plexavo 0.2.6__tar.gz → 0.2.7__tar.gz

{plexavo-0.2.6 → plexavo-0.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plexavo
-Version: 0.2.6
+Version: 0.2.7
 Summary: Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else.
 Author: Kavee
 License: AGPL-3.0-or-later
@@ -53,14 +53,14 @@ can read, and it's entirely optional. See [Cost](#cost).
 
 ## What it checks
 
-31 checks across 6 categories, run against real AWS accounts:
+32 checks across 6 categories, run against real AWS accounts:
 
 - **IAM**: privilege escalation paths, wildcard admin, cross-account
   trust, root usage, dormant credentials
 - **Network**: security groups and RDS instances exposed to the
   internet
 - **Storage**: public S3 buckets, via ACLs, bucket policies, or missing
-  Block Public Access
+  Block Public Access; buckets with no access logging configured
 - **Encryption**: unencrypted EBS volumes, RDS instances, S3 buckets
 - **Logging**: CloudTrail coverage and encryption, GuardDuty status
 - **Usage**: permissions granted but never used, roles nobody has
@@ -167,6 +167,14 @@ uv pip install -e .
 See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the pattern used to add a
 new check.
 
+## Break Plexavo
+
+Think you can make Plexavo miss something, or give confusing guidance?
+[Report it](../../issues/new?template=break-plexavo.yml). Every
+confirmed, genuinely new finding gets fixed and shipped, and you get a
+permanent credit in the [Hall of Bugs](HALL_OF_BUGS.md). No bounty,
+public credit only.
+
 ## Security
 
 Found a vulnerability in the tool itself, not a misconfiguration in your

{plexavo-0.2.6 → plexavo-0.2.7}/README.md

@@ -24,14 +24,14 @@ can read, and it's entirely optional. See [Cost](#cost).
 
 ## What it checks
 
-31 checks across 6 categories, run against real AWS accounts:
+32 checks across 6 categories, run against real AWS accounts:
 
 - **IAM**: privilege escalation paths, wildcard admin, cross-account
   trust, root usage, dormant credentials
 - **Network**: security groups and RDS instances exposed to the
   internet
 - **Storage**: public S3 buckets, via ACLs, bucket policies, or missing
-  Block Public Access
+  Block Public Access; buckets with no access logging configured
 - **Encryption**: unencrypted EBS volumes, RDS instances, S3 buckets
 - **Logging**: CloudTrail coverage and encryption, GuardDuty status
 - **Usage**: permissions granted but never used, roles nobody has
@@ -138,6 +138,14 @@ uv pip install -e .
 See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the pattern used to add a
 new check.
 
+## Break Plexavo
+
+Think you can make Plexavo miss something, or give confusing guidance?
+[Report it](../../issues/new?template=break-plexavo.yml). Every
+confirmed, genuinely new finding gets fixed and shipped, and you get a
+permanent credit in the [Hall of Bugs](HALL_OF_BUGS.md). No bounty,
+public credit only.
+
 ## Security
 
 Found a vulnerability in the tool itself, not a misconfiguration in your

{plexavo-0.2.6 → plexavo-0.2.7}/plexavo/__init__.py

@@ -4,4 +4,4 @@ Runs entirely with your own local AWS credentials. Nothing is sent to
 anyone else. See README.md for usage, or `plexavo scan --help`.
 """
 
-__version__ = "0.2.6"
+__version__ = "0.2.7"

{plexavo-0.2.6 → plexavo-0.2.7}/plexavo/checks/storage.py

@@ -1,4 +1,5 @@
-"""Category 3: Storage Exposure — checks 19-21, all Critical.
+"""Category 3: Storage Exposure — checks 19-22. 19-21 are Critical
+(public exposure); 22 is Medium (a visibility gap, not exposure itself).
 
