modelmoat 0.1.0__py3-none-any.whl

modelmoat/__init__.py

@@ -0,0 +1,3 @@
+"""modelmoat: static analysis for AI infrastructure security in Terraform."""
+
+__version__ = "0.1.0"

modelmoat/checks/__init__.py

@@ -0,0 +1,15 @@
+"""Check registry."""
+
+from .datastores import VectorDataStoreCheck
+from .iam import AIServiceIAMCheck
+from .network import AIVPCEndpointCheck
+from .s3 import ModelArtifactBucketCheck
+from .sagemaker import SageMakerNetworkCheck
+
+ALL_CHECKS = [
+    SageMakerNetworkCheck(),
+    AIServiceIAMCheck(),
+    ModelArtifactBucketCheck(),
+    AIVPCEndpointCheck(),
+    VectorDataStoreCheck(),
+]

modelmoat/checks/datastores.py

@@ -0,0 +1,270 @@
+"""VEC-001: vector and embedding data stores.
+
+Lane discipline: general IaC scanners already flag every unencrypted RDS
+instance on the internet. modelmoat only speaks up when the data store is
+plausibly holding AI data, and its messages never claim more than the
+configuration proves:
+
+  OpenSearch domains       always in scope (the managed vector engine)
+  RDS instances/clusters   in scope when the engine is Postgres-family
+                           (pgvector capable) or the name/tags are AI-related
+  ElastiCache              in scope only when the name/tags are AI-related
+
+Explicitly disabled settings (enabled = false) are treated exactly like
+missing ones, and values that come from variables are unknown and never
+flagged.
+"""
+
+from __future__ import annotations
+
+from ..graph import (
+    ProjectGraph,
+    Resource,
+    ai_tokens_in,
+    as_list,
+    first_block,
+    missing_or_false,
+    truthy,
+)
+from ..policy import allows_public_principal, parse_policy_document
+from ..scanner import Finding
+
+
+class VectorDataStoreCheck:
+    check_id = "VEC-001"
+    check_name = "Vector Data Store Missing Security Controls"
+
+    def run(self, graph: ProjectGraph) -> list[Finding]:
+        findings: list[Finding] = []
+        findings.extend(self._opensearch(graph))
+        findings.extend(self._rds(graph))
+        findings.extend(self._elasticache(graph))
+        return findings
+
+    # ------------------------------------------------------------------ #
+    # OpenSearch                                                          #
+    # ------------------------------------------------------------------ #
+    def _opensearch(self, graph: ProjectGraph) -> list[Finding]:
+        findings: list[Finding] = []
+
+        for domain in graph.by_type("aws_opensearch_domain", "aws_elasticsearch_domain"):
+            at_rest = first_block(domain.config, "encrypt_at_rest")
+            if at_rest is None or missing_or_false(at_rest.get("enabled")):
+                state = "explicitly disables" if at_rest is not None else "does not enable"
+                findings.append(
+                    self._finding(
+                        domain,
+                        "HIGH",
+                        f"OpenSearch domain '{domain.name}' {state} encryption at "
+                        "rest. Indexed documents and vector embeddings sit "
+                        "unencrypted on disk.",
+                        "Set encrypt_at_rest { enabled = true }, ideally with a "
+                        "customer managed KMS key.",
+                        "https://docs.aws.amazon.com/opensearch-service/latest/"
+                        "developerguide/encryption-at-rest.html",
+                    )
+                )
+
+            node_to_node = first_block(domain.config, "node_to_node_encryption")
+            if node_to_node is None or missing_or_false(node_to_node.get("enabled")):
+                findings.append(
+                    self._finding(
+                        domain,
+                        "MEDIUM",
+                        f"OpenSearch domain '{domain.name}' lacks node-to-node "
+                        "encryption, so traffic between cluster nodes travels in "
+                        "plaintext.",
+                        "Set node_to_node_encryption { enabled = true }.",
+                        "https://docs.aws.amazon.com/opensearch-service/latest/"
+                        "developerguide/ntn.html",
+                    )
+                )
+
+            vpc_options = first_block(domain.config, "vpc_options")
+            if vpc_options is None:
+                access_doc = parse_policy_document(domain.config.get("access_policies"))
+                if access_doc is not None and allows_public_principal(access_doc):
+                    findings.append(
+                        self._finding(
+                            domain,
+                            "CRITICAL",
+                            f"OpenSearch domain '{domain.name}' has no vpc_options and "
+                            'its access policy allows Principal "*". The domain '
+                            "endpoint is reachable from the internet with no IAM "
+                            "restriction, which is how vector databases end up in "
+                            "breach write-ups.",
+                            "Move the domain into a VPC with vpc_options, or at "
+                            "minimum restrict the access policy to specific "
+                            "principals and source conditions.",
+                            "https://docs.aws.amazon.com/opensearch-service/latest/"
+                            "developerguide/vpc.html",
+                        )
+                    )
+                else:
+                    findings.append(
+                        self._finding(
+                            domain,
+                            "HIGH",
+                            f"OpenSearch domain '{domain.name}' has no vpc_options, so "
+                            "its endpoint resolves publicly and reachability is "
+                            "governed only by the access policy and fine-grained "
+                            "access control.",
+                            "Add vpc_options with subnet_ids and security_group_ids "
+                            "so the domain is only reachable from your network.",
+                            "https://docs.aws.amazon.com/opensearch-service/latest/"
+                            "developerguide/vpc.html",
+                        )
+                    )
+            elif not as_list(vpc_options.get("security_group_ids")):
+                findings.append(
+                    self._finding(
+                        domain,
+                        "LOW",
+                        f"OpenSearch domain '{domain.name}' is in a VPC but sets no "
