plexavo 0.4.4__tar.gz → 0.4.6__tar.gz

{plexavo-0.4.4 → plexavo-0.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plexavo
-Version: 0.4.4
+Version: 0.4.6
 Summary: Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else.
 Author: Kavee
 License: AGPL-3.0-or-later
@@ -85,12 +85,13 @@ command to fix it.
 
 ## What it checks
 
-**32 checks across 6 categories**, run against real AWS accounts:
+**33 checks across 7 categories**, run against real AWS accounts:
 
 | Category | What Plexavo looks for |
 |---|---|
 | **IAM** | Privilege escalation paths, wildcard admin, cross-account trust, root usage, dormant credentials |
 | **Network** | Security groups and RDS instances exposed to the internet |
+| **EC2 Hardening** | Instance metadata service (IMDS) not requiring IMDSv2 - the setting behind the 2019 Capital One breach |
 | **Storage** | Public S3 buckets via ACLs, bucket policies, or missing Block Public Access; buckets with no access logging |
 | **Encryption** | Unencrypted EBS volumes, RDS instances, S3 buckets |
 | **Logging** | CloudTrail coverage and encryption, GuardDuty status |

{plexavo-0.4.4 → plexavo-0.4.6}/README.md

@@ -56,12 +56,13 @@ command to fix it.
 
 ## What it checks
 
-**32 checks across 6 categories**, run against real AWS accounts:
+**33 checks across 7 categories**, run against real AWS accounts:
 
 | Category | What Plexavo looks for |
 |---|---|
 | **IAM** | Privilege escalation paths, wildcard admin, cross-account trust, root usage, dormant credentials |
 | **Network** | Security groups and RDS instances exposed to the internet |
+| **EC2 Hardening** | Instance metadata service (IMDS) not requiring IMDSv2 - the setting behind the 2019 Capital One breach |
 | **Storage** | Public S3 buckets via ACLs, bucket policies, or missing Block Public Access; buckets with no access logging |
 | **Encryption** | Unencrypted EBS volumes, RDS instances, S3 buckets |
 | **Logging** | CloudTrail coverage and encryption, GuardDuty status |

{plexavo-0.4.4 → plexavo-0.4.6}/plexavo/__init__.py

@@ -4,4 +4,4 @@ Runs entirely with your own local AWS credentials. Nothing is sent to
 anyone else. See README.md for usage, or `plexavo scan --help`.
 """
 
-__version__ = "0.4.4"
+__version__ = "0.4.6"

