nsauditor-ai 0.2.48 → 0.2.49

package/README.md

@@ -17,6 +17,22 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
+**Sovereign and air-gapped AWS partitions stop being mistaken for commercial (CE 0.2.49 / Enterprise 0.42.0).**
+This one DOES change CE behaviour, and Enterprise now requires it (`>=0.2.49`). `detectPartition`
+tested only `cn-` and `us-gov-` before falling through to `'aws'`, so every ISO and European
+Sovereign region resolved to the commercial partition — downstream, an ISO account inherited the 32
+commercial regions as its static fallback and the scan-scope disclosure reported that as its
+denominator. No ISO region ids are enumerated to fix it: the new rule is structural over the region-id
+prefix, the static fallback for those partitions is EMPTY, and the live `DescribeRegions` path stays
+the only source of truth. Separately, `NSA_ENV_FILE` now clears ambient Azure cloud selectors
+(`AZURE_ENVIRONMENT`, `ARM_ENVIRONMENT`, `AZURE_ARM_ENDPOINT`, `AZURE_AUTHORITY_HOST`) — the env file
+is the scan-target selector, and a subscription id and the cloud whose ARM hosts it are one selection,
+not two. What Enterprise adds in the pair: GovCloud/partition correctness across 19 executable
+defects, Azure sovereign-cloud addressing that refuses rather than silently scanning commercial, an
+SBOM generated over the package you actually install, and a FIPS posture statement that claims
+approved *algorithms* and explicitly not a validated *module*. Plugin counts unchanged — 27 Community
+scanners, 29 Enterprise plugins, 56 with a licence active; all eight coverage matrices UNCHANGED.
+
 **The 29th Enterprise plugin: Amazon DocumentDB (CE 0.2.48 / Enterprise 0.41.0).** No CE behaviour
 change and **the peer floor stays `>=0.2.45`, unraised** — nothing in this cycle needs new Community
 Edition code; this bump pairs the npm-frozen page with Enterprise 0.41.0. What Enterprise adds, in
@@ -356,6 +372,7 @@ Results land in `./out/<host>_<timestamp>/`:
 | 1220 | Azure Storage Account Data-Protection (**EE 0.13.2**) | Enterprise | Dedicated Azure Storage Account encryption / transit / authorization auditor — orthogonal to the 1022 scanner's network-exposure dims (no double-emission; mirrors the AWS 1020 + 1120 two-plugin S3 split). HTTPS-only transit (`enableHttpsTrafficOnly`) + minimum TLS version + Shared Key authorization (`allowSharedKeyAccess` — bypasses Azure AD; absent = enabled, never silent-PASS) + infrastructure (double) encryption + encryption key source incl. **customer-managed-key reachability + rotation** (`keyVaultProperties` — a disabled/revoked/version-pinned CMK degrades, not silent-PASS). Conservative classifier: indeterminate field / AccessDenied → evidence-gap; single-subscription scope surfaced explicitly. **CC6.7 / CC6.1 / C1.1** |
 | 1221 | Azure NSG Perimeter (**EE 0.14.0**; UDP lane **EE 0.14.1**) | Enterprise | The Azure analog of AWS 1170 — a CC6.6 network-segmentation perimeter auditor for Azure Network Security Groups. Evaluates each NSG's inbound rules in Azure priority order (first match wins; DenyAllInbound default): all-protocol public Allow + public-source (`*`/`0.0.0.0/0`/`Internet`) to a restricted **TCP** management/data-tier port (SSH/RDP/MSSQL/MySQL/Postgres/Redis/Mongo/SMB/WinRM/etc.) + `::/0` IPv6-wildcard to a restricted port (the dimension 1022's flat lint misses) + **public-source / `::/0` to a restricted UDP service** (SNMP/CLDAP/NTP/rpcbind/IPMI/IKE/Memcached etc. — Dim 2u/3u, EE 0.14.1) + public→non-restricted INFO + PASS substrate. **Attachment-aware** (attached → CRITICAL effective; orphaned → MEDIUM latent) + effective priority/deny-override resolution + `0.0.0.0/1` split-range coverage. Non-overlapping-by-depth with 1022's coarse per-rule NSG lint. Conservative classifier: denied/indeterminate → evidence-gap; one malformed NSG degrades per-resource. **CC6.6** |