 Scope note: check_19 checks BUCKET-level PublicAccessBlock only, per the
 blueprint's literal spec (GetBucketPublicAccessBlock). It does NOT check
@@ -127,8 +128,39 @@ def check_21_public_acl(s3, bucket_names: list) -> list[Finding]:
     return findings
 
 
+def check_22_access_logging_disabled(s3, bucket_names: list) -> list[Finding]:
+    """STOR-22: bucket has no server access logging configured.
+
+    GetBucketLogging always returns 200, even when logging was never set
+    up — the response body simply omits the 'LoggingEnabled' key in that
+    case. Unlike check_19's PublicAccessBlock, there's no distinct
+    "not configured" exception to catch here, confirmed against the real
+    S3 service model before writing this.
+
+    Medium, not Critical: this is a forensics gap, not an exposure by
+    itself — a bucket with logging off isn't more reachable than one with
+    it on, it's just unreviewable after the fact if something happens."""
+    findings = []
+    for name in bucket_names:
+        config = s3.get_bucket_logging(Bucket=name)
+        if "LoggingEnabled" in config:
+            continue
+        findings.append(Finding(
+            check_id="STOR-22",
+            title="S3 Bucket Access Logging Not Enabled",
+            severity=Severity.MEDIUM,
+            resource_arn=f"arn:aws:s3:::{name}",
+            raw_detail=f"Bucket '{name}' has no server access logging configured. "
+                       f"If this bucket is ever accessed, modified, or exfiltrated "
+                       f"from, there is no record of who did what — investigation "
+                       f"after the fact isn't possible.",
+            account_context=f"bucket={name}",
+        ))
+    return findings
+
+
 def run_all(session) -> list[Finding]:
-    """Run STOR-19 through STOR-21 against every bucket in the account —
+    """Run STOR-19 through STOR-22 against every bucket in the account —
     not just testbed buckets. A real scan must check everything."""
     s3 = session.client("s3")
     bucket_names = list_buckets(s3)
@@ -136,4 +168,5 @@ def run_all(session) -> list[Finding]:
     findings += check_19_missing_public_access_block(s3, bucket_names)
     findings += check_20_public_bucket_policy(s3, bucket_names)
     findings += check_21_public_acl(s3, bucket_names)
+    findings += check_22_access_logging_disabled(s3, bucket_names)
     return findings

{plexavo-0.2.6 → plexavo-0.2.7}/plexavo/cli.py

@@ -155,7 +155,7 @@ def _run_scan(args) -> None:
         stage("Running checks NET-01 through NET-04")
         findings += network_checks.run_all(session)
 
-        stage("Running checks STOR-19 through STOR-21")
+        stage("Running checks STOR-19 through STOR-22")
         findings += storage_checks.run_all(session)
 
         stage("Running checks ENC-29 through ENC-31")

{plexavo-0.2.6 → plexavo-0.2.7}/plexavo.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plexavo
-Version: 0.2.6
+Version: 0.2.7
 Summary: Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else.
 Author: Kavee
 License: AGPL-3.0-or-later
@@ -53,14 +53,14 @@ can read, and it's entirely optional. See [Cost](#cost).
 
 ## What it checks
 
-31 checks across 6 categories, run against real AWS accounts:
+32 checks across 6 categories, run against real AWS accounts:
 
 - **IAM**: privilege escalation paths, wildcard admin, cross-account
   trust, root usage, dormant credentials
 - **Network**: security groups and RDS instances exposed to the
   internet
 - **Storage**: public S3 buckets, via ACLs, bucket policies, or missing
-  Block Public Access
+  Block Public Access; buckets with no access logging configured
 - **Encryption**: unencrypted EBS volumes, RDS instances, S3 buckets
 - **Logging**: CloudTrail coverage and encryption, GuardDuty status
 - **Usage**: permissions granted but never used, roles nobody has
@@ -167,6 +167,14 @@ uv pip install -e .
 See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the pattern used to add a
 new check.
 