plexavo-0.4.6/plexavo/checks/compute.py

@@ -0,0 +1,117 @@
+"""Category 7: EC2 Instance Hardening — check 32.
+
+Added after scanning a hand-built "capital_one stack" terraform demo that
+reproduces the 2019 Capital One breach shape (internet-facing instance,
+IMDSv1 reachable, an over-permissioned role attached) and finding Plexavo
+had nothing at all looking at the metadata service — the exact setting
+that let the real attack escalate an SSRF into stolen AWS credentials.
+
+Deliberately its own category rather than folded into Network: NET-01/02/03
+answer "can something on the internet reach a port on this instance,"
+which is a security-group question. IMDSv1 reachability is not gated by
+the instance's own security group at all — the request that matters is
+loopback-style, from a process already running ON the instance (an SSRF
+bug in the app is the classic path) to the link-local metadata address
+169.254.169.254. So, unlike every NET-0x check, this one deliberately does
+NOT require a public IP or an internet-open security group rule to fire —
+gating it on network exposure the way NET-01/02/03 do would make it blind
+to the exact scenario it exists to catch.
+"""
+
+from plexavo.findings import Finding, Severity
+
+
+def list_instances_with_metadata(ec2) -> list[dict]:
+    """{'instance_id', 'name', 'http_tokens', 'http_endpoint', 'has_role'}
+    for every running/pending instance. Stopped instances are excluded —
+    same reasoning as network.py's list_public_instances: a finding should
+    describe what's actually reachable right now, not a past or future
+    state. MetadataOptions is always present on a real DescribeInstances
+    response; the .get() defaults here only guard hand-built test fixtures
+    that omit it."""
+    instances = []
+    paginator = ec2.get_paginator("describe_instances")
+    for page in paginator.paginate(Filters=[
+        {"Name": "instance-state-name", "Values": ["pending", "running"]}
+    ]):
+        for reservation in page["Reservations"]:
+            for instance in reservation["Instances"]:
+                name = next(
+                    (t["Value"] for t in instance.get("Tags", []) if t["Key"] == "Name"),
+                    instance["InstanceId"],
+                )
+                metadata_options = instance.get("MetadataOptions", {})
+                instances.append({
+                    "instance_id": instance["InstanceId"],
+                    "name": name,
+                    "http_tokens": metadata_options.get("HttpTokens", "optional"),
+                    "http_endpoint": metadata_options.get("HttpEndpoint", "enabled"),
+                    "has_role": bool(instance.get("IamInstanceProfile")),
+                })
+    return instances
+
+
+def check_32_imdsv2_not_enforced(instances: list[dict]) -> list[Finding]:
+    """EC2-32: the instance's metadata service accepts unauthenticated
+    IMDSv1 requests (HttpTokens != 'required') instead of requiring the
+    session-token-authenticated IMDSv2.
+
+    An instance with HttpEndpoint == 'disabled' has no metadata service to
+    reach at all — correctly not flagged, that's the strongest posture,
+    not a gap.
+
+    Severity is genuinely different depending on whether there's anything
+    for a stolen token to retrieve:
+    - CRITICAL when an IAM instance profile is attached — this is the
+      exact chain the 2019 Capital One breach used: SSRF into the app,
+      SSRF used to query IMDS, IMDSv1 hands back the attached role's
+      temporary credentials with no proof the caller ever reached IMDS
+      intentionally, credentials used to reach whatever that role can
+      reach.
+    - MEDIUM when no role is attached — still a real hardening gap (the
+      metadata service still exposes the instance identity document, and
+      any secrets accidentally left in user-data), but there's no AWS
+      credential sitting behind this specific instance for IMDSv1 to hand
+      over, so it doesn't get the same severity as the credential-theft
+      case above."""
+    findings = []
+    for inst in instances:
+        if inst["http_endpoint"] != "enabled":
+            continue
+        if inst["http_tokens"] == "required":
+            continue
+        if inst["has_role"]:
+            severity = Severity.CRITICAL
+            role_note = (
+                "This instance also has an IAM role attached, so a stolen session token "
+                "can retrieve that role's real, temporary AWS credentials — this is the "
+                "exact chain (SSRF -> IMDSv1 -> stolen instance-role credentials) that "
+                "caused the 2019 Capital One breach."
+            )
+        else:
+            severity = Severity.MEDIUM
+            role_note = (
+                "No IAM role is attached to this instance, so there are no AWS "
+                "credentials for a stolen token to retrieve here — but the metadata "
+                "service can still leak the instance identity document and any secrets "
+                "left in user-data."
+            )
+        findings.append(Finding(
+            check_id="EC2-32",
+            title="IMDSv2 Not Enforced",
+            severity=severity,
+            resource_arn=inst["instance_id"],
+            raw_detail=f"EC2 instance '{inst['name']}' ({inst['instance_id']}) accepts the "
+                       f"legacy, unauthenticated IMDSv1 metadata requests instead of "
+                       f"requiring IMDSv2's session token. {role_note}",
+            account_context=f"iam_role_attached={inst['has_role']}",
+            evidence=f"http_tokens={inst['http_tokens']}, iam_role_attached={inst['has_role']}",
+        ))
+    return findings
+
+
+def run_all(session) -> list[Finding]:
+    """Run EC2-32 against every running/pending instance in the account."""
+    ec2 = session.client("ec2")
+    instances = list_instances_with_metadata(ec2)
+    return check_32_imdsv2_not_enforced(instances)

{plexavo-0.4.4 → plexavo-0.4.6}/plexavo/checks/iam.py

@@ -40,9 +40,11 @@ from plexavo.principals import (
     statement_has_wildcard_action,
     resource_is_wildcard,
     resource_includes,
+    resource_grants_any_role,
     find_blocking_deny,
     has_full_wildcard_deny,
     action_within_boundary,
+    _condition_adjustment,
     _normalize,
 )
 
@@ -88,25 +90,6 @@ def _all_statements(principal: Principal):
             yield policy_name, stmt
 
