', why: 'It is the managed threat detection for compromised credentials and instances.',
+        steps: ['aws guardduty create-detector --enable --region <region>', 'In an organization, enable it from a delegated administrator with auto-enable.'],
+        doc: 'https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html', effort: 'quick', needs: ['guardduty:ListDetectors', 'guardduty:GetDetector'],
+    },
+    'baseline.securityhub': {
+        title: 'Enable Security Hub', why: 'It runs the AWS Foundational Security Best Practices checks continuously and collects findings in one place.',
+        steps: ['Security Hub console > Enable, with the AWS Foundational Security Best Practices standard.'],
+        doc: 'https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html', effort: 'quick', needs: ['securityhub:DescribeHub'],
+    },
+    'baseline.access-analyzer': {
+        title: 'Create an IAM Access Analyzer', why: 'It flags buckets, roles and keys shared outside the account.',
+        steps: ['aws accessanalyzer create-analyzer --analyzer-name prism --type ACCOUNT --region <region>'],
+        doc: `${IAM}/access-analyzer-getting-started.html`, effort: 'quick', needs: ['access-analyzer:ListAnalyzers'],
+    },
+    'baseline.budget': {
+        title: 'Create an AWS Budget', why: 'Without a budget, unexpected spend raises no alert.',
+        steps: ['Billing > Budgets > Create a monthly cost budget for all services with 80% and 100% alerts.'],
+        doc: `${COST}/budgets-create.html`, effort: 'quick', needs: ['budgets:ViewBudget'], key: 'budgets',
+    },
+    'baseline.s3-account-bpa': {
+        title: 'Turn on S3 Block Public Access for the account', why: 'One misconfigured bucket policy or ACL is otherwise enough to publish data.',
+        steps: ['aws s3control put-public-access-block --account-id <account> --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true', 'First check no bucket needs public access on purpose.'],
+        doc: 'https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html', effort: 'quick', needs: ['s3:GetAccountPublicAccessBlock'],
+    },
+    'baseline.ebs-default-encryption': {
+        title: 'Encrypt new EBS volumes by default', why: 'Unencrypted volumes and snapshots can expose data when shared or copied.',
+        steps: ['aws ec2 enable-ebs-encryption-by-default --region <region> (applies to new volumes only).'],
+        doc: 'https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html', effort: 'quick', needs: ['ec2:GetEbsEncryptionByDefault'],
+    },
+    // -- startup-advisor ---------------------------------------------------------
+    'startup-advisor.not-integrated': {
+        title: 'Startup Advisor checks', why: 'Planned: PRISM will reuse Startup Advisor\'s account checks once how to consume them, and the license, are settled.',
+        steps: ['Nothing to do yet.'], doc: 'https://github.com/aws-samples/sample-prism-d1-velocity/blob/main/docs/PRISM-CLI-STATUS.md', effort: 'quick',
+        indeterminate: 'Not integrated yet; nothing to grant or fix.',
+    },
+};
+//# sourceMappingURL=advice.js.map