+## Break Plexavo
+
+Think you can make Plexavo miss something, or give confusing guidance?
+[Report it](../../issues/new?template=break-plexavo.yml). Every
+confirmed, genuinely new finding gets fixed and shipped, and you get a
+permanent credit in the [Hall of Bugs](HALL_OF_BUGS.md). No bounty,
+public credit only.
+
 ## Security
 
 Found a vulnerability in the tool itself, not a misconfiguration in your

{plexavo-0.2.6 → plexavo-0.2.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "plexavo"
-version = "0.2.6"
+version = "0.2.7"
 description = "Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else."
 readme = "README.md"
 license = { text = "AGPL-3.0-or-later" }

{plexavo-0.2.6 → plexavo-0.2.7}/tests/test_storage_offline.py

@@ -12,11 +12,12 @@ from plexavo.checks import storage
 
 
 class FakeS3:
-    def __init__(self, buckets, pab=None, policies=None, acls=None):
+    def __init__(self, buckets, pab=None, policies=None, acls=None, logging=None):
         self._buckets = buckets
         self._pab = pab or {}
         self._policies = policies or {}
         self._acls = acls or {}
+        self._logging = logging or {}
 
     def list_buckets(self):
         return {"Buckets": [{"Name": b} for b in self._buckets]}
@@ -34,6 +35,13 @@ class FakeS3:
     def get_bucket_acl(self, Bucket):
         return self._acls.get(Bucket, {"Grants": []})
 
+    def get_bucket_logging(self, Bucket):
+        # Real S3 behavior: always 200, 'LoggingEnabled' simply absent when
+        # logging was never configured — never raises.
+        if Bucket in self._logging:
+            return {"LoggingEnabled": self._logging[Bucket]}
+        return {}
+
 
 FULL_PAB = {"BlockPublicAcls": True, "IgnorePublicAcls": True, "BlockPublicPolicy": True, "RestrictPublicBuckets": True}
 
@@ -53,6 +61,7 @@ def run_checks(s3, buckets):
     findings += storage.check_19_missing_public_access_block(s3, buckets)
     findings += storage.check_20_public_bucket_policy(s3, buckets)
     findings += storage.check_21_public_acl(s3, buckets)
+    findings += storage.check_22_access_logging_disabled(s3, buckets)
     return findings
 
 
@@ -114,5 +123,23 @@ s3 = FakeS3(["owner-only-bucket"], pab={"owner-only-bucket": FULL_PAB}, acls={
 findings = run_checks(s3, ["owner-only-bucket"])
 assert_true(not any(f.check_id == "STOR-21" for f in findings), "Does NOT fire on an owner-only ACL grant")
 
+print("\n=== STOR-22: bucket has no access logging configured ===")
+s3 = FakeS3(["no-logging-bucket"], pab={"no-logging-bucket": FULL_PAB})
+findings = run_checks(s3, ["no-logging-bucket"])
+assert_true(any(f.check_id == "STOR-22" for f in findings), "Fires when access logging was never configured")
+
+print("\n=== FALSE POSITIVE GUARD: STOR-22 does not fire when access logging is enabled ===")
+s3 = FakeS3(["logged-bucket"], pab={"logged-bucket": FULL_PAB},
+            logging={"logged-bucket": {"TargetBucket": "log-archive", "TargetPrefix": "logged-bucket/"}})
+findings = run_checks(s3, ["logged-bucket"])
+assert_true(not any(f.check_id == "STOR-22" for f in findings), "Does NOT fire when LoggingEnabled is present")
+
+print("\n=== REGRESSION: reported bug (Hall of Bugs #1, found by ThePettyReviewer) — a bucket with logging genuinely off must be flagged ===")
+s3 = FakeS3(["reported-bucket"], pab={"reported-bucket": FULL_PAB})
+findings = run_checks(s3, ["reported-bucket"])
+matched = [f for f in findings if f.check_id == "STOR-22"]
+assert_true(bool(matched), "STOR-22 fires on a bucket with logging off (previously: no check existed at all, so nothing ever fired)")
+assert_true(bool(matched) and matched[0].severity.value == "Medium", "Severity is Medium — a visibility gap, not exposure like STOR-19/20/21")
+
 print(f"\n{'ALL PASSED' if failures == 0 else f'{failures} FAILURE(S)'}")
 sys.exit(1 if failures else 0)