 
-def _condition_adjustment(stmt: dict) -> tuple[Severity, str, str]:
-    """A Condition block on the ALLOW statement itself means we can't
-    safely claim this grant is unconditional. Downgrade Critical -> High
-    and say so via confidence/evidence — never as free text baked into
-    raw_detail, so the report can show "this needs a human look" as a
-    distinct, structured fact instead of a sentence buried in prose.
-    Returns (severity, confidence, evidence)."""
-    condition = stmt.get("Condition")
-    if condition:
-        keys = ", ".join(condition.keys())
-        return (
-            Severity.HIGH,
-            "Likely — see note",
-            f"Grant is scoped by a Condition block ({keys}) — not evaluated automatically; "
-            f"whether it meaningfully restricts access needs a manual look.",
-        )
-    return Severity.CRITICAL, "Confirmed", ""
-
-
 def _apply_deny_and_boundary(principal: Principal, action: str, resource_arn: str | None,
                               severity: Severity, confidence: str, evidence: str):
     """Combined evaluator: explicit Deny (identity + boundary) can suppress
@@ -394,11 +377,11 @@ def check_05_assumerole_chain_to_admin(principals: list[Principal]) -> list[Find
                 continue
             if not statement_grants(stmt, {"sts:AssumeRole"}):
                 continue
-            if resource_is_wildcard(stmt):
-                continue  # that's check IAM-06, not IAM-05
+            if resource_grants_any_role(stmt):
+                continue  # that's check IAM-06, not IAM-05 - includes "role/*", not just a literal "*"
             base_severity, base_confidence, base_evidence = _condition_adjustment(stmt)
-            for target_arn in _normalize(stmt.get("Resource")):
-                if target_arn not in admin_roles or target_arn == p.arn:
+            for target_arn in admin_roles:
+                if target_arn == p.arn or not resource_includes(stmt, target_arn):
                     continue
                 result = _apply_deny_and_boundary(p, "sts:AssumeRole", target_arn, base_severity, base_confidence, base_evidence)
                 if result is None:
@@ -422,7 +405,18 @@ def check_05_assumerole_chain_to_admin(principals: list[Principal]) -> list[Find
 
 
 def check_06_wildcard_assumerole(principals: list[Principal]) -> list[Finding]:
-    """IAM-06: sts:AssumeRole on effectively Resource:* — can assume any role in the account."""
+    """IAM-06: sts:AssumeRole on effectively Resource:* — can assume any role
+    in the account. Fires on a literal "*" AND on a role-scoped prefix
+    wildcard like "arn:aws:iam::123456789012:role/*" (resource_grants_any_role)
+    - the previous version only recognized the literal "*" case, silently
+    missing the far more common role/* form (Hall of Bugs, found by
+    fusiontechstrategies). Known residual gap, not expanded here: a Deny or
+    boundary scoped to the same role/* pattern (rather than a literal "*")
+    is not recognized as suppressing this finding, since
+    _apply_deny_and_boundary's resource_arn=None path only checks
+    resource_is_wildcard on the Deny/boundary side too - narrower than a
+    fix would need to be, but the safe-direction failure mode (a rare
+    over-report, never an under-report)."""
     findings = []
     for p in principals:
         for policy_name, stmt in _all_statements(p):
@@ -430,7 +424,7 @@ def check_06_wildcard_assumerole(principals: list[Principal]) -> list[Finding]:
                 continue
             if not statement_grants(stmt, {"sts:AssumeRole"}):
                 continue
-            if not resource_is_wildcard(stmt):
+            if not resource_grants_any_role(stmt):
                 continue
             severity, confidence, evidence = _condition_adjustment(stmt)
             result = _apply_deny_and_boundary(p, "sts:AssumeRole", None, severity, confidence, evidence)

{plexavo-0.4.4 → plexavo-0.4.6}/plexavo/checks/storage.py

@@ -15,7 +15,7 @@ import json
 from botocore.exceptions import ClientError
 
 from plexavo.findings import Finding, Severity
-from plexavo.principals import _normalize
+from plexavo.principals import _normalize, _condition_adjustment
 
 PUBLIC_GROUP_URIS = {
     "http://acs.amazonaws.com/groups/global/AllUsers": "AllUsers (anyone on the internet, no AWS account needed)",
@@ -29,7 +29,7 @@ def list_buckets(s3) -> list:
     return [b["Name"] for b in s3.list_buckets()["Buckets"]]
 
 
-def check_19_missing_public_access_block(s3, bucket_names: list) -> list[Finding]:
+def check_19_missing_public_access_block(s3, bucket_names: list, skipped: set | None = None) -> list[Finding]:
     """STOR-19: bucket-level PublicAccessBlock missing entirely, or present
     but with any of the 4 settings disabled.
 