package/dist/src/aws/advice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advice.js","sourceRoot":"","sources":["../../../src/aws/advice.ts"],"names":[],"mappings":"AA2BA,mHAAmH;AACnH,MAAM,CAAC,MAAM,MAAM,GAAkE;IACnF,OAAO,EAAE;QACP,KAAK,EAAE,qFAAqF;QAC5F,GAAG,EAAE,mJAAmJ;QACxJ,KAAK,EAAE,oBAAoB;KAC5B;CACF,CAAC;AAEF,MAAM,GAAG,GAAG,kDAAkD,CAAC;AAC/D,MAAM,IAAI,GAAG,8DAA8D,CAAC;AAC5E,MAAM,OAAO,GAAG,sDAAsD,CAAC;AACvE,MAAM,KAAK,GAAG,iFAAiF,CAAC;AAChG,MAAM,iBAAiB,GAAG,CAAC,4IAA4I,CAAC,CAAC;AAEzK,MAAM,OAAO,GAAW;IACtB,KAAK,EAAE,0BAA0B,EAAE,GAAG,EAAE,yHAAyH;IACjK,KAAK,EAAE;QACL,2BAA2B,EAAE,wEAAwE;QACrG,gHAAgH;KACjH;IACD,GAAG,EAAE,GAAG,GAAG,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,uBAAuB,CAAC;CAC1F,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAA2B;IAC5C,iFAAiF;IACjF,kBAAkB,EAAE,OAAO;IAC3B,0BAA0B,EAAE;QAC1B,KAAK,EAAE,6BAA6B,EAAE,GAAG,EAAE,6EAA6E;QACxH,KAAK,EAAE,CAAC,gEAAgE,EAAE,oDAAoD,CAAC;QAC/H,GAAG,EAAE,GAAG,GAAG,gCAAgC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,uBAAuB,CAAC;KAC/F;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,gCAAgC,EAAE,GAAG,EAAE,yEAAyE;QACvH,KAAK,EAAE,CAAC,wIAAwI,EAAE,oDAAoD,CAAC;QACvM,GAAG,EAAE,GAAG,GAAG,+CAA+C,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,8BAA8B,CAAC;KACrH;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,yCAAyC,EAAE,GAAG,EAAE,0EAA0E;QACjI,KAAK,EAAE,CAAC,oEAAoE,EAAE,2FAA2F,CAAC;QAC1K,GAAG,EAAE,GAAG,GAAG,kCAAkC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB;KAC1F;IACD,6BAA6B,EAAE;QAC7B,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE,4DAA4D;QACzG,KAAK,EAAE,CAAC,iFAAiF,CAAC;QAC1F,GAAG,EAAE,GAAG,GAAG,iCAAiC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB;KACzF;IACD,4BAA4B,EAAE;QAC5B,KAAK,EAAE,2BAA2B,EAAE,GAAG,EAAE,4DAA4D;QACrG,KAAK,EAAE,CAAC,2EAA2E,CAAC;QACpF,GAAG,EAAE,GAAG,GAAG,qCAAqC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB;KAC5F;IACD,2BAA2B,EAAE;QAC3B,KAAK,EAAE,wCAAwC,EAAE,GAAG,EAAE,2DAA2D;QACjH,KAAK,EAAE,CAAC,2EAA2E,EAAE,4CAA4C,CAAC;QAClI,GAAG,EAAE,GAAG,GAAG,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,eAAe,EAAE,8BAA8B,CAAC;KAC7G;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,kCAAkC,EAAE,GAAG,EAAE,yEAAyE;QACzH,KAAK,EAAE,CAAC,0FAA0F,EAAE,sCAAsC,CAAC;QAC3I,GAAG,EAAE,GAAG,IAAI,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,SAAS;KACnG;IACD,4BAA4B,EAAE;QAC5B,KAAK,EAAE,mEAAmE,EAAE,GAAG,EAAE,kFAAkF;QACnK,KAAK,EAAE,CAAC,wGAAwG,CAAC;QACjH,GAAG,EAAE,GAAG,IAAI,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,SAAS;KACnG;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,yCAAyC,EAAE,GAAG,EAAE,2EAA2E;QAClI,KAAK,EAAE,CAAC,yGAAyG,CAAC;QAClH,GAAG,EAAE,GAAG,IAAI,0BAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,SAAS;KAChH;IACD,+BAA+B,EAAE;QAC/B,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,wFAAwF;QAC5H,KAAK,EAAE,CAAC,kEAAkE,CAAC;QAC3E,GAAG,EAAE,GAAG,IAAI,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,uBAAuB,CAAC;KACjF;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,uDAAuD,EAAE,GAAG,EAAE,0DAA0D;QAC/H,KAAK,EAAE,CAAC,oEAAoE,EAAE,2CAA2C,CAAC;QAC1H,GAAG,EAAE,GAAG,IAAI,0BAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,uBAAuB,EAAE,4BAA4B,CAAC;KACxH;IACD,kCAAkC,EAAE;QAClC,KAAK,EAAE,oCAAoC,EAAE,GAAG,EAAE,+EAA+E;QACjI,KAAK,EAAE,CAAC,4FAA4F,CAAC;QACrG,GAAG,EAAE,GAAG,OAAO,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,2BAA2B,CAAC;KAC1F;IACD,iCAAiC,EAAE;QACjC,KAAK,EAAE,gCAAgC,EAAE,GAAG,EAAE,sDAAsD;QACpG,KAAK,EAAE,CAAC,kJAAkJ,CAAC;QAC3J,GAAG,EAAE,wEAAwE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;KAC5J;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,2CAA2C,EAAE,GAAG,EAAE,2EAA2E;QACpI,KAAK,EAAE,CAAC,kGAAkG,CAAC;QAC3G,GAAG,EAAE,GAAG,OAAO,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,yCAAyC,CAAC;KAC7G;IACD,kCAAkC,EAAE;QAClC,KAAK,EAAE,0CAA0C,EAAE,GAAG,EAAE,kEAAkE;QAC1H,KAAK,EAAE,CAAC,gFAAgF,EAAE,uEAAuE,CAAC;QAClK,GAAG,EAAE,GAAG,OAAO,gCAAgC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC;KAC5H;IAED,+EAA+E;IAC/E,8BAA8B,EAAE;QAC9B,KAAK,EAAE,mCAAmC,EAAE,GAAG,EAAE,gEAAgE;QACjH,KAAK,EAAE,CAAC,4GAA4G,CAAC;QACrH,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,+BAA+B,CAAC;KAC5E;IACD,kCAAkC,EAAE;QAClC,KAAK,EAAE,2BAA2B,EAAE,GAAG,EAAE,4DAA4D;QACrG,KAAK,EAAE,CAAC,oEAAoE,CAAC,EAAE,OAAO,EAAE,2BAA2B;QACnH,GAAG,EAAE,GAAG,KAAK,uCAAuC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,+BAA+B,EAAE,4BAA4B,CAAC;KAC9I;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,2CAA2C,EAAE,GAAG,EAAE,oGAAoG;QAC7J,KAAK,EAAE,CAAC,oFAAoF,CAAC,EAAE,OAAO,EAAE,2BAA2B;QACnI,GAAG,EAAE,GAAG,KAAK,uCAAuC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,kBAAkB,EAAE,+BAA+B,CAAC;KACpI;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,kDAAkD,EAAE,GAAG,EAAE,iFAAiF;QACjJ,KAAK,EAAE,CAAC,4CAA4C,CAAC,EAAE,OAAO,EAAE,2BAA2B;QAC3F,GAAG,EAAE,GAAG,KAAK,uCAAuC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,mCAAmC,CAAC;KACpH;IACD,0BAA0B,EAAE;QAC1B,KAAK,EAAE,sCAAsC,EAAE,GAAG,EAAE,qFAAqF;QACzI,KAAK,EAAE,CAAC,uEAAuE,EAAE,sEAAsE,CAAC;QACxJ,OAAO,EAAE,0CAA0C,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,gCAAgC,EAAE,eAAe,CAAC;KAC7I;IACD,2BAA2B,EAAE;QAC3B,KAAK,EAAE,yCAAyC,EAAE,GAAG,EAAE,kFAAkF;QACzI,KAAK,EAAE,CAAC,gFAAgF,CAAC,EAAE,OAAO,EAAE,2BAA2B;QAC/H,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gIAAgI;KAC7K;IAED,+EAA+E;IAC/E,iCAAiC,EAAE;QACjC,KAAK,EAAE,4DAA4D,EAAE,GAAG,EAAE,6EAA6E;QACvJ,KAAK,EAAE,CAAC,kGAAkG,EAAE,iDAAiD,EAAE,gFAAgF,CAAC;QAChP,GAAG,EAAE,sGAAsG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,2BAA2B,EAAE,2BAA2B,CAAC;KACjM;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,+EAA+E;QAC/G,KAAK,EAAE,CAAC,0DAA0D,EAAE,gFAAgF,CAAC;QACrJ,GAAG,EAAE,0EAA0E,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;KAC9J;IACD,sBAAsB,EAAE;QACtB,KAAK,EAAE,qBAAqB,EAAE,GAAG,EAAE,8GAA8G;QACjJ,KAAK,EAAE,CAAC,4FAA4F,CAAC;QACrG,GAAG,EAAE,qFAAqF,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,yBAAyB,CAAC;KAChJ;IACD,0BAA0B,EAAE;QAC1B,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE,8DAA8D;QAC3G,KAAK,EAAE,CAAC,2FAA2F,CAAC;QACpG,GAAG,EAAE,GAAG,GAAG,uCAAuC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,+BAA+B,CAAC;KAC9G;IACD,iBAAiB,EAAE;QACjB,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,qDAAqD;QACzF,KAAK,EAAE,CAAC,6FAA6F,CAAC;QACtG,GAAG,EAAE,GAAG,IAAI,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,SAAS;KACnG;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,gDAAgD,EAAE,GAAG,EAAE,6EAA6E;QAC3I,KAAK,EAAE,CAAC,+LAA+L,EAAE,uDAAuD,CAAC;QACjQ,GAAG,EAAE,+FAA+F,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,gCAAgC,CAAC;KACjK;IACD,iCAAiC,EAAE;QACjC,KAAK,EAAE,oCAAoC,EAAE,GAAG,EAAE,0EAA0E;QAC5H,KAAK,EAAE,CAAC,2FAA2F,CAAC;QACpG,GAAG,EAAE,sEAAsE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,+BAA+B,CAAC;KACvI;IAED,+EAA+E;IAC/E,gCAAgC,EAAE;QAChC,KAAK,EAAE,wBAAwB,EAAE,GAAG,EAAE,qHAAqH;QAC3J,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,4FAA4F,EAAE,MAAM,EAAE,OAAO;QACjJ,aAAa,EAAE,8CAA8C;KAC9D;CACF,CAAC"}

package/dist/src/aws/check.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `prism-cli aws check`: read-only account checks on the audit framework
+ * (utils/audit.ts), in pluggable sections. A section is a name, a heading,
+ * the check ids it can return, and a run function; SECTIONS is the registry.