 | 1222 | Azure Key Vault Deep Auditor (**EE 0.15.0**) | Enterprise | The third dedicated Azure auditor (after 1220 storage + 1221 NSG) — the KV analog of how 1221 deepens 1022's flat NSG dim. Enumerates each vault's keys, role assignments, and diagnostic settings across 4 dims: (1) key **auto-rotation policy** + (2) key **expiry** (epoch-s/ms/Date/string coerced) + (3) **diagnostic logging → Log Analytics** (`@azure/arm-monitor`) + (4) **privileged-access depth** (RBAC `roleAssignments` admin/data-plane/scope-aware + legacy `accessPolicies` export/wide-crypto breadth). Orthogonal to 1022's vault-property dims (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission. Secret/cert expiry is a deliberate data-plane scope boundary. Conservative classifier: indeterminate field / AccessDenied / arm-monitor absent → evidence-gap; one malformed vault degrades per-resource. **CC6.3 / C1.1 / CC6.1 / CC7.2** |
+| 1230 | AWS DocumentDB Auditor (**EE 0.41.0**) | Enterprise | Amazon DocumentDB (MongoDB-compatible) cluster security — owns the `docdb` engine on the shared RDS control plane (plugin 1140 delegates it and discloses Neptune as unaudited). Seven dimensions: storage encryption at rest + KMS custody classification (customer-alias PASS / AWS-managed / foreign-account + key-UUID custody-unverifiable evidence gaps — encryption is fixed at cluster creation, so the emission gives a migration remediation, never an unrunnable in-place one) + `tls` cluster parameter (disabled = HIGH) + `audit_logs` + CloudWatch `audit` export (generating-but-unexported = MEDIUM) + backup retention vs the 7-day floor + deletion protection + replica/AZ availability topology under the CLUSTER lens (the per-instance Multi-AZ flag is RDS semantics and never consulted) + manual-snapshot public/cross-account restorability (`all` = CRITICAL). Non-docdb engines counted and skipped; DocumentDB Elastic clusters declared deferred; per-dimension fail-closed evidence gaps. **C1.1 / CC6.1 / CC6.6 / CC7.2 / A1.2** |
 | — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), SHA-256 chain-of-custody, opt-in RFC 3161 timestamps, exercised against a live TSA on both the npm path and the `:0.33.0` container image, and the suppression workflow. (Ed25519 SIGNING of suppressions is reachable from EE 0.35.0 and PROVEN at EE 0.36.0, verified per approver holding **key material**.) |
 | — | **HIPAA Compliance Engine (EE 0.9.0)** | Enterprise | HIPAA Security Rule §164.312 Technical Safeguards mapping (7 covered + 3 partial + 45 OOS within §164.312 + entire §164.308 + entire §164.310). HHS Required/Addressable discipline per control. Same evidence infrastructure as SOC 2 (SHA-256 chain-of-custody; opt-in RFC 3161 timestamps; suppression signing reachable from EE 0.35.0, proven at EE 0.36.0 and verified per approver holding **key material**). Use `--compliance hipaa` or `--compliance soc2,hipaa` for dual-framework reports from a single scan. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. |
 | — | **NIST CSF 2.0 Compliance Engine (EE 0.10.0)** | Enterprise | NIST Cybersecurity Framework 2.0 Core mapping at the auditor-canonical Subcategory level — 13 covered + 10 partial + 83 OOS across 106 of CSF 2.0's 107 Subcategories. Govern function OOS-by-design (GV.SC-04 partial as substrate exception); Respond function OOS-entirely; Implementation Tiers 1-4 OOS as organizational-maturity claims. NIST SP 800-53 Rev. 5 + CIS Critical Security Controls v8 cross-references baked into `informativeReferences`. Use `--compliance nist-csf` or `--compliance soc2,hipaa,nist-csf` for triple-framework reports from a single scan. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "Modular AI-assisted network security audit platform \u2014 Community Edition",
   "type": "module",
   "private": false,

package/utils/aws_regions.mjs

@@ -27,10 +27,43 @@ export const CANONICAL_REGIONS_BY_PARTITION = Object.freeze({
 
 export const CANONICAL_REGION_LIST_VERSION = '2026-05';
 