@@ -39,7 +39,14 @@ def check_19_missing_public_access_block(s3, bucket_names: list) -> list[Finding
     distinct exception shape (unlike, say, IAM's NoSuchEntityException),
     so the dynamic-exception-class pattern silently never matches and the
     code never raises AttributeError only because it's also never
-    triggered — a latent bug, not a working code path, until this fix."""
+    triggered — a latent bug, not a working code path, until this fix.
+
+    A bucket the caller's own principal can't read (AccessDenied, e.g. an
+    explicit Deny in that bucket's own policy) is skipped for this check
+    rather than raised — one unreadable bucket used to crash the entire
+    scan (Hall of Bugs, found by fusiontechstrategies). Its name is added
+    to `skipped` so the caller can report it as unevaluated instead of
+    silently dropping it from coverage."""
     findings = []
     for name in bucket_names:
         try:
@@ -50,7 +57,12 @@ def check_19_missing_public_access_block(s3, bucket_names: list) -> list[Finding
             detail = (f"has PublicAccessBlock configured, but "
                       f"{', '.join(off)} {'is' if len(off) == 1 else 'are'} disabled")
         except ClientError as e:
-            if e.response["Error"]["Code"] != "NoSuchPublicAccessBlockConfiguration":
+            code = e.response["Error"]["Code"]
+            if code == "AccessDenied":
+                if skipped is not None:
+                    skipped.add(name)
+                continue
+            if code != "NoSuchPublicAccessBlockConfiguration":
                 raise
             detail = "has NO PublicAccessBlock configuration at all — none of the four protections are in place"
         findings.append(Finding(
@@ -65,16 +77,31 @@ def check_19_missing_public_access_block(s3, bucket_names: list) -> list[Finding
     return findings
 
 
-def check_20_public_bucket_policy(s3, bucket_names: list) -> list[Finding]:
+def check_20_public_bucket_policy(s3, bucket_names: list, skipped: set | None = None) -> list[Finding]:
     """STOR-20: bucket policy grants Allow to Principal:* (or {"AWS":"*"}).
     Same ClientError pattern as check_19, same real reason — confirmed
-    NoSuchBucketPolicy isn't modeled as a distinct S3 exception either."""
+    NoSuchBucketPolicy isn't modeled as a distinct S3 exception either.
+    AccessDenied is skipped, not raised — see check_19's docstring.
+
+    A Condition block on the statement (e.g. aws:PrincipalOrgID, aws:SourceVpc)
+    downgrades Critical/Confirmed to High/"Likely — see note" via the shared
+    _condition_adjustment (moved from checks/iam.py, same mechanism every IAM
+    check already used) instead of asserting unconditional public access —
+    Hall of Bugs, found by fusiontechstrategies: a Principal:* bucket policy
+    scoped to an org/VPC via Condition is a common, legitimate pattern
+    (CloudFront OAC, org-wide internal buckets), and this previously fired
+    at full Critical/Confirmed regardless."""
     findings = []
     for name in bucket_names:
         try:
             policy_str = s3.get_bucket_policy(Bucket=name)["Policy"]
         except ClientError as e:
-            if e.response["Error"]["Code"] != "NoSuchBucketPolicy":
+            code = e.response["Error"]["Code"]
+            if code == "AccessDenied":
+                if skipped is not None:
+                    skipped.add(name)
+                continue
+            if code != "NoSuchBucketPolicy":
                 raise
             continue
         policy = json.loads(policy_str)
@@ -88,25 +115,42 @@ def check_20_public_bucket_policy(s3, bucket_names: list) -> list[Finding]:
             if not is_public:
                 continue
             actions = _normalize(stmt.get("Action"))
+            severity, confidence, evidence = _condition_adjustment(stmt)
+            if stmt.get("Condition"):
+                access_phrase = ("to Principal:* — but scoped by a Condition block, so whether "
+                                  "this is actually publicly reachable depends on that condition; "
+                                  "see evidence")
+            else:
+                access_phrase = ("to Principal:* — anyone on the internet, no AWS account "
+                                  "required, can perform these actions")
             findings.append(Finding(
                 check_id="STOR-20",
                 title="S3 Bucket Policy Allows Public Access",
-                severity=Severity.CRITICAL,
+                severity=severity,
                 resource_arn=f"arn:aws:s3:::{name}",
                 raw_detail=f"Bucket '{name}' has a bucket policy statement granting "
-                           f"{', '.join(actions)} to Principal:* — anyone on the internet, "
-                           f"no AWS account required, can perform these actions.",
+                           f"{', '.join(actions)} {access_phrase}.",
                 account_context=f"bucket={name}",
+                confidence=confidence,
+                evidence=evidence,
             ))
     return findings
 
