smoke: initial CI validation

[nb1b3k]

First CI run on the public repo. Expects Checkov + Semgrep findings on the moved Terraform file. FAIL decision is expected; do not merge.

[github-actions]

SecureFlow AI Security Review

PR: nb1b3k/secureflow-ai#1 · smoke/initial-pipeline-validation → main

Decision: ❌ FAIL
Risk score: 100/100

6 blocking finding(s). Risk score 100/100. PR should not merge.

Blocking findings

IAM policies that allow full "-" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more

• Severity: low · Confidence: 0.55 · Source: semgrep
• Location: demo_smoke.tf:36
• CWE: CWE-269: Improper Privilege Management · OWASP: A04:2021 - Insecure Design, A06:2025 - Insecure Design

Statement = [{
      Effect   = "Allow"
      Action   = "*"
      Resource = "*"
    }]

Ensure that no IAM policies allow "*" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, spe

• Severity: low · Confidence: 0.55 · Source: semgrep
• Location: demo_smoke.tf:38
• CWE: CWE-269: Improper Privilege Management · OWASP: A04:2021 - Insecure Design, A06:2025 - Insecure Design

Action   = "*"

Ensure the S3 bucket has access logging enabled

• Severity: medium · Confidence: 0.70 · Source: checkov
• Location: demo_smoke.tf:14
• OWASP: A05:2021-Security Misconfiguration

resource "aws_s3_bucket" "public" {
  bucket = "secureflow-demo-public-bucket"
  # No public_access_block, no versioning, no SSE, no logging.
}

Recommendation: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

Suggested fix:
(generated by LLM; manually verify before applying)

resource "aws_s3_bucket" "public" {
  bucket = "secureflow-demo-public-bucket"
  # No public_access_block, no versioning, no SSE, no logging.
}

resource "aws_s3_bucket_logging" "public" {
  bucket = aws_s3_bucket.public.id
  target_bucket = aws_s3_bucket.logging.id
  target_prefix = "log/"
}

resource "aws_s3_bucket" "logging" {
  bucket = "secureflow-demo-logging-bucket"
  acl    = "log-delivery-write"
}

Add an aws_s3_bucket_logging resource and a separate logging bucket to enable access logging for the S3 bucket.

Patch review: approve (confidence 0.95)

References:

• https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

Ensure S3 bucket does not allow an action with any Principal

• Severity: high · Confidence: 0.90 · Source: checkov
• Location: demo_smoke.tf:19
• OWASP: A05:2021-Security Misconfiguration

resource "aws_s3_bucket_policy" "public" {
  bucket = aws_s3_bucket.public.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "s3:GetObject"
      Resource  = "${aws_s3_bucket.public.arn}/*"
    }]
  })
}

Recommendation: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-23

Suggested fix:
(generated by LLM; manually verify before applying)

resource "aws_s3_bucket_policy" "public" {
  bucket = aws_s3_bucket.public.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = {
        AWS = "arn:aws:iam::123456789012:root"
      }
      Action    = "s3:GetObject"
      Resource  = "${aws_s3_bucket.public.arn}/*"
    }]
  })
}

Replace wildcard Principal with a specific AWS account principal to restrict access.

Patch review: approve (confidence 0.95)

References:

• https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-23

Ensure IAM policies that allow full "-" administrative privileges are not created

• Severity: high · Confidence: 0.85 · Source: checkov
• Location: demo_smoke.tf:32
• OWASP: A05:2021-Security Misconfiguration

resource "aws_iam_policy" "wildcard" {
  name   = "secureflow-demo-wildcard"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "*"
      Resource = "*"
    }]
  })
}

Recommendation: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45

Suggested fix:
(generated by LLM; manually verify before applying)

resource "aws_iam_policy" "wildcard" {
  name   = "secureflow-demo-wildcard"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "ec2:Describe*"
      Resource = "*"
    }]
  })
}

Restrict the IAM policy Action from wildcard '' to specific actions like 'ec2:Describe' to follow least-privilege principles.

Patch review: approve (confidence 0.95)

References:

• https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45

Ensure no security groups allow ingress from 0.0.0.0:0 to port 22

• Severity: high · Confidence: 0.85 · Source: checkov
• Location: demo_smoke.tf:44
• OWASP: A05:2021-Security Misconfiguration

resource "aws_security_group" "ssh_open" {
  name        = "secureflow-demo-ssh-open"
  description = "Demo: SSH open to the world"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Recommendation: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

Suggested fix:
(generated by LLM; manually verify before applying)

resource "aws_security_group" "ssh_open" {
  name        = "secureflow-demo-ssh-open"
  description = "Demo: SSH open to the world"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }
}

Restrict SSH ingress to a private IP range instead of 0.0.0.0/0.

Patch review: approve (confidence 0.95)

References:

• https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

Notes

• grype: skipped: no dependency manifests changed

_{Budget — tokens_in: 24404, tokens_out: 1825, llm_calls: 14}