83d8cfa829
fix(aws): treat security groups on Batch compute environments as used ( #12458 )
...
Co-authored-by: hackertwinten <193916571+hackertwinten@users.noreply.github.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-08-24 16:18:56 +02:00
Jonathan Nguyen and Hugo P.Brito
f39c92b8f8
feat(bedrock): add model artifact and guardrail grounding security checks for the AWS provider ( #12459 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-08-21 10:50:34 +01:00
Eugene C. and Hugo P.Brito
0b9791ffdc
feat(ecr): add ecr_repository_image_no_secrets check ( #12123 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-08-18 11:10:07 +01:00
ye11oc4t and Hugo P.Brito
f3224d0988
fix(ses): evaluate all identity authorization policies ( #12464 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-08-17 14:19:45 +01:00
2cd93fe119
fix(sdk): skip undescribed ECS task definitions ( #12217 )
...
Co-authored-by: Nguyễn Công Thuận Huy <nguyencongthuanhuy@gmail.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-08-17 12:42:06 +01:00
Pedro Martín
0758c3585d
feat(rolesanywhere): flag profiles with unscoped sessions ( #12416 )
2026-08-13 17:06:24 +02:00
praneetrajv and Daniel Barranquero
94594d6766
feat(batch): add batch_job_definition_no_secrets check ( #12117 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-08-07 11:57:58 +02:00
6e71dee85d
feat(awslambda): add awslambda_layer_no_secrets_in_content check ( #12233 )
...
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
Co-authored-by: Claude Opus 5 <noreply@anthropic.com >
2026-08-07 11:33:54 +02:00
Pedro Martín
8bf788ea95
fix(aws): delegated administrator lookup and reporting ( #12319 )
2026-08-05 09:48:00 +02:00
Daniel Barranquero
a19fd70001
feat(aws): add pathfinding.cloud privilege-escalation coverage ( #12237 )
2026-08-04 08:59:52 +02:00
lydiavilchez
f19106281b
feat(aws): add Nitro Enclaves security checks for EC2 and KMS ( #12283 )
2026-08-03 13:00:26 +02:00
0b98a34687
feat(aws): add glue_catalog_connection_no_secrets check ( #11963 )
...
Signed-off-by: Alex Chen <l46983284@gmail.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
Co-authored-by: Rishi943 <84287593+Rishi943@users.noreply.github.com >
Co-authored-by: Utkarsh <udaydeepak1928@gmail.com >
2026-07-30 15:12:37 +02:00
Siddhant Jadhav and Daniel Barranquero
fc0204a40d
feat(codecommit): add codecommit service and codecommit_repository_no_secrets check ( #11846 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-30 15:05:27 +02:00
7a6a35afec
feat(sagemaker): add sagemaker_endpoint_config_kms_encryption_enabled check ( #12118 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
Co-authored-by: Alex Chen <l46983284@gmail.com >
2026-07-30 14:29:45 +02:00
Nithin Reddy and Daniel Barranquero
339930ef13
feat(ec2): add ec2_instance_stopped_older_than_specific_days check ( #12076 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-27 09:13:18 +02:00
kiranrajsg and Daniel Barranquero
97233189c3
feat(sagemaker): add sagemaker_notebook_instance_no_secrets check ( #11843 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-21 10:44:41 +02:00
Hugo Pereira Brito
8e9af708f8
feat(aws): add elbv2_listener_pqc_tls_enabled security check ( #11254 )
2026-07-15 12:45:23 +01:00
Deep Shah and Daniel Barranquero
24b670ac36
feat(sdk): add AWS Amplify app secret scanning check ( #11825 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-15 13:44:20 +02:00
Adrián Peña
470e218bb8
fix(sdk): preserve regional IMDSv2 account findings ( #11959 )
2026-07-13 17:32:08 +02:00
Hugo Pereira Brito
0f6137dd04
fix(aws): target EC2 Amazon AMI loading ( #11945 )
2026-07-13 15:33:30 +01:00
Hugo Pereira Brito
c6dae3a711
chore: remove __init__.py from test directories ( #10582 )
2026-07-13 15:09:42 +01:00
GOUTHAM HARIGOVIND and Daniel Barranquero
3369e48260
feat(ec2): Implement AMI block public access check ( #11794 ) ( #11828 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-10 13:10:15 +02:00
1ee4de18be
chore: add trailing newlines to 7 files for POSIX compliance ( #11765 )
...
