plexavo 0.2.5__tar.gz → 0.2.7__tar.gz

{plexavo-0.2.5 → plexavo-0.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plexavo
-Version: 0.2.5
+Version: 0.2.7
 Summary: Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else.
 Author: Kavee
 License: AGPL-3.0-or-later
@@ -53,14 +53,14 @@ can read, and it's entirely optional. See [Cost](#cost).
 
 ## What it checks
 
-31 checks across 6 categories, run against real AWS accounts:
+32 checks across 6 categories, run against real AWS accounts:
 
 - **IAM**: privilege escalation paths, wildcard admin, cross-account
   trust, root usage, dormant credentials
 - **Network**: security groups and RDS instances exposed to the
   internet
 - **Storage**: public S3 buckets, via ACLs, bucket policies, or missing
-  Block Public Access
+  Block Public Access; buckets with no access logging configured
 - **Encryption**: unencrypted EBS volumes, RDS instances, S3 buckets
 - **Logging**: CloudTrail coverage and encryption, GuardDuty status
 - **Usage**: permissions granted but never used, roles nobody has
@@ -167,6 +167,14 @@ uv pip install -e .
 See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the pattern used to add a
 new check.
 
+## Break Plexavo
+
+Think you can make Plexavo miss something, or give confusing guidance?
+[Report it](../../issues/new?template=break-plexavo.yml). Every
+confirmed, genuinely new finding gets fixed and shipped, and you get a
+permanent credit in the [Hall of Bugs](HALL_OF_BUGS.md). No bounty,
+public credit only.
+
 ## Security
 
 Found a vulnerability in the tool itself, not a misconfiguration in your

{plexavo-0.2.5 → plexavo-0.2.7}/README.md

@@ -24,14 +24,14 @@ can read, and it's entirely optional. See [Cost](#cost).
 
 ## What it checks
 
-31 checks across 6 categories, run against real AWS accounts:
+32 checks across 6 categories, run against real AWS accounts:
 
 - **IAM**: privilege escalation paths, wildcard admin, cross-account
   trust, root usage, dormant credentials
 - **Network**: security groups and RDS instances exposed to the
   internet
 - **Storage**: public S3 buckets, via ACLs, bucket policies, or missing
-  Block Public Access
+  Block Public Access; buckets with no access logging configured
 - **Encryption**: unencrypted EBS volumes, RDS instances, S3 buckets
 - **Logging**: CloudTrail coverage and encryption, GuardDuty status
 - **Usage**: permissions granted but never used, roles nobody has
@@ -138,6 +138,14 @@ uv pip install -e .
 See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the pattern used to add a
 new check.
 
+## Break Plexavo
+
+Think you can make Plexavo miss something, or give confusing guidance?
+[Report it](../../issues/new?template=break-plexavo.yml). Every
+confirmed, genuinely new finding gets fixed and shipped, and you get a
+permanent credit in the [Hall of Bugs](HALL_OF_BUGS.md). No bounty,
+public credit only.
+
 ## Security
 
 Found a vulnerability in the tool itself, not a misconfiguration in your

{plexavo-0.2.5 → plexavo-0.2.7}/plexavo/__init__.py

@@ -4,4 +4,4 @@ Runs entirely with your own local AWS credentials. Nothing is sent to
 anyone else. See README.md for usage, or `plexavo scan --help`.
 """
 
-__version__ = "0.2.5"
+__version__ = "0.2.7"

{plexavo-0.2.5 → plexavo-0.2.7}/plexavo/checks/storage.py

@@ -1,4 +1,5 @@
-"""Category 3: Storage Exposure — checks 19-21, all Critical.
+"""Category 3: Storage Exposure — checks 19-22. 19-21 are Critical
+(public exposure); 22 is Medium (a visibility gap, not exposure itself).
 
 Scope note: check_19 checks BUCKET-level PublicAccessBlock only, per the
 blueprint's literal spec (GetBucketPublicAccessBlock). It does NOT check
@@ -127,8 +128,39 @@ def check_21_public_acl(s3, bucket_names: list) -> list[Finding]:
     return findings
 