+ *
+ * Every AWS call here is a read. INDETERMINATE (a denied or failed read) is
+ * never counted as a pass.
+ */
+import { type AwsTarget } from '../utils/aws.js';
+import { type Finding, type Severity } from '../utils/audit.js';
+import { type Ctx, type Deps, type Resolved } from '../security/setup.js';
+export interface CheckContext {
+    target: AwsTarget;
+    account: string;
+    region: string;
+    home: string;
+    /** A read-only enable-security context, for the Security Agent rows. */
+    security: Ctx;
+}
+export interface CheckSection {
+    name: string;
+    heading: string;
+    /** Every check id run() can return (without the section prefix). */
+    ids: readonly string[];
+    run(c: CheckContext): Finding[];
+}
+/** `<section>.<id>`: one id space across sections (a check appears in one section only). */
+export declare const checkId: (section: string, id: string) => string;
+export declare const bedrockSection: CheckSection;
+export declare function metricsPipeline(c: CheckContext): Finding;
+/** Maps the enable security --status rows to findings. A row that never appeared (the report stopped) is INDETERMINATE. */
+export declare function securityAgent(c: CheckContext): Finding[];
+export declare function ciOidcRole(c: CheckContext): Finding;
+/** Local only: the endpoint codeburn syncs to (~/.config/codeburn/sync.json). No AWS call. */
+export declare function codeburnSync(c: CheckContext): Finding;
+export declare const prismSetupSection: CheckSection;
+export declare function cloudTrail(c: CheckContext): Finding;
+export declare function guardDuty(c: CheckContext): Finding;
+export declare function securityHub(c: CheckContext): Finding;
+export declare function accessAnalyzer(c: CheckContext): Finding;
+export declare function budget(c: CheckContext): Finding;
+export declare function s3PublicAccess(c: CheckContext): Finding;
+export declare function ebsEncryption(c: CheckContext): Finding;
+export declare const baselineSection: CheckSection;
+export declare const startupAdvisorSection: CheckSection;
+export declare const SECTIONS: CheckSection[];
+/** Every full check id any section can return. */
+export declare const ALL_CHECK_IDS: string[];
+/** The sections named by --section (all when none), or an error naming the valid ones. */
+export declare function selectSections(names: string[] | undefined): CheckSection[] | {
+    error: string;
+};
+export interface SectionCounts {
+    pass: number;
+    fail: number;
+    indeterminate: number;
+}
+export declare function countFindings(findings: Finding[]): SectionCounts;
+export declare function failBySeverity(findings: Finding[]): Record<Severity, number>;
+/** FAIL findings at or above `failOn` (none when failOn is null). */
+export declare function breaching(findings: Finding[], failOn: Severity | null): Finding[];
+/** A read-only enable-security context for collectSecurityStatus. Repo rows are skipped (git reports no repo). */
+export declare function securityContext(opts: Resolved, aws: Deps['aws'], env: NodeJS.ProcessEnv, awsVersion: () => string | null, log: (l?: string) => void): Ctx;
+//# sourceMappingURL=check.d.ts.map

package/dist/src/aws/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/aws/check.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAuB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAgB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG9E,OAAO,EACkC,KAAK,GAAG,EAAE,KAAK,IAAI,EAAE,KAAK,QAAQ,EAC1E,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,GAAG,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,EAAE,CAAC;CACjC;AAED,4FAA4F;AAC5F,eAAO,MAAM,OAAO,GAAI,SAAS,MAAM,EAAE,IAAI,MAAM,KAAG,MAA4B,CAAC;AAkBnF,eAAO,MAAM,cAAc,EAAE,YAS5B,CAAC;AAUF,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAQxD;AAED,2HAA2H;AAC3H,wBAAgB,aAAa,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,EAAE,CAqBxD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAanD;AAED,8FAA8F;AAC9F,wBAAgB,YAAY,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAMrD;AAED,eAAO,MAAM,iBAAiB,EAAE,YAK/B,CAAC;AAOF,wBAAgB,UAAU,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAgBnD;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAUlD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAQpD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAOvD;AAKD,wBAAgB,MAAM,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAM/C;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAQvD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAMtD;AAED,eAAO,MAAM,eAAe,EAAE,YAK7B,CAAC;AAKF,eAAO,MAAM,qBAAqB,EAAE,YASnC,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,YAAY,EAAgF,CAAC;AAEpH,kDAAkD;AAClD,eAAO,MAAM,aAAa,EAAE,MAAM,EAAoE,CAAC;AAEvG,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,YAAY,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAK9F;AAED,MAAM,WAAW,aAAa;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAEpF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,aAAa,CAMhE;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAI5E;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,EAAE,CAGjF;AAED,kHAAkH;AAClH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,GAAG,CAazJ"}