{ "tokens_out": 4842, "outcome": "needs_credentials", "suggested_fix": "Use the normal credential setup for a future live run; keep the credential-free check results.", "cycle_checks": null, "fault": { "owner": "prerequisite", "status": "diagnosed", "reason": "missing prerequisite cannot prove a working operation: {\"returncode\": 3, \"stdout\": \"t bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \\u2014 the dangerous combination is the join on a shared bucket ARN. The Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side's scope is its own ARN (asset.ID), which the resolver returns when the property path is absent on the storage asset.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.BEDROCK.KB.MARKER.INDEXES.001\\\",\\n \\\"CTL.S3.MARKER.PHI.001\\\"\\n ],\\n \\\"compound_score\\\": 18,\\n \\\"severity\\\": \\\"critical\\\",\\n \\\"narrative\\\": \\\"Bedrock knowledge base indexes an S3 bucket AND that bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \\u2014 the dangerous combination is the join on a shared bucket ARN. The Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side's scope is its own ARN (asset.ID), which the resolver returns when the property path is absent on the storage asset.\\\\n Failing: CTL.BEDROCK.KB.MARKER.INDEXES.001, CTL.S3.MARKER.PHI.001.\\\"\\n }\\n ],\\n \\\"near_miss_chains\\\": [\\n {\\n \\\"chain\\\": \\\"bedrock_agent_data_exfiltration\\\",\\n \\\"description\\\": \\\"Bedrock agent execution role grants broad lambda:InvokeFunction on Resource: *, the agent's tool list references a Lambda that no longer exists (ghost reference), and the agent role has overbroad S3 write. An attacker who gains prompt control can invoke arbitrary Lambdas (including ones replaced by an adversary via the ghost ARN), and the agent role can write exfiltrated data to S3 buckets outside the intended tenant boundary. All three conditions must stack: broad Lambda reach provides the mechanism, the ghost reference provides the exploitation vector, and overbroad S3 provides the exfiltration destination. Drop any one and the chain breaks.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.BEDROCK.AGENT.OVERPERM.LAMBDA.001\\\",\\n \\\"CTL.BEDROCK.AGENT.OVERPERM.S3.001\\\"\\n ],\\n \\\"missing_control\\\": \\\"CTL.BEDROCK.AGENT.GHOST.LAMBDA.001\\\",\\n \\\"severity\\\": \\\"critical\\\",\\n \\\"scope_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\"\\n },\\n {\\n \\\"chain\\\": \\\"bedrock_to_dynamodb_lateral\\\",\\n \\\"description\\\": \\\"Bedrock agent has an overbroad IAM role and DynamoDB is accessible without a VPC endpoint policy restriction \\u2014 a compromised or prompt-injected agent can read or write arbitrary DynamoDB tables via the public API. The first leg detects that the Bedrock agent's role grants overbroad S3 or data-access permissions (CTL.BEDROCK.AGENT.OVERPERM.S3.001) \\u2014 the role is not scoped to specific resources. The second leg detects that no VPC endpoint enforces a restrictive policy on DynamoDB access (CTL.DYNAMODB.VPC.ENDPOINT.001) \\u2014 the agent reaches DynamoDB over the public endpoint with no network-level constraint. Together: agent compromise via prompt injection or tool misuse yields unrestricted DynamoDB access across every table the overbroad role permits. Bedrock agents with knowledge bases commonly access DynamoDB for retrieval-augmented generation; this IAM-path lateral movement pattern is the agentic equivalent of the Lambda\\u2192DynamoDB pattern. Removing either leg breaks the chain: scope the agent role to specific tables and actions, OR enforce a VPC endpoint policy that restricts DynamoDB access to authorized agent roles only.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.BEDROCK.AGENT.OVERPERM.S3.001\\\"\\n ],\\n \\\"missing_control\\\": \\\"CTL.DYNAMODB.VPC.ENDPOINT.001\\\",\\n \\\"severity\\\": \\\"high\\\",\\n \\\"scope_id\\\": \\\"__global__\\\"\\n },\\n {\\n \\\"chain\\\": \\\"cognito_unauth_phi_s3\\\",\\n \\\"description\\\": \\\"Cognito identity pool admits anonymous AWS credentials AND its unauthenticated role carries S3 actions AND the action target is an S3 bucket tagged data-classification=phi. The compound describes an internet-to-PHI data path that no individual control catches: UNAUTH.S3 alone fires on any S3 access (over-broad signal); the PHI marker alone is the desired state. Their conjunction over a shared bucket ARN \\u2014 surfaced via scope_field on the bucket's identity \\u2014 is the HIPAA-reportable shape.