cloud-audit 2.3.1__tar.gz → 2.5.0__tar.gz

{cloud_audit-2.3.1 → cloud_audit-2.5.0}/.github/workflows/ci.yml

@@ -15,8 +15,8 @@ jobs:
     name: Lint & Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v6
         with:
           python-version: "3.12"
           cache: "pip"
@@ -28,8 +28,8 @@ jobs:
     name: Type Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v6
         with:
           python-version: "3.12"
           cache: "pip"
@@ -43,8 +43,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: "pip"
@@ -55,6 +55,6 @@ jobs:
     name: Docker Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
       - run: docker build -t cloud-audit:test .
       - run: docker run --rm cloud-audit:test version

{cloud_audit-2.3.1 → cloud_audit-2.5.0}/.github/workflows/docs.yml

@@ -15,8 +15,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - run: pip install mkdocs-material

{cloud_audit-2.3.1 → cloud_audit-2.5.0}/.github/workflows/example-scan.yml

@@ -27,7 +27,7 @@ jobs:
     name: cloud-audit scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:

{cloud_audit-2.3.1 → cloud_audit-2.5.0}/.github/workflows/release.yml

@@ -18,8 +18,8 @@ jobs:
     needs: ci
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v6
         with:
           python-version: "3.12"
       - name: Verify tag matches package version
@@ -51,7 +51,7 @@ jobs:
         with:
           name: dist
           path: dist/
-      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
 
   docker:
     name: Publish Docker image
@@ -61,17 +61,17 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
-      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6.2.0
         id: meta
         with:
           images: |
@@ -81,7 +81,7 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=raw,value=latest
-      - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f  # v7.1.0
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           push: true
@@ -95,7 +95,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v6
       - name: Extract changelog for this version
         id: changelog
         run: |