+                        "security_group_ids, so it silently uses the VPC default "
+                        "security group.",
+                        "Set security_group_ids explicitly and restrict ingress on "
+                        "443 to the application tiers that query the domain.",
+                        "https://docs.aws.amazon.com/opensearch-service/latest/"
+                        "developerguide/vpc.html",
+                    )
+                )
+
+        return findings
+
+    # ------------------------------------------------------------------ #
+    # RDS / Aurora (pgvector)                                             #
+    # ------------------------------------------------------------------ #
+    def _rds(self, graph: ProjectGraph) -> list[Finding]:
+        findings: list[Finding] = []
+
+        instances = graph.by_type("aws_db_instance", "aws_rds_cluster_instance")
+        clusters = graph.by_type("aws_rds_cluster")
+
+        for db in instances + clusters:
+            engine = str(db.config.get("engine", "")).lower()
+            postgres = "postgres" in engine
+            names = " ".join(
+                str(db.config.get(key, ""))
+                for key in ("identifier", "cluster_identifier", "db_name", "name")
+            )
+            tags = db.config.get("tags") or {}
+            tag_values = [str(v) for v in tags.values()] if isinstance(tags, dict) else []
+            relevant = postgres or ai_tokens_in(db.name, names, *tag_values)
+            if not relevant:
+                continue
+
+            data_note = (
+                "a pgvector-capable Postgres database"
+                if postgres
+                else "a database whose name or tags look AI related"
+            )
+
+            if truthy(db.config.get("publicly_accessible")):
+                findings.append(
+                    self._finding(
+                        db,
+                        "CRITICAL",
+                        f"'{db.name}' sets publicly_accessible = true on {data_note}. "
+                        "The instance gets a public IP and is reachable from the "
+                        "internet, guarded only by security groups and database "
+                        "credentials.",
+                        "Set publicly_accessible = false and place the database in "
+                        "private subnets. Reach it through VPC-connected "
+                        "applications or a bastion.",
+                        "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/"
+                        "USER_VPC.html",
+                    )
+                )
+
+            # storage_encrypted lives on aws_db_instance and aws_rds_cluster,
+            # not on cluster instances, which inherit it.
+            if db.type != "aws_rds_cluster_instance" and missing_or_false(
+                db.config.get("storage_encrypted")
+            ):
+                findings.append(
+                    self._finding(
+                        db,
+                        "HIGH",
+                        f"'{db.name}' does not enable storage_encrypted on "
+                        f"{data_note}. Embeddings and their source text would sit "
+                        "unencrypted at rest, and encryption cannot be enabled "
+                        "in place later.",
+                        "Set storage_encrypted = true, optionally with kms_key_id "
+                        "for a customer managed key.",
+                        "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/"
+                        "Overview.Encryption.html",
+                    )
+                )
+
+        return findings
+
+    # ------------------------------------------------------------------ #
+    # ElastiCache (Redis as a vector or embedding cache)                  #
+    # ------------------------------------------------------------------ #
+    def _elasticache(self, graph: ProjectGraph) -> list[Finding]:
+        findings: list[Finding] = []
+
+        caches = graph.by_type(
+            "aws_elasticache_replication_group", "aws_elasticache_cluster"
+        )
+        for cache in caches:
+            names = " ".join(
+                str(cache.config.get(key, ""))
+                for key in ("replication_group_id", "cluster_id", "description")
+            )
+            tags = cache.config.get("tags") or {}
+            tag_values = [str(v) for v in tags.values()] if isinstance(tags, dict) else []
+            if not ai_tokens_in(cache.name, names, *tag_values):
+                continue
+
+            if missing_or_false(cache.config.get("transit_encryption_enabled")):
+                findings.append(
+                    self._finding(
+                        cache,
+                        "HIGH",
+                        f"ElastiCache '{cache.name}' looks AI related but does not "
+                        "enable transit encryption, so embeddings and cached "
+                        "completions cross the network in plaintext.",
+                        "Set transit_encryption_enabled = true and require an "
+                        "auth_token or RBAC users.",
+                        "https://docs.aws.amazon.com/AmazonElastiCache/latest/"
+                        "red-ug/in-transit-encryption.html",
+                    )
+                )
+
+            if missing_or_false(cache.config.get("at_rest_encryption_enabled")):
+                findings.append(
+                    self._finding(
+                        cache,
+                        "MEDIUM",
+                        f"ElastiCache '{cache.name}' looks AI related but does not "
+                        "enable at-rest encryption.",
+                        "Set at_rest_encryption_enabled = true.",
+                        "https://docs.aws.amazon.com/AmazonElastiCache/latest/"
+                        "red-ug/at-rest-encryption.html",
+                    )
+                )
+
+        return findings
+
+    def _finding(
+        self,
+        resource: Resource,
+        severity: str,
+        message: str,
+        remediation: str,
+        docs_url: str,
+    ) -> Finding:
+        return Finding(
+            check_id=self.check_id,
+            check_name=self.check_name,
+            severity=severity,
+            resource_type=resource.type,
+            resource_name=resource.name,
+            file_path=str(resource.file),
+            line=resource.line,
+            message=message,
+            remediation=remediation,
+            docs_url=docs_url,
+        )