 
+def check_22_access_logging_disabled(s3, bucket_names: list) -> list[Finding]:
+    """STOR-22: bucket has no server access logging configured.
+
+    GetBucketLogging always returns 200, even when logging was never set
+    up — the response body simply omits the 'LoggingEnabled' key in that
+    case. Unlike check_19's PublicAccessBlock, there's no distinct
+    "not configured" exception to catch here, confirmed against the real
+    S3 service model before writing this.
+
+    Medium, not Critical: this is a forensics gap, not an exposure by
+    itself — a bucket with logging off isn't more reachable than one with
+    it on, it's just unreviewable after the fact if something happens."""
+    findings = []
+    for name in bucket_names:
+        config = s3.get_bucket_logging(Bucket=name)
+        if "LoggingEnabled" in config:
+            continue
+        findings.append(Finding(
+            check_id="STOR-22",
+            title="S3 Bucket Access Logging Not Enabled",
+            severity=Severity.MEDIUM,
+            resource_arn=f"arn:aws:s3:::{name}",
+            raw_detail=f"Bucket '{name}' has no server access logging configured. "
+                       f"If this bucket is ever accessed, modified, or exfiltrated "
+                       f"from, there is no record of who did what — investigation "
+                       f"after the fact isn't possible.",
+            account_context=f"bucket={name}",
+        ))
+    return findings
+
+
 def run_all(session) -> list[Finding]:
-    """Run STOR-19 through STOR-21 against every bucket in the account —
+    """Run STOR-19 through STOR-22 against every bucket in the account —
     not just testbed buckets. A real scan must check everything."""
     s3 = session.client("s3")
     bucket_names = list_buckets(s3)
@@ -136,4 +168,5 @@ def run_all(session) -> list[Finding]:
     findings += check_19_missing_public_access_block(s3, bucket_names)
     findings += check_20_public_bucket_policy(s3, bucket_names)
     findings += check_21_public_acl(s3, bucket_names)
+    findings += check_22_access_logging_disabled(s3, bucket_names)
     return findings

{plexavo-0.2.5 → plexavo-0.2.7}/plexavo/cli.py

@@ -83,7 +83,7 @@ def _build_parser() -> argparse.ArgumentParser:
                             "key. No key set, or a call fails for any reason? That finding falls back to raw "
                             "detail automatically, the scan never stops because of it. Off by default — without "
                             "it, findings still get free, no-API-key-needed remediation text wherever a template "
-                            "exists (10 common check types); --explain always uses live AI instead, for every "
+                            "exists (11 common check types); --explain always uses live AI instead, for every "
                             "finding, not just the non-templated ones.")
     scan.add_argument("--explain-limit", type=int, default=25,
                        help="Safety cap on how many findings get a live AI call when --explain is passed, in "
@@ -155,7 +155,7 @@ def _run_scan(args) -> None:
         stage("Running checks NET-01 through NET-04")
         findings += network_checks.run_all(session)
 
-        stage("Running checks STOR-19 through STOR-21")
+        stage("Running checks STOR-19 through STOR-22")
         findings += storage_checks.run_all(session)
 
         stage("Running checks ENC-29 through ENC-31")

{plexavo-0.2.5 → plexavo-0.2.7}/plexavo/report/ai_narration.py

@@ -172,7 +172,7 @@ def _parse_sections(raw_text: str) -> tuple[str, str, str]:
 
 
 # ---------------------------------------------------------------------------
-# Templates for the 10 most common, narratively-generic check types.
+# Templates for the 11 most common, narratively-generic check types.
 # Every specific fact (resource names, chain targets) already lives in
 # the Finding's own fields, computed deterministically in Python — the
 # template just substitutes them into fixed prose matching the same
@@ -373,6 +373,31 @@ def _template_enc29(f: Finding) -> Explanation:
     )
 
 
+def _template_log25(f: Finding) -> Explanation:
+    return Explanation(
+        impact=(
+            "GuardDuty is not enabled in this region, so there is no automated threat detection watching the "
+            "account. GuardDuty continuously analyzes CloudTrail, VPC flow logs, and DNS logs for known-bad "
+            "signals — an access key suddenly used from a new country or a Tor exit node, an EC2 instance "
+            "calling a known crypto-mining or malware domain, someone running account-wide recon with calls "
+            "like iam:ListUsers, ec2:DescribeInstances, and s3:ListAllMyBuckets in quick succession. With it "
+            "off, all of that happens with nothing raising an alert, so a compromise is usually only noticed "
+            "once it causes visible damage or a surprise bill."
+        ),
+        how_to_fix=(
+            "Enable GuardDuty in this region, then confirm the detector is active:\n"
+            "aws guardduty create-detector --enable\n"
+            "aws guardduty list-detectors\n"
+            "GuardDuty is per-region, so repeat this in every region you run workloads in, or enable it for "
+            "the whole organization from your AWS Organizations management account. It is free for the first "
+            "30 days, then billed on the volume of logs analyzed (typically a few dollars a month for a small "
+            "account)."
+        ),
+        next_step="Turn GuardDuty on in this region now: aws guardduty create-detector --enable",
+        source="template",
+    )
+
+
 COMMON_CHECK_TEMPLATES = {
     "IAM-01": _template_iam01,
     "IAM-06": _template_iam06,
@@ -384,18 +409,19 @@ COMMON_CHECK_TEMPLATES = {
     "NET-02": _template_net02,
     "STOR-19": _template_stor19,
     "ENC-29": _template_enc29,
+    "LOG-25": _template_log25,
 }
 