Co-authored-by: Janderik Marins <janderik@email.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-09 18:19:55 +02:00
Yinka Metrics and Daniel Barranquero
0b36d08b92
feat(sdk): add Data Pipeline secret scanning check ( #11821 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-09 16:21:05 +02:00
Narahari Raghava and Daniel Barranquero
13bd6fc0bf
fix(aws): check statement Effect instead of policy Statement in SCP a… ( #11727 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-09 11:19:33 +02:00
Hugo Pereira Brito
25bcbac309
fix(dms): lazy load ec2 for public access check ( #11899 )
2026-07-08 16:42:23 +01:00
Hugo Pereira Brito
20aad80a78
fix(aws): avoid full ec2 inventory in dlm check ( #11850 )
2026-07-08 15:59:16 +01:00
Hugo Pereira Brito
991c204a88
fix(sdk): limit ECS task definitions by registration date ( #11868 )
2026-07-08 13:09:25 +01:00
Son Sulung Suryahatta Asnan and Daniel Barranquero
e1b23e2526
feat(s3): new check s3_bucket_object_public to detect public objects ( #9517 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-02 11:41:29 +02:00
Chirag Trivedi and Daniel Barranquero
3f8c1e822f
feat(apigateway): add check for secrets in REST API stage variables ( #11188 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-01 14:24:18 +02:00
Sergio Garcia
1e1c1c018b
feat(iam): add AWS Bedrock AgentCore privilege escalation paths ( #11726 )
2026-07-01 12:49:34 +02:00
Hugo Pereira Brito and Daniel Barranquero
fd38a0ac03
feat(awslambda): add secrets_ignore_files to skip false-positive files (e.g. *.deps.json) in no-secrets-in-code check ( #11222 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-01 09:03:25 +01:00
Hugo Pereira Brito
c46cbaaa4a
feat(sdk): limit selected high-volume AWS resource analysis ( #11228 )
2026-06-30 15:49:12 +01:00
Daniel Barranquero
5dac8a0a53
feat(sdk): replace detect-secrets library with kingfisher ( #11694 )
2026-06-30 15:36:23 +02:00
Siddhant Jadhav and Lydia Vilchez
086805df1d
feat(waf): add check for regional web ACL logging enabled ( #11539 )
...
Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com >
2026-06-26 12:31:44 +02:00
Siddhant Jadhav and Daniel Barranquero
9b8b77cec0
feat(stepfunctions): add check for state machine encryption at rest ( #11538 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-06-25 17:14:50 +02:00
Pedro Martín and Hugo P.Brito
04e6e330a7
feat(aws): add rolesanywhere service and pqc trust anchor check ( #11319 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 18:39:16 +01:00
Pedro Martín and Hugo P.Brito
bdd44a0dce
feat(aws): add acmpca service and pqc key algorithm check ( #11318 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 17:13:17 +01:00
Pedro Martín and Hugo P.Brito
10d9fc35e6
feat(aws): add cloudfront_distributions_pqc_tls_enabled check ( #11317 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 16:44:51 +01:00
Pedro Martín and Hugo P.Brito
ca48fd0719
feat(aws): add apigateway_domain_name_pqc_tls_enabled check ( #11316 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 16:12:01 +01:00
Pedro Martín and Hugo P.Brito
45cfe4e411
feat(aws): add transfer_server_pqc_ssh_kex_enabled check ( #11315 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 14:30:15 +01:00
Pepe Fagoaga
810d8d7686
chore(codepipeline): verify if repo is public with TLS ( #11603 )
2026-06-16 09:35:11 +02:00
Branch Vincent and Pepe Fagoaga
dccd674cf9
chore(sdk): support Python 3.13 ( #9293 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-06-15 10:59:51 +02:00
Oleksandr_Sanin and Daniel Barranquero
bba594a1db
feat(aws/sagemaker): add sagemaker_clarify_exists check ( #11211 )
...
Signed-off-by: Oleksandr Sanin <alexaaander.sanin@gmail.com >
Signed-off-by: Oleksandr Yizchak Sanin <alexaaander.sanin@gmail.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-06-11 17:40:41 +02:00
Zeus Almightee and Lydia Vilchez
ce27053c2d
feat(aws): add securityhub + config org-wide delegated admin checks ( #11259 )
...
Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com >
2026-06-11 16:53:28 +02:00
Daniel Barranquero
989c3b174e
fix(bedrock): per-finding severity for long-term API key check ( #11526 )
2026-06-11 08:31:08 +02:00
e085e14247
fix(aws): order-independent CloudWatch metric filter pattern checks ( #11345 )
...
Co-authored-by: Sahil Pugalia <sahil-sols@users.noreply.github.com >
Co-authored-by: Cursor <cursoragent@cursor.com >
Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com >
2026-06-10 18:49:06 +02:00
Aryan Bhaskar and Daniel Barranquero
ec0bb53839
feat(bedrock): add bedrock_agent_role_least_privilege check ( #11335 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-06-10 12:40:54 +02:00
potato-20 and Hugo P.Brito
6f172a5c19
feat(elbv2): add elbv2_alb_drop_invalid_header_fields_enabled check (FSBP ELB.4) ( #11471 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-05 14:26:07 +02:00
d573af911d
feat(aws): add sagemaker_models_monitor_enabled check ( #11278 )
...
Co-authored-by: RishiWig3 <rishi.wig@gmail.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-06-02 16:10:13 +01:00