modelmoat/checks/iam.py

@@ -0,0 +1,178 @@
+"""IAM-001: blanket AI service permissions.
+
+Flags bedrock:* / sagemaker:* style actions granted on Resource "*", wherever
+the policy lives: inline aws_iam_role_policy, standalone aws_iam_policy,
+data.aws_iam_policy_document, or an attached AWS managed FullAccess policy.
+Roles are resolved across files, and findings name the Lambda functions that
+use the role so the blast radius is obvious.
+"""
+
+from __future__ import annotations
+
+from ..graph import ProjectGraph, Resource, extract_ref
+from ..policy import (
+    parse_policy_document,
+    raw_wildcard_scan,
+    risky_managed_policy,
+    statement_block_grants,
+    wildcard_ai_grants,
+)
+from ..scanner import Finding
+
+_DOCS = "https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html"
+_REMEDIATION = (
+    "Scope the policy to the specific actions and ARNs the workload needs, for "
+    "example bedrock:InvokeModel on the exact foundation model ARN. Wildcard "
+    "actions on Resource \"*\" let the principal invoke, create, or delete any "
+    "AI resource in the account."
+)
+
+
+class AIServiceIAMCheck:
+    check_id = "IAM-001"
+    check_name = "Blanket AI Service IAM Permissions"
+
+    def run(self, graph: ProjectGraph) -> list[Finding]:
+        findings: list[Finding] = []
+
+        roles = graph.by_type("aws_iam_role")
+        role_labels = {r.name for r in roles}
+        role_by_declared_name = {
+            str(r.config.get("name")): r.name
+            for r in roles
+            if isinstance(r.config.get("name"), str)
+        }
+
+        lambdas_by_role = self._lambdas_by_role(graph, role_by_declared_name)
+        data_docs = {d.name: d for d in graph.data_by_type("aws_iam_policy_document")}
+
+        def resolve_role(value) -> str | None:
+            label = extract_ref(value, "aws_iam_role")
+            if label:
+                return label
+            if isinstance(value, str):
+                if value in role_labels:
+                    return value
+                if value in role_by_declared_name:
+                    return role_by_declared_name[value]
+            return None
+
+        def usage(label: str | None) -> str:
+            names = lambdas_by_role.get(label or "", [])
+            if names:
+                return "used by Lambda function(s) " + ", ".join(sorted(names))
+            return "not attached to any Lambda function in the scanned files"
+
+        # Inline role policies.
+        for policy in graph.by_type("aws_iam_role_policy"):
+            matched = self._grants(policy.config.get("policy"), data_docs)
+            if not matched:
+                continue
+            label = resolve_role(policy.config.get("role"))
+            findings.append(
+                self._finding(
+                    policy,
+                    f"Inline policy '{policy.name}' on role "
+                    f"'{label or policy.config.get('role')}' grants "
+                    f"{', '.join(matched)} on Resource \"*\". The role is "
+                    f"{usage(label)}.",
+                )
+            )
+
+        # Standalone customer managed policies.
+        attachments = graph.by_type(
+            "aws_iam_role_policy_attachment", "aws_iam_policy_attachment"
+        )
+        attached_roles_by_policy: dict[str, set[str]] = {}
+        for attachment in attachments:
+            policy_label = extract_ref(attachment.config.get("policy_arn"), "aws_iam_policy")
+            if not policy_label:
+                continue
+            role_refs = [attachment.config.get("role")] + list(
+                attachment.config.get("roles") or []