 
 def explain_finding(finding: Finding, client=None, use_ai: bool = False) -> Explanation | None:
     """use_ai=False (default): route to the free template (zero API cost,
-    zero network) for the 10 most common, narratively-generic check
+    zero network) for the 11 most common, narratively-generic check
     types; every other check returns None (raw finding detail only — no
     API call is ever attempted in this mode, regardless of whether a key
     is configured). This is the always-on baseline — no flag needed to
     get free remediation guidance where a template exists.
 
-    use_ai=True: every finding, including the 10 templated ones, is sent
+    use_ai=True: every finding, including the 11 templated ones, is sent
     to Claude instead — deliberately bypasses the template shortcut so
     "AI narration on" always means fully AI-written content, never a mix
     of template and AI.

{plexavo-0.2.5 → plexavo-0.2.7}/plexavo.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plexavo
-Version: 0.2.5
+Version: 0.2.7
 Summary: Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else.
 Author: Kavee
 License: AGPL-3.0-or-later
@@ -53,14 +53,14 @@ can read, and it's entirely optional. See [Cost](#cost).
 
 ## What it checks
 
-31 checks across 6 categories, run against real AWS accounts:
+32 checks across 6 categories, run against real AWS accounts:
 
 - **IAM**: privilege escalation paths, wildcard admin, cross-account
   trust, root usage, dormant credentials
 - **Network**: security groups and RDS instances exposed to the
   internet
 - **Storage**: public S3 buckets, via ACLs, bucket policies, or missing
-  Block Public Access
+  Block Public Access; buckets with no access logging configured
 - **Encryption**: unencrypted EBS volumes, RDS instances, S3 buckets
 - **Logging**: CloudTrail coverage and encryption, GuardDuty status
 - **Usage**: permissions granted but never used, roles nobody has
@@ -167,6 +167,14 @@ uv pip install -e .
 See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the pattern used to add a
 new check.
 
+## Break Plexavo
+
+Think you can make Plexavo miss something, or give confusing guidance?
+[Report it](../../issues/new?template=break-plexavo.yml). Every
+confirmed, genuinely new finding gets fixed and shipped, and you get a
+permanent credit in the [Hall of Bugs](HALL_OF_BUGS.md). No bounty,
+public credit only.
+
 ## Security
 
 Found a vulnerability in the tool itself, not a misconfiguration in your

{plexavo-0.2.5 → plexavo-0.2.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "plexavo"
-version = "0.2.5"
+version = "0.2.7"
 description = "Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else."
 readme = "README.md"
 license = { text = "AGPL-3.0-or-later" }

{plexavo-0.2.5 → plexavo-0.2.7}/tests/test_ai_narration_offline.py

@@ -73,7 +73,7 @@ assert_true(_short_name("arn:aws:iam::111111111111:role/my-role") == "my-role",
 assert_true(_short_name("arn:aws:s3:::my-bucket") == "my-bucket", "Extracts name after last : when no /")
 assert_true(_short_name("i-0abc123") == "i-0abc123", "Bare ID with no separators returned as-is")
 
-print("\n=== All 10 templates produce non-empty impact/next_step, with ZERO API contact ===")
+print("\n=== All 11 templates produce non-empty impact/next_step, with ZERO API contact ===")
 for check_id in COMMON_CHECK_TEMPLATES:
     finding = f(check_id)
     result = explain_finding(finding, client=ExplodingClient())
@@ -81,7 +81,19 @@ for check_id in COMMON_CHECK_TEMPLATES:
     assert_true(bool(result.impact.strip()), f"{check_id} impact is non-empty")
     assert_true(bool(result.how_to_fix.strip()), f"{check_id} how_to_fix is non-empty")
     assert_true(bool(result.next_step.strip()), f"{check_id} next_step is non-empty — this is new, every template must set it")
-assert_true(len(COMMON_CHECK_TEMPLATES) == 10, f"Exactly 10 templated checks exist (got {len(COMMON_CHECK_TEMPLATES)})")
+assert_true(len(COMMON_CHECK_TEMPLATES) == 11, f"Exactly 11 templated checks exist (got {len(COMMON_CHECK_TEMPLATES)})")
+
+print("\n=== LOG-25 (GuardDuty): account-level finding, template does not depend on a resource name ===")
+# LOG-25's real finding has resource_arn="account" — no per-resource
+# identifier to substitute, unlike bucket/volume/user templates. The
+# template must still produce complete, correct guidance.
+finding = f("LOG-25", resource_arn="account", raw_detail="GuardDuty is not enabled in this region.")
+result = explain_finding(finding, client=ExplodingClient())
+assert_true(result.source == "template", f"LOG-25 routes to template (got source={result.source})")
+assert_true("guardduty create-detector" in result.how_to_fix, "LOG-25 fix names the actual enable command")
+assert_true("guardduty create-detector" in result.next_step, "LOG-25 next_step names the actual enable command")
+assert_true("<PLACEHOLDER" not in result.how_to_fix and "<PLACEHOLDER" not in result.next_step,
+            "LOG-25 has no per-resource value to fill, so no placeholder should appear")
 