{cloud_audit-2.3.1 → cloud_audit-2.5.0}/CHANGELOG.md

@@ -7,6 +7,187 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.5.0] - 2026-09-08
+
+### Added
+
+- **`cloud-audit agent-blast`** - what can a hijacked AI agent reach in your
+  AWS account, and can you prove it? For every Bedrock Agent, AgentCore runtime,
+  gateway, code interpreter and browser discovered by `scan`, answers under two
+  threat models: *identity takeover* (the attacker holds the credentials of a
+  role the agent runs as: full role, escalation methods, AssumeRole hops) and
+  *behaviour takeover* (prompt injection steering the agent's tools, bounded by
+  the tools' own execution roles). Reach covers S3, Secrets Manager, SSM,
+  DynamoDB, RDS Data API, KMS, SQS, Lambda invoke/code, AssumeRole and Bedrock
+  model invocation; the agent's own knowledge-base buckets are concrete targets
+  even under wildcard grants (write access there is flagged as RAG poisoning).
+  Findings carry OWASP Top 10 for Agentic Applications (2026) and MITRE ATLAS
+  (v2026.08) identifiers. Output: tree, JSON, Markdown. Pure in-memory analysis
+  of the saved scan. `--verify` asks the read-only IAM policy simulator about
+  every concrete (principal, action, resource) and every escalation path.
+- **AI agent identity inventory** - `scan` now records `agents` on the report:
+  Bedrock Agents (resource role, action groups at DRAFT version resolved to the
+  Lambda execution role, knowledge bases resolved to S3 data-source buckets)
+  and AgentCore (runtime role and network mode, gateway role with authorizer,
+  policy engine and targets, code interpreter and browser execution roles).
+  Read-only list/get calls, no charge. A denied read is recorded as a coverage
+  gap, never as "no agents here".
+- **Policy grants for agent identities** - `report.principal_grants` keeps the
+  raw `(action, resource, effect, condition-flag, source)` statements for agent
+  roles and their tools' roles only. Conditions are flagged, not evaluated; the
+  IAM policy simulator decides.
+- **Coverage gaps** - `CheckResult.coverage_gaps` and `summary.coverage_gaps`.
+  AgentCore checks now record an `AccessDenied` as "not assessed in this
+  region" (console, JSON, Markdown) instead of silently skipping the region.
+  A pass with gaps is not a clean pass.
+- **Proof Mode per resource** - `proof.verify_resource_access` simulates one
+  action against concrete resource ARNs with optional context keys
+  (`ATTACKER_CONTEXT_ENTRIES`: no MFA on the session, TLS transport), reports
+  which policy layer denied (SCP, permissions boundary) and follows result
+  pagination.
+- **Sample scan through the real engines** - `cloud-audit demo` now renders an
+  invented account through the actual correlation, root-cause, breach-cost and
+  security-graph engines instead of printing canned text; `demo --save FILE`
+  writes it as a scan report so `blast-radius`, `agent-blast`, `simulate`,
+  `exposure` and `diff` can be tried offline, and `agent-blast --demo` needs no
+  file at all. The sample includes a Bedrock Agent, an AgentCore runtime, a
+  gateway with Lambda and remote-MCP targets and a code interpreter.
+- **MCP tool `get_agent_blast`** - the agent-blast report (Markdown) for every
+  agent in the last scan, or one agent by name, id or ARN substring.
+
+### Fixed
+
+- The MCP SDK dependency is pinned to `mcp>=1.20,<2`. The `mcp` 2.x line
+  (released 2026-07-28) moved `FastMCP` out of `mcp.server.fastmcp`, so a fresh
+  `pip install cloud-audit` resolved to 2.x and `cloud-audit-mcp` failed to
+  import. The 1.x line is still maintained (1.30.0 on 2026-09-07); 2.x support
+  is a follow-up.
+- `simulate` reported relationship-based chains (`AC-01` internet-exposed admin
+  instance, `AC-07` OIDC to admin) as broken by any fix, because re-detection
+  from findings alone cannot see EC2-to-role and OIDC-to-policy relationships a
+  saved scan does not carry. A chain now survives a simulated fix unless one of
+  its own findings was fixed, and the remaining risk exposure is priced
+  accordingly.
+- `blast-radius` (tree output) crashed on Windows consoles with `cp1250`
+  encoding, and rendered emoji elsewhere, when a node label contained an ARN
+  segment such as `:secret:`: Rich interpreted it as an emoji shortcode.
+  Tree labels are now rendered with emoji disabled. `agent-blast` uses the same
+  renderer.
+
+### Changed
+
+- Proof Mode documentation now reflects the IAM policy simulator as of
+  2026-07-30: the attached permissions boundary and the organization's SCPs
+  (including their condition keys and resource scoping) are evaluated; RCPs,
+  VPC endpoint policies, role chaining and resource-based policies for IAM
+  roles are not. The "verified" detail text says so.
+- `blast-radius` labels IAM principals as `role/<name>` / `user/<name>` instead
+  of a truncated account prefix.
+- README rewritten around `agent-blast`, with every sample block taken from the
+  commands' real output on the built-in sample scan.
+
+## [2.4.0] - 2026-06-30
+
+### Added
+
+- **Data Perimeter Scanner** - new check category (`aws-dp-001` .. `aws-dp-005`)
+  that evaluates resource-based policies for the two boundary failures detectable
+  from a single account's configuration - read-only, and without AWS Organizations
+  access:
+
+  - **Confused deputy**: an `Allow` statement grants an AWS service principal
+    without an `aws:SourceAccount` / `aws:SourceArn` / `aws:SourceOrgID` /
+    `aws:SourceOwner` condition (`MEDIUM`). A service acting on behalf of another
+    account could be coerced into operating on your resource.
+  - **Cross-organization exposure**: an `Allow` statement grants a wildcard