+            )
+            for ref in role_refs:
+                label = resolve_role(ref)
+                if label:
+                    attached_roles_by_policy.setdefault(policy_label, set()).add(label)
+
+        for policy in graph.by_type("aws_iam_policy"):
+            matched = self._grants(policy.config.get("policy"), data_docs)
+            if not matched:
+                continue
+            attached = sorted(attached_roles_by_policy.get(policy.name, set()))
+            lam_names: list[str] = []
+            for label in attached:
+                lam_names.extend(lambdas_by_role.get(label, []))
+            if attached:
+                context = f"attached to role(s) {', '.join(attached)}"
+                if lam_names:
+                    context += f", used by Lambda function(s) {', '.join(sorted(set(lam_names)))}"
+            else:
+                context = "not attached to any role in the scanned files"
+            findings.append(
+                self._finding(
+                    policy,
+                    f"Managed policy '{policy.name}' grants {', '.join(matched)} on "
+                    f"Resource \"*\" and is {context}.",
+                )
+            )
+
+        # AWS managed FullAccess attachments. Matching is case-insensitive on
+        # both sides so mixed-case ARNs cannot slip past.
+        for attachment in attachments:
+            arn = attachment.config.get("policy_arn")
+            matched_name = risky_managed_policy(arn)
+            if not matched_name:
+                continue
+            label = resolve_role(attachment.config.get("role"))
+            findings.append(
+                self._finding(
+                    attachment,
+                    f"Role '{label or attachment.config.get('role')}' attaches AWS "
+                    f"managed policy '{arn}', which grants blanket AI service access. "
+                    f"The role is {usage(label)}.",
+                )
+            )
+
+        return findings
+
+    def _lambdas_by_role(
+        self, graph: ProjectGraph, role_by_declared_name: dict[str, str]
+    ) -> dict[str, list[str]]:
+        mapping: dict[str, list[str]] = {}
+        for function in graph.by_type("aws_lambda_function"):
+            role_value = function.config.get("role")
+            label = extract_ref(role_value, "aws_iam_role")
+            if not label and isinstance(role_value, str):
+                label = role_by_declared_name.get(role_value)
+            if label:
+                mapping.setdefault(label, []).append(function.name)
+        return mapping
+
+    def _grants(self, policy_value, data_docs: dict[str, Resource]) -> list[str]:
+        doc = parse_policy_document(policy_value)
+        if doc is not None:
+            return wildcard_ai_grants(doc)
+
+        data_label = extract_ref(policy_value, "data.aws_iam_policy_document") or extract_ref(
+            policy_value, "aws_iam_policy_document"
+        )
+        if data_label and data_label in data_docs:
+            return statement_block_grants(data_docs[data_label].config)
+
+        return raw_wildcard_scan(policy_value)
+
+    def _finding(self, resource: Resource, message: str) -> Finding:
+        return Finding(
+            check_id=self.check_id,
+            check_name=self.check_name,
+            severity="HIGH",
+            resource_type=resource.type,
+            resource_name=resource.name,
+            file_path=str(resource.file),
+            line=resource.line,
+            message=message,
+            remediation=_REMEDIATION,
+            docs_url=_DOCS,
+        )

