Repository navigation
Cite observed traffic on hops and widen risk:plan's shift-left gate - #42
Merged
therandomsecurityguy merged 1 commit intoOct 28, 2026
Merged
Conversation
Completion item 4 from the re-review (~/Documents/Testing/plans/2026-10-27-predictive-completion.md). Two halves: flow-log endpoint evidence that lands on attack-path hops, and an IAM-policy/Helm-values gate in risk:plan. Flow logs v2: - The analyzer runs a second, bounded aggregation: the top remote senders (srcaddr) per interface, ranked by bytes with a window function, ENDPOINTS_PER_INTERFACE (5) per interface, a 25k parsed-row cap and two Athena scans per run. Endpoints ride the existing TrafficObservations row (TTL unchanged); an endpoint-query failure degrades to observations without citations, never a failed run. - The collector deduplicates top senders across an instance's interfaces (biggest first, capped at 5) onto observed_endpoints. - The engine maps each observed vertex to the 1-based hop that arrives at it (tolerant, capped); attack-path search responses, issue metadata (observedTraffic) and the graph carry the citations, and the risk chip "observed traffic from <address>" renders on the hop's target. Shift-left v2 (risk:plan): - Plan-embedded IAM policies (aws_iam_policy / aws_iam_role_policy) are parsed with the same policy parser the CIEM evaluator runs; a policy that newly grants iam:PassRole on Resource "*" fails the gate as critical (precursor of RULE-034), wildcard Action "*" is high. With a before document (plan change.before or --policy-before) the checks are a true diff; conditions/SCPs are explicitly not evaluated and findings say so. - New standalone inputs: --policy after.json [--policy-before before.json] for non-Terraform flows, and --helm-values values.yaml (js-yaml) flagging an internet-facing ingress as high with a medium note for a plain enabled ingress. All inputs share one report and one exit code; the README documents the optional CI gate for plan, policy and chart changes. Why this is safe: every new input is bounded and failure-tolerant (row caps, per-interface caps, degrade-don't-fail paths), plan-time checks only report what the catalogue would eventually fire on (with explicit caveats for conditions/SCPs and plan-time ignorance), and the analyzer adds exactly one extra read-only Athena scan over the same window.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Flow logs v2 — endpoint evidence on hops
srcaddr) per interface, ranked by bytes via window function, 5 per interface, 25k parsed-row cap, two Athena scans per run; endpoints ride the existingTrafficObservationsrow; an endpoint-query failure degrades to observations without citationsobserved_endpointsobservedTraffic), and the graph renders an "observed traffic from<address>" chip on the hop's target — a path shows observed traffic on a specific hop, not just configured exposureShift-left v2 —
risk:planaws_iam_policy/aws_iam_role_policydocuments parsed with the same parser the CIEM evaluator runs; newly grantingiam:PassRoleonResource: "*"→ critical → gate fails (precursor of RULE-034); wildcardAction: "*"→ highchange.beforeor--policy-before) checks are a true diff — unchanged grants are not re-reported; conditions/SCPs/permission boundaries are explicitly not evaluated and findings say so--policy after.json [--policy-before before.json],--helm-values values.yaml(js-yaml) — internet-facing ingress high, plain enabled ingress a medium note; all inputs share one report and exit code; README documents the optional CI gateWhy this is safe
js-yamlat the repo root, used by the CLI script only; lockfile verified withnpm ci --dry-runTest plan
npx jest --runInBand— 20 projects / 1851 tests passed (new: endpoint SQL/parsing/caps, analyzer merge + degrade path, collector endpoint parsing/dedupe/cap, citation mapping + tolerance, runner metadata, search-response citations, UI chip, policy diff semantics incl. unchanged-grant case, plan-embedded policies, Helm values cases, argv validation)npm run typecheck; full workspace lint;npm run format:checknpm run ci:build;npm run package:lambdassmoke;npm ci --dry-run