 print("\n=== Confidence/evidence are copied from the Finding, not decided by the template ===")
 finding = f("IAM-01", confidence="Likely — see note", evidence="Grant is scoped by a Condition block (aws:SourceIp)")

{plexavo-0.2.5 → plexavo-0.2.7}/tests/test_storage_offline.py

@@ -12,11 +12,12 @@ from plexavo.checks import storage
 
 
 class FakeS3:
-    def __init__(self, buckets, pab=None, policies=None, acls=None):
+    def __init__(self, buckets, pab=None, policies=None, acls=None, logging=None):
         self._buckets = buckets
         self._pab = pab or {}
         self._policies = policies or {}
         self._acls = acls or {}
+        self._logging = logging or {}
 
     def list_buckets(self):
         return {"Buckets": [{"Name": b} for b in self._buckets]}
@@ -34,6 +35,13 @@ class FakeS3:
     def get_bucket_acl(self, Bucket):
         return self._acls.get(Bucket, {"Grants": []})
 
+    def get_bucket_logging(self, Bucket):
+        # Real S3 behavior: always 200, 'LoggingEnabled' simply absent when
+        # logging was never configured — never raises.
+        if Bucket in self._logging:
+            return {"LoggingEnabled": self._logging[Bucket]}
+        return {}
+
 
 FULL_PAB = {"BlockPublicAcls": True, "IgnorePublicAcls": True, "BlockPublicPolicy": True, "RestrictPublicBuckets": True}
 
@@ -53,6 +61,7 @@ def run_checks(s3, buckets):
     findings += storage.check_19_missing_public_access_block(s3, buckets)
     findings += storage.check_20_public_bucket_policy(s3, buckets)
     findings += storage.check_21_public_acl(s3, buckets)
+    findings += storage.check_22_access_logging_disabled(s3, buckets)
     return findings
 
 
@@ -114,5 +123,23 @@ s3 = FakeS3(["owner-only-bucket"], pab={"owner-only-bucket": FULL_PAB}, acls={
 findings = run_checks(s3, ["owner-only-bucket"])
 assert_true(not any(f.check_id == "STOR-21" for f in findings), "Does NOT fire on an owner-only ACL grant")
 
+print("\n=== STOR-22: bucket has no access logging configured ===")
+s3 = FakeS3(["no-logging-bucket"], pab={"no-logging-bucket": FULL_PAB})
+findings = run_checks(s3, ["no-logging-bucket"])
+assert_true(any(f.check_id == "STOR-22" for f in findings), "Fires when access logging was never configured")
+
+print("\n=== FALSE POSITIVE GUARD: STOR-22 does not fire when access logging is enabled ===")
+s3 = FakeS3(["logged-bucket"], pab={"logged-bucket": FULL_PAB},
+            logging={"logged-bucket": {"TargetBucket": "log-archive", "TargetPrefix": "logged-bucket/"}})
+findings = run_checks(s3, ["logged-bucket"])
+assert_true(not any(f.check_id == "STOR-22" for f in findings), "Does NOT fire when LoggingEnabled is present")
+
+print("\n=== REGRESSION: reported bug (Hall of Bugs #1, found by ThePettyReviewer) — a bucket with logging genuinely off must be flagged ===")
+s3 = FakeS3(["reported-bucket"], pab={"reported-bucket": FULL_PAB})
+findings = run_checks(s3, ["reported-bucket"])
+matched = [f for f in findings if f.check_id == "STOR-22"]
+assert_true(bool(matched), "STOR-22 fires on a bucket with logging off (previously: no check existed at all, so nothing ever fired)")
+assert_true(bool(matched) and matched[0].severity.value == "Medium", "Severity is Medium — a visibility gap, not exposure like STOR-19/20/21")
+
 print(f"\n{'ALL PASSED' if failures == 0 else f'{failures} FAILURE(S)'}")
 sys.exit(1 if failures else 0)