modelmoat/checks/network.py

@@ -0,0 +1,148 @@
+"""VPC-001: AI service traffic without PrivateLink.
+
+VPC endpoints only matter for traffic that originates inside a VPC, so the
+check distinguishes two situations instead of shouting at both:
+
+  MEDIUM  a VPC-attached Lambda shows signals of calling Bedrock or SageMaker
+          and no matching interface endpoint exists anywhere in the project.
+          Depending on routing, those calls either fail or leave through a
+          NAT gateway to public AWS endpoints.
+  LOW     a Lambda with AI signals runs outside any VPC. Its traffic uses
+          public AWS endpoints, which are TLS plus IAM authenticated. That is
+          acceptable for many workloads and the finding says so.
+
+Endpoint matching is on the service fragment (".bedrock-runtime",
+".sagemaker.runtime"), so a service_name built from a region variable still
+matches and does not produce a false positive.
+"""
+
+from __future__ import annotations
+
+from ..graph import ProjectGraph, Resource, blocks, extract_ref
+from ..scanner import Finding
+
+_DOCS = "https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html"
+
+_SERVICES = {
+    "bedrock": ".bedrock-runtime",
+    "sagemaker": ".sagemaker.runtime",
+}
+
+
+class AIVPCEndpointCheck:
+    check_id = "VPC-001"
+    check_name = "AI Service Traffic Without PrivateLink"
+
+    def run(self, graph: ProjectGraph) -> list[Finding]:
+        findings: list[Finding] = []
+
+        endpoint_services = [
+            str(endpoint.config.get("service_name", "")).lower()
+            for endpoint in graph.by_type("aws_vpc_endpoint")
+        ]
+
+        def endpoint_exists(fragment: str) -> bool:
+            return any(fragment in service for service in endpoint_services)
+
+        role_signals = self._role_signals(graph)
+
+        for function in graph.by_type("aws_lambda_function"):
+            in_vpc = bool(blocks(function.config, "vpc_config"))
+            signals = self._function_signals(function, role_signals)
+
+            for service in sorted(signals):
+                fragment = _SERVICES[service]
+                if in_vpc and not endpoint_exists(fragment):
+                    findings.append(
+                        Finding(
+                            check_id=self.check_id,
+                            check_name=self.check_name,
+                            severity="MEDIUM",
+                            resource_type=function.type,
+                            resource_name=function.name,
+                            file_path=str(function.file),
+                            line=function.line,
+                            message=(
+                                f"Lambda '{function.name}' runs inside a VPC and shows "
+                                f"signals of calling {service}, but no interface VPC "
+                                f"endpoint matching '{fragment}' exists in the scanned "
+                                "files. Depending on routing, calls either fail or exit "
+                                "through NAT to public AWS endpoints."
+                            ),
+                            remediation=(
+                                "Add an aws_vpc_endpoint with vpc_endpoint_type "
+                                '"Interface" and service_name '
+                                f'"com.amazonaws.<region>{fragment}" in the same VPC, '
+                                "and allow the Lambda security group to reach it on 443."
+                            ),
+                            docs_url=_DOCS,
+                        )
+                    )
+                elif not in_vpc:
+                    findings.append(
+                        Finding(
+                            check_id=self.check_id,
+                            check_name=self.check_name,
+                            severity="LOW",
+                            resource_type=function.type,
+                            resource_name=function.name,
+                            file_path=str(function.file),
+                            line=function.line,
+                            message=(
+                                f"Lambda '{function.name}' shows signals of calling "
+                                f"{service} and is not attached to a VPC, so traffic "
+                                "uses public AWS endpoints. Those are TLS and IAM "
+                                "authenticated, which many workloads accept. For "
+                                "sensitive prompts or regulated data, keep the traffic "
+                                "on your private network."
+                            ),
+                            remediation=(
+                                "If this workload handles sensitive data, attach the "
+                                "Lambda to a VPC and add an interface endpoint for "
+                                f'"com.amazonaws.<region>{fragment}".'
+                            ),
+                            docs_url=_DOCS,
+                        )
+                    )
+
+        return findings
+
+    def _function_signals(
+        self, function: Resource, role_signals: dict[str, set[str]]
+    ) -> set[str]:
+        signals: set[str] = set()
+
+        for environment in blocks(function.config, "environment"):
+            variables = environment.get("variables")
+            if isinstance(variables, dict):
+                for key, value in variables.items():
+                    text = f"{key} {value}".lower()
+                    for service in _SERVICES:
+                        if service in text:
+                            signals.add(service)
+
+        role_label = extract_ref(function.config.get("role"), "aws_iam_role")
+        if role_label:
+            signals |= role_signals.get(role_label, set())
+
+        return signals
+
+    def _role_signals(self, graph: ProjectGraph) -> dict[str, set[str]]:
+        """Which AI services each role's policies mention, resolved cross-file."""
+        signals: dict[str, set[str]] = {}
+
+        def note(role_value, text: str) -> None:
+            label = extract_ref(role_value, "aws_iam_role")
+            if not label:
+                return
+            lowered = text.lower()
+            for service in _SERVICES:
+                if service in lowered:
+                    signals.setdefault(label, set()).add(service)
+
+        for policy in graph.by_type("aws_iam_role_policy"):
+            note(policy.config.get("role"), str(policy.config.get("policy", "")))
+        for attachment in graph.by_type("aws_iam_role_policy_attachment"):
+            note(attachment.config.get("role"), str(attachment.config.get("policy_arn", "")))
+
+        return signals