rules-aws

AWS resource deletion is irreversible. Verify the target resource and AWS_PROFILE/region before proceeding.

RISK: Scheduling a KMS key for deletion (or disabling it) permanently destroys every ciphertext encrypted under it — RDS snapshots, S3 objects, EBS volumes become unrecoverable. FIX: Confirm no active resources reference the key (use aws kms list-grants, check CloudTrail) and prefer disabling with a long pending-window before deletion.

RISK: Long-lived IAM user access keys are the #1 source of AWS credential leaks (GitGuardian 2025). FIX: Prefer IAM Identity Center (SSO), IAM Roles for Service Accounts (IRSA), or role assumption with STS short-lived credentials instead of static user keys.

RISK: Disabling CloudTrail logging blinds incident response and breaks compliance requirements (CIS, PCI, HIPAA). FIX: Keep enable_logging = true and set is_multi_region_trail = true with log file validation enabled.

RISK: Hardcoded AWS access key ID detected — leaked keys are weaponized within minutes (GitGuardian 2025 found 23M+ exposed secrets, 70% still active after 2 years). FIX: Remove the key, rotate it immediately, and load credentials via IAM roles, AWS SSO, or environment variables (never commit them).

RISK: Hardcoded AWS secret access key literal detected. FIX: Delete the secret, rotate the IAM credential, and retrieve secrets at runtime from AWS Secrets Manager, Parameter Store, or an IAM role.

RISK: NotAction combined with Effect=Allow grants every AWS action not explicitly excluded — the same privilege-escalation pattern implicated in the Capital One breach. FIX: Use Effect=Allow with an explicit Action list, or reserve NotAction for Effect=Deny statements only.

Using '*' for IAM actions grants administrative privileges. Follow the Principle of Least Privilege by explicitly defining necessary actions.

RISK: IMDS hop limit >1 lets containerized workloads reach the instance metadata service and steal the EC2 role credentials (common SSRF pivot). FIX: Set http_put_response_hop_limit = 1 unless you explicitly need nested container access.

Using IMDSv1 (http_tokens = optional) makes instances vulnerable to SSRF attacks which can leak IAM credentials. Require IMDSv2 by setting http_tokens = 'required'.

RISK: Lambda environment variables are stored in plaintext in CloudFormation/Terraform state and visible to anyone with lambda:GetFunction. FIX: Fetch secrets at runtime from AWS Secrets Manager or SSM Parameter Store (SecureString), or encrypt envs with a CMK.

RISK: RDS storage_encrypted = false leaves database snapshots, logs, and replicas unencrypted at rest, violating most compliance baselines (PCI/HIPAA/SOC2). FIX: Set storage_encrypted = true and specify kms_key_id for a customer-managed CMK.

RISK: Disabling aws_s3_bucket_public_access_block settings removes the safety net that prevents accidental public exposure — the leading cause of S3 data leaks. FIX: Leave all four Block Public Access flags at true unless the bucket is an intentional public static site.

Setting S3 buckets to 'public-read' exposes data to the entire internet. Ensure this is explicitly intended (e.g. for a static website) or use 'private' and enable Block Public Access (BPA).

RISK: SSE-C lets the caller supply the encryption key — the Codefinger ransomware campaign (Jan 2025) abused compromised credentials + SSE-C to encrypt victim S3 data with attacker-held keys. FIX: Prefer SSE-KMS with a customer-managed CMK so key material stays inside AWS KMS and access is auditable via CloudTrail.

RISK: Database/cache ports (MySQL/Postgres/MSSQL/Mongo/Redis/Elastic/Couch) open to 0.0.0.0/0 are scanned and brute-forced within minutes. FIX: Restrict cidr_blocks to the app VPC/subnet or use security group references; never expose DB engines to the public internet.

Opening SSH (22) or RDP (3389) to 0.0.0.0/0 exposes management ports to the public internet, a massive security risk. Restrict to specific IP ranges or use AWS Systems Manager Session Manager.

AWS CLI command detected. Ensure AWS_PROFILE and AWS_DEFAULT_REGION are set correctly for the target environment.

RISK: Passing secret keys on the command line writes them to shell history and process listings (ps, /proc). FIX: Use 'aws configure' interactively, 'aws sso login', or set env vars in a file sourced once — never pass the secret as an argv.

IAM wildcard Action '*' grants full access to all AWS services. Use least-privilege — specify only the exact actions needed.

IAM Resource '*' applies permissions to all resources. Scope the resource ARN to the specific bucket, table, or service where possible.

Making an S3 bucket public exposes all objects to the internet. Use pre-signed URLs or CloudFront for controlled access instead.