 
-def check_21_public_acl(s3, bucket_names: list) -> list[Finding]:
+def check_21_public_acl(s3, bucket_names: list, skipped: set | None = None) -> list[Finding]:
     """STOR-21: bucket ACL grants any permission to the AllUsers or
-    AuthenticatedUsers built-in groups."""
+    AuthenticatedUsers built-in groups. AccessDenied is skipped, not
+    raised — see check_19's docstring."""
     findings = []
     for name in bucket_names:
-        acl = s3.get_bucket_acl(Bucket=name)
+        try:
+            acl = s3.get_bucket_acl(Bucket=name)
+        except ClientError as e:
+            if e.response["Error"]["Code"] != "AccessDenied":
+                raise
+            if skipped is not None:
+                skipped.add(name)
+            continue
         for grant in acl.get("Grants", []):
             grantee = grant.get("Grantee", {})
             if grantee.get("Type") != "Group":
@@ -128,7 +172,7 @@ def check_21_public_acl(s3, bucket_names: list) -> list[Finding]:
     return findings
 
 
-def check_22_access_logging_disabled(s3, bucket_names: list) -> list[Finding]:
+def check_22_access_logging_disabled(s3, bucket_names: list, skipped: set | None = None) -> list[Finding]:
     """STOR-22: bucket has no server access logging configured.
 
     GetBucketLogging always returns 200, even when logging was never set
@@ -142,10 +186,19 @@ def check_22_access_logging_disabled(s3, bucket_names: list) -> list[Finding]:
     it on. Whether object-level access is actually unreviewable after the
     fact depends on whether it's captured another way (e.g. CloudTrail S3
     data events), which Plexavo does not check — so the finding language
-    stays careful not to claim investigation is impossible."""
+    stays careful not to claim investigation is impossible.
+
+    AccessDenied is skipped, not raised — see check_19's docstring."""
     findings = []
     for name in bucket_names:
-        config = s3.get_bucket_logging(Bucket=name)
+        try:
+            config = s3.get_bucket_logging(Bucket=name)
+        except ClientError as e:
+            if e.response["Error"]["Code"] != "AccessDenied":
+                raise
+            if skipped is not None:
+                skipped.add(name)
+            continue
         if "LoggingEnabled" in config:
             continue
         findings.append(Finding(
@@ -165,14 +218,21 @@ def check_22_access_logging_disabled(s3, bucket_names: list) -> list[Finding]:
     return findings
 
 
-def run_all(session) -> list[Finding]:
+def run_all(session) -> tuple[list[Finding], list[str]]:
     """Run STOR-19 through STOR-22 against every bucket in the account —
-    not just testbed buckets. A real scan must check everything."""
+    not just testbed buckets. A real scan must check everything.
+
+    Returns (findings, skipped_buckets): a bucket the caller's principal
+    can't read (AccessDenied on any of the 4 per-bucket calls) is skipped
+    rather than crashing the whole scan, and its name comes back in
+    skipped_buckets so the caller can report it as unevaluated instead of
+    silently under-reporting. See check_19's docstring for why."""
     s3 = session.client("s3")
     bucket_names = list_buckets(s3)
+    skipped: set = set()
     findings = []
-    findings += check_19_missing_public_access_block(s3, bucket_names)
-    findings += check_20_public_bucket_policy(s3, bucket_names)
-    findings += check_21_public_acl(s3, bucket_names)
-    findings += check_22_access_logging_disabled(s3, bucket_names)
-    return findings
+    findings += check_19_missing_public_access_block(s3, bucket_names, skipped)
+    findings += check_20_public_bucket_policy(s3, bucket_names, skipped)
+    findings += check_21_public_acl(s3, bucket_names, skipped)
+    findings += check_22_access_logging_disabled(s3, bucket_names, skipped)
+    return findings, sorted(skipped)