+    (`"*"`) or external-account AWS principal without an organization-boundary
+    condition (`aws:PrincipalOrgID`, `aws:ResourceOrgID`, `aws:SourceOrgID`, ...).
+    Wildcard grants are `HIGH`; a named external account is `LOW` (often an
+    intentional partner share). On Secrets Manager these are escalated to
+    `CRITICAL` (wildcard) / `MEDIUM` (external) as a direct credential-exfiltration
+    path.
+
+  Services covered: S3 bucket policies (`aws-dp-001`), SNS topic policies
+  (`aws-dp-002`), SQS queue policies (`aws-dp-003`), Secrets Manager resource
+  policies (`aws-dp-004`), and Lambda resource policies (`aws-dp-005`). Every
+  finding ships CLI + Terraform remediation and a breach-cost estimate. Condition
+  keys are matched case-insensitively, and condition **values** are evaluated (not
+  just key presence) - a guardrail scoped to a *foreign* account or org is still
+  flagged. Default SNS/SQS policies relying on `aws:SourceOwner` set to the owner
+  account are correctly treated as account-scoped (no false positive). Federated
+  provider ARNs in a foreign account are flagged as external; federated URL IdPs
+  and `CanonicalUser` principals are out of scope.
+
+  This closes a gap the dominant open-source scanner explicitly does not cover
+  (Prowler issue #7114, "Integrating SCP/RCP Policy Awareness", open since
+  2025-03): evaluating data-perimeter condition keys on resource policies. SCP/RCP
+  enforcement at the AWS Organizations level is intentionally out of scope.
+  Detection taxonomy follows the AWS data perimeter whitepaper and the AWS
+  cross-service confused-deputy guidance.
+
+- **Proof Mode** - new opt-in `scan --verify` that cross-checks each detected IAM
+  privilege-escalation path against the read-only `iam:SimulatePrincipalPolicy`
+  API to confirm the principal's policies actually allow the required actions. Each
+  path is annotated `verified` with `verification_detail` evidence: `true` = the
+  simulator allowed every required action (policy-allowed; *simulated, not
+  executed*); `false` = the simulator denied one (the static path is likely a
+  false positive); `null` = not asserted. The scan prints
+  `Proof Mode: N/M escalation path(s) policy-allowed by IAM simulator`. Honest
+  framing throughout: this confirms the permission exists, not end-to-end
+  exploitability - the simulator does not factor in SCPs, permission boundaries,
+  resource policies, or trust conditions. Resource-scoped methods (`iam:PassRole`,
+  `sts:AssumeRole`, compute-hijack) are deliberately left `null` because without
+  resource ARNs the simulator evaluates against `*` and would over-report; paths
+  gated by unevaluated condition keys are also left `null`.
+  `iam:SimulatePrincipalPolicy` has no per-call charge, so the opt-in controls
+  latency/throttling only; calls are deduplicated per (principal, action-set). New
+  module `proof.py`; `EscalationPath` gains `verified` / `verification_detail`
+  (backward compatible, default unchecked). Brings the 2026 "proof, not
+  probability" validation trend - which commercial scanners sell as a paid
+  flagship - to open-source AWS.
+
+- **AgentCore checks** - first OSS scanner with dedicated Amazon Bedrock AgentCore
+  (GA 2025-10) coverage: 6 read-only checks `aws-agc-001..006` over the AI agent
+  platform. Flags Code Interpreter / Runtime in PUBLIC network mode (egress
+  exfiltration), Runtime not enforcing MMDSv2 (metadata credential theft), Memory
+  without a customer-managed KMS key, Gateway with no inbound authorizer
+  (`authorizerType=NONE`), and Gateway with no enforcing policy engine (missing or
+  `LOG_ONLY`). Each finding ships a CLI + Terraform fix and breach-cost estimate,
+  and maps to Palo Alto Unit 42 "Cracks in the Bedrock" research. Read-only
+  `bedrock-agentcore-control` (no per-call charge); the service is regional and
+  absent regions are skipped silently. New module `agentcore.py`; field names,
+  operations and enum values verified against the live boto3 service model.
+
+### Changed
+
+- Check count: 99 -> 110 (across 25 services). AgentCore adds a new service module
+  of 6 checks; the data perimeter's 5 checks remain a cross-cutting category over
+  existing services, like Threat Feed.
+
+### Tests
+
+- 836 -> 948 (+112). New file `tests/aws/test_data_perimeter.py`: 43 unit tests
+  pinning the `_find_perimeter_gaps` detection engine (confused deputy, cross-org
+  wildcard/external, condition-value evaluation so a guardrail pointing at a
+  foreign account/org is still flagged, federated provider ARNs, case-insensitive
+  conditions, Deny/NotPrincipal/CanonicalUser/malformed handling) plus 17 moto
+  integration tests across all five services. New file `tests/test_proof.py`:
+  28 tests pinning the Proof Mode engine (decision semantics: allowed /
+  explicit+implicit deny / unknown-decision / incomplete / empty / malformed; the
+  resource-scoping gate that leaves PassRole/AssumeRole and deny-removal paths
+  unasserted; condition-key gating; API-call dedup; per-path error isolation;
+  provider-backed path). New file `tests/aws/test_agentcore.py`: 24 fixture-based
+  tests (moto lacks bedrock-agentcore-control) covering each check's positive and
+  negative cases across network mode, MMDSv2, memory KMS, gateway authorizer and
+  policy engine, empty policy config, multi-page pagination, plus
+  region-unavailable / access-denied skip and multi-region aggregation.
+
+### Compliance
+
+- `aws-dp-001` .. `aws-dp-005` mapped: SOC 2 (CC5.2, CC6.1, CC6.6, C1.1),
+  CIS AWS v3.0 (2.1.4), HIPAA (164.308(a)(1)(ii)(A), 164.312(a)(1)),
+  ISO/IEC 27001:2022 (A.8.3, A.8.12), NIS2 (NIS2-RM-09a), BSI C5:2020 (IDM-07).
+
 ## [2.3.1] - 2026-05-26
 
 ### Added