mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
82 lines
2.5 KiB
Markdown
82 lines
2.5 KiB
Markdown
# API Reference: S3 Bucket Misconfiguration Remediation Agent
|
|
|
|
## Overview
|
|
|
|
Audits and remediates S3 bucket security: public access blocks, bucket policies, ACLs, encryption, versioning, and access logging using boto3.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| boto3 | >= 1.28 | AWS S3 API for audit and remediation |
|
|
|
|
## Audit Functions
|
|
|
|
### `check_public_access_block(s3, bucket)`
|
|
Verifies all four S3 Block Public Access settings are enabled.
|
|
- **Returns**: `dict` with `block_config`, `fully_blocked`
|
|
|
|
### `check_bucket_policy(s3, bucket)`
|
|
Parses bucket policy for `Principal: "*"` Allow statements.
|
|
- **Returns**: `dict` with `public_statements` list (risk: CRITICAL)
|
|
|
|
### `check_bucket_acl(s3, bucket)`
|
|
Checks ACL grants for AllUsers or AuthenticatedUsers URIs.
|
|
- **Returns**: `dict` with `public_grants` list
|
|
|
|
### `check_encryption(s3, bucket)`
|
|
Checks for default server-side encryption configuration.
|
|
- **Returns**: `dict` with `encrypted`, `algorithm` (AES256 or aws:kms)
|
|
|
|
### `check_versioning(s3, bucket)`
|
|
Checks versioning status and MFA Delete configuration.
|
|
- **Returns**: `dict` with `status`, `mfa_delete`
|
|
|
|
### `check_logging(s3, bucket)`
|
|
Verifies access logging is enabled with target bucket.
|
|
- **Returns**: `dict` with `logging_enabled`, `target_bucket`
|
|
|
|
### `audit_all_buckets(s3)`
|
|
Full audit across all buckets, sorted by issue count.
|
|
- **Returns**: `list[dict]` with risk rating per bucket
|
|
|
|
## Remediation Functions
|
|
|
|
### `enable_public_access_block(s3, bucket)`
|
|
Enables all four S3 Block Public Access settings.
|
|
|
|
### `enable_encryption(s3, bucket, algorithm)`
|
|
Configures default SSE-KMS or AES256 encryption with bucket key.
|
|
|
|
### `enable_versioning(s3, bucket)`
|
|
Enables S3 versioning on the bucket.
|
|
|
|
## AWS API Calls
|
|
|
|
| API Call | Purpose |
|
|
|----------|---------|
|
|
| `list_buckets` | Enumerate all buckets |
|
|
| `get_public_access_block` | Check block config |
|
|
| `put_public_access_block` | Apply block config |
|
|
| `get_bucket_policy` | Read bucket policy |
|
|
| `get_bucket_acl` | Read ACL grants |
|
|
| `get_bucket_encryption` | Check encryption |
|
|
| `put_bucket_encryption` | Enable encryption |
|
|
| `get_bucket_versioning` | Check versioning |
|
|
| `put_bucket_versioning` | Enable versioning |
|
|
| `get_bucket_logging` | Check access logging |
|
|
|
|
## Environment Variables
|
|
|
|
| Variable | Required | Description |
|
|
|----------|----------|-------------|
|
|
| `AWS_ACCESS_KEY_ID` | Yes | AWS credential |
|
|
| `AWS_SECRET_ACCESS_KEY` | Yes | AWS credential |
|
|
| `AWS_DEFAULT_REGION` | No | Default: us-east-1 |
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python agent.py us-east-1
|
|
```
|