{plexavo-0.4.4 → plexavo-0.4.6}/plexavo/checks/usage.py

@@ -71,6 +71,22 @@ Real, stated scope limits for check_26, not hidden:
   yet — not because they're provably excess. This is a real, structural
   limitation of usage-based analysis on quiet accounts, not a bug to
   fix; noted here so it isn't mistaken for one during grading.
+- CONFIRMED REAL BUG, found via a Hall of Bugs report (fusiontechstrategies):
+  CloudTrail's LookupEvents API returns MANAGEMENT events only, never data
+  events, regardless of trail configuration or actual activity — confirmed
+  against AWS's own CloudTrail documentation. Actions like s3:GetObject/
+  s3:PutObject, dynamodb:GetItem/PutItem, lambda:InvokeFunction, KMS crypto
+  operations, and SQS message operations are ALL data-plane, so a role
+  actively calling them nonstop still shows zero usage in this check's
+  source data — the exact opposite of "unused." Fixed the same way the
+  wildcard-action gap above is already handled: _KNOWN_DATA_PLANE_ACTIONS
+  excludes them from _explicit_granted_actions' candidate set entirely,
+  rather than confidently (and wrongly) calling them unused. That list is a
+  small, explicitly non-exhaustive set of the well-documented, high-
+  confidence AWS CloudTrail data-event categories — same honesty pattern as
+  _IAM_TO_CLOUDTRAIL_EVENTNAME_EXCEPTIONS below, not a full per-service
+  audit. A data-plane action for a service not yet in this list can still
+  be incorrectly flagged until confirmed through real use and added.
 """
 
 import json
@@ -88,6 +104,27 @@ _IAM_TO_CLOUDTRAIL_EVENTNAME_EXCEPTIONS = {
     "s3:listallmybuckets": "s3:listbuckets",
 }
 
+_KNOWN_DATA_PLANE_ACTIONS = {
+    # Actions CloudTrail's LookupEvents can NEVER see, regardless of how
+    # actively they're called — see module docstring (Hall of Bugs, found
+    # by fusiontechstrategies). A small, explicitly non-exhaustive set of
+    # the well-documented AWS CloudTrail data-event categories, not a full
+    # per-service audit. Add entries here as more are confirmed, don't
+    # assume this list is complete.
+    "s3:getobject", "s3:putobject", "s3:deleteobject",
+    "s3:getobjectacl", "s3:putobjectacl",
+    "s3:getobjecttagging", "s3:putobjecttagging", "s3:deleteobjecttagging",
+    "s3:getobjectversion", "s3:deleteobjectversion", "s3:restoreobject",
+    "dynamodb:getitem", "dynamodb:putitem", "dynamodb:updateitem", "dynamodb:deleteitem",
+    "dynamodb:query", "dynamodb:scan",
+    "dynamodb:batchgetitem", "dynamodb:batchwriteitem",
+    "dynamodb:transactgetitems", "dynamodb:transactwriteitems",
+    "lambda:invokefunction",
+    "kms:decrypt", "kms:encrypt", "kms:generatedatakey",
+    "kms:generatedatakeywithoutplaintext", "kms:reencrypt",
+    "sqs:sendmessage", "sqs:receivemessage", "sqs:deletemessage",
+}
+
 
 def _is_action_used(granted_action: str, used_actions: set) -> bool:
     """True if granted_action was actually used — checked directly, or
@@ -103,7 +140,11 @@ def _explicit_granted_actions(principal: Principal) -> set:
     Allow statements grant. Excludes '*', any 'service:*' wildcard, Deny
     statements, and NotAction statements (same reasoning as wildcards —
     NotAction implies an unbounded 'everything except X' set, not a
-    concrete list to check usage against)."""
+    concrete list to check usage against), AND any known data-plane
+    action (see _KNOWN_DATA_PLANE_ACTIONS / module docstring) — CloudTrail
+    LookupEvents structurally cannot observe those either way, so they're
+    excluded from the candidate set the same way wildcards are, not
+    confidently called 'unused'."""
     granted = set()
     for _, statements in principal.policies:
         for stmt in statements:
@@ -121,6 +162,8 @@ def _explicit_granted_actions(principal: Principal) -> set:
                     # slipping through the old check (action.endswith(":*")),
                     # which only matches the exact literal ":*" suffix.
                     continue
+                if action in _KNOWN_DATA_PLANE_ACTIONS:
+                    continue
                 granted.add(action)
     return granted
 