+// AWS ISO ("air-gapped") partition region-id prefixes. Matching these is a
+// STRUCTURAL rule over the region-id shape, not a transcribed region list — and
+// the distinction is the whole design. Before this, every ISO region fell through
+// to 'aws', so plugin 1040's `CANONICAL_REGIONS_BY_PARTITION[partition] || …aws`
+// handed an ISO account the 32 COMMERCIAL regions as its static fallback and
+// reported that count as `regionsTotal` in the scanScope disclosure — a
+// disclosure asserting the wrong denominator.
+//
+// ⚠️ NO ISO REGION IDS ARE ENUMERATED, DELIBERATELY. They are a datum this repo
+// holds no authority for, and a guessed list would put a wrong scan SCOPE into
+// the fallback, which is the SILENT direction. `regionsForPartition` returns the
+// frozen empty list for these keys, so an ISO account gets an EMPTY static
+// fallback and the live DescribeRegions path — correct in any partition — stays
+// its only source of truth. Incompleteness costs an empty scope and a visible
+// disclosure, never a wrong one. (EE F3 lane, 2026-08-27.)
+// Region-id prefixes for the partitions that carry NO canonical region list here
+// (see the note above: structural rules, never transcribed region ids).
+// `eusc-` is the European Sovereign Cloud, added after the ISO rule shipped —
+// without it an EUSC region detected as COMMERCIAL and took the 32-region static
+// fallback, re-entering the very defect the ISO rule had just closed, by
+// MISdetection rather than by fallback. Derivable: @aws-sdk/util-endpoints'
+// partitions.json gives aws-eusc the regionRegex ^eusc\-(de)\-\w+\-\d+$.
+const NON_ENUMERATED_REGION_PREFIXES = Object.freeze([
+  ['us-iso-', 'aws-iso'],
+  ['us-isob-', 'aws-iso-b'],
+  ['us-isof-', 'aws-iso-f'],
+  ['eu-isoe-', 'aws-iso-e'],
+  ['eusc-', 'aws-eusc'],
+]);
+
 export function detectPartition(region) {
   if (typeof region !== 'string' || region.length === 0) return 'aws';
   if (region.startsWith('cn-')) return 'aws-cn';
   if (region.startsWith('us-gov-')) return 'aws-us-gov';
+  for (const [prefix, partition] of NON_ENUMERATED_REGION_PREFIXES) {
+    if (region.startsWith(prefix)) return partition;
+  }
   return 'aws';
 }
 

package/utils/mcp_env_file.mjs

@@ -26,6 +26,16 @@ const PROVIDER_CRED_KEYS = [
   'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN', 'AWS_PROFILE',
   'GOOGLE_APPLICATION_CREDENTIALS', 'GOOGLE_CLOUD_PROJECT', 'GOOGLE_CLOUD_PROJECT_ID', 'GCLOUD_PROJECT',
   'AZURE_CLIENT_ID', 'AZURE_TENANT_ID', 'AZURE_CLIENT_SECRET', 'AZURE_SUBSCRIPTION_ID',
+  // Azure CLOUD SELECTORS. Credential-adjacent rather than credentials, and they
+  // belong here for the same anti-false-clean reason: the env file IS the
+  // scan-target selector, and a subscription id together with the cloud whose ARM
+  // hosts it are ONE selection, not two. Left ambient, a shell-profile
+  // AZURE_ENVIRONMENT or AZURE_ARM_ENDPOINT could redirect a scan the file
+  // selected to a different Azure cloud entirely, and AZURE_AUTHORITY_HOST is read
+  // by @azure/identity itself, so it can steer authentication with no code of ours
+  // involved. Added 2026-08-27 alongside the EE sovereign-cloud resolver
+  // (utils/azure_cloud.mjs), which is what made these reachable.
+  'AZURE_ENVIRONMENT', 'ARM_ENVIRONMENT', 'AZURE_ARM_ENDPOINT', 'AZURE_AUTHORITY_HOST',
 ];
 
 /**