@@ -200,6 +243,16 @@ def check_27_roles_not_assumed(iam_roles_raw: list, lookback_days: int = 90) ->
     window, using IAM's own RoleLastUsed field directly — no CloudTrail
     needed, same pattern as IAM-09/10.
 
+    iam_roles_raw must come from per-role get_role calls, NOT list_roles
+    directly — confirmed unreliable (Hall of Bugs, found by
+    fusiontechstrategies): a role assumed minutes earlier, with RoleLastUsed
+    correctly populated via get_role, can still come back empty from
+    list_roles, making this check flag every role in the account as "never
+    assumed" regardless of actual activity. Same fix already applied to
+    PermissionsBoundary in principals.py — get_role per role is the
+    documented-reliable path, list_roles' own summary data isn't. See
+    run_all() below for where the per-role fetch happens.
+
     AWS-managed service-linked roles (path starts with
     /aws-service-role/) are deliberately excluded — confirmed as a real
     gap via a live scan that flagged AWSServiceRoleForRDS,
@@ -249,10 +302,16 @@ def run_all(session, principals: list) -> list:
     cloudtrail = session.client("cloudtrail")
     iam = session.client("iam")
 
-    roles_raw = []
+    role_names = []
     paginator = iam.get_paginator("list_roles")
     for page in paginator.paginate():
-        roles_raw.extend(page["Roles"])
+        role_names.extend(r["RoleName"] for r in page["Roles"])
+
+    # list_roles' own RoleLastUsed is unreliable — see check_27's docstring.
+    # get_role per role, one extra call each, is the documented-reliable
+    # path; the same tradeoff principals.py already makes for
+    # PermissionsBoundary.
+    roles_raw = [iam.get_role(RoleName=name)["Role"] for name in role_names]
 
     findings = []
     findings += check_26_unused_permissions(cloudtrail, principals)

{plexavo-0.4.4 → plexavo-0.4.6}/plexavo/cli.py

@@ -31,6 +31,7 @@ from plexavo import attack_paths
 from plexavo.checks import iam as iam_checks
 from plexavo.checks import iam_hygiene
 from plexavo.checks import network as network_checks
+from plexavo.checks import compute as compute_checks
 from plexavo.checks import storage as storage_checks
 from plexavo.checks import encryption as encryption_checks
 from plexavo.checks import logging as logging_checks
@@ -203,7 +204,7 @@ def _run_scan_impl(args, json_mode: bool) -> None:
     principals = []
     chains = []
     stage_num = 0
-    total_stages = 9
+    total_stages = 10
     start_time = time.monotonic()
     flavor_pool = FLAVOR_WORDS.copy()
     random.shuffle(flavor_pool)
@@ -238,8 +239,16 @@ def _run_scan_impl(args, json_mode: bool) -> None:
         stage("Running checks NET-01 through NET-04")
         findings += network_checks.run_all(session)
 
+        stage("Running check EC2-32 (IMDSv2 enforcement)")
+        findings += compute_checks.run_all(session)
+
         stage("Running checks STOR-19 through STOR-22")
-        findings += storage_checks.run_all(session)
+        storage_findings, skipped_buckets = storage_checks.run_all(session)
+        findings += storage_findings
+        if skipped_buckets:
+            console.print(f"[yellow]{len(skipped_buckets)} bucket(s) could not be fully evaluated for "
+                           f"STOR-19/20/21/22 (AccessDenied) — treat their public-access/ACL/logging "
+                           f"status as unknown, not confirmed safe: {', '.join(skipped_buckets)}[/yellow]")
 
         stage("Running checks ENC-29 through ENC-31")
         findings += encryption_checks.run_all(session)