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.S3.MARKER.PHI.001\\\"\\n ],\\n \\\"missing_control\\\": \\\"CTL.COGNITO.IDPOOL.UNAUTH.S3.001\\\",\\n \\\"severity\\\": \\\"critical\\\",\\n \\\"scope_id\\\": \\\"arn:aws:s3:::patient-records\\\"\\n },\\n {\\n \\\"chain\\\": \\\"intent_expiry_unclassified_ai_datasource\\\",\\n \\\"description\\\": \\\"Intent-expiry compound on AI data sources \\u2014 a Bedrock knowledge base indexes an S3 bucket AND that bucket has no data-classification tag. The protection chains that detect sensitive-data exposure through AI tool chains (bedrock_rag_phi_exposure and others) all condition on the classification marker. When the marker is absent, those chains go silent \\u2014 not because the data is safe, but because the operator has not declared what the bucket contains. If the bucket holds PHI, PII, or other sensitive data, the protection gap is invisible.\\\\nThis is the \\\\\\\"tag existed Monday, gone Tuesday\\\\\\\" failure mode surfaced on a single snapshot: any KB-indexed bucket missing the data-classification declaration is a coverage gap whether the tag was removed yesterday or was never applied. The failure mode is the absence of the declaration, not the history of how it disappeared.\\\\nSame scope_field pattern as bedrock_rag_phi_exposure: the Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side falls back to its own asset.ID (the bucket ARN) when the property path is absent, so the chain groups by the shared bucket ARN.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.BEDROCK.KB.MARKER.INDEXES.001\\\"\\n ],\\n \\\"missing_control\\\": \\\"CTL.S3.CLASSIFY.COVERAGE.001\\\",\\n \\\"severity\\\": \\\"high\\\",\\n \\\"scope_id\\\": \\\"arn:aws:s3:::patient-records\\\"\\n }\\n ],\\n \\\"issues\\\": [\\n {\\n \\\"issue_id\\\": \\\"sha256:7dc1980d74d52774\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"shared_keys\\\": [\\n \\\"ai.agent\\\",\\n \\\"ai.agent.guardrail_associated\\\",\\n \\\"ai.agent.invocation_logging_enabled\\\",\\n \\\"ai.agent.lambda_invoke_scope_broad\\\",\\n \\\"ai.agent.s3_access_scope_broad\\\",\\n \\\"ai.kind\\\"\\n ],\\n \\\"headline_finding_id\\\": \\\"sha256:6ba94d07bc8f4058\\\",\\n \\\"member_finding_ids\\\": [\\n \\\"sha256:3341778eee9e6787\\\",\\n \\\"sha256:6ba94d07bc8f4058\\\",\\n \\\"sha256:b67ada4bcce5ce5d\\\",\\n \\\"sha256:bdfeaa27cfcbeb98\\\",\\n \\\"sha256:c796b99eb9b808b9\\\"\\n ],\\n \\\"consolidated_score\\\": 100,\\n \\\"consolidated_blast_radius\\\": 1\\n },\\n {\\n \\\"issue_id\\\": \\\"sha256:5eca1e86755ea761\\\",\\n \\\"asset_id\\\": \\\"arn:aws:lambda:us-east-1:111122223333:function:patient-lookup-tool\\\",\\n \\\"shared_keys\\\": [\\n \\\"compute.bedrock\\\",\\n \\\"compute.bedrock.role_reaches_phi_bucket\\\"\\n ],\\n \\\"headline_finding_id\\\": \\\"sha256:ade5b73d64ba2615\\\",\\n \\\"member_finding_ids\\\": [\\n \\\"sha256:ade5b73d64ba2615\\\"\\n ],\\n \\\"consolidated_score\\\": 100,\\n \\\"consolidated_blast_radius\\\": 1\\n },\\n {\\n \\\"issue_id\\\": \\\"sha256:0b397ed316a32837\\\",\\n \\\"asset_id\\\": \\\"arn:aws:s3:::patient-records\\\",\\n \\\"shared_keys\\\": [\\n \\\"storage.object_ownership\\\",\\n \\\"storage.object_ownership.rule\\\"\\n ],\\n \\\"headline_finding_id\\\": \\\"sha256:f56a113f19738662\\\",\\n \\\"member_finding_ids\\\": [\\n \\\"sha256:f56a113f19738662\\\"\\n ],\\n \\\"consolidated_score\\\": 75,\\n \\\"consolidated_blast_radius\\\": 1\\n }\\n ],\\n \\\"top_exposures\\\": [\\n {\\n \\\"finding_index\\\": 1,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.GUARDRAIL.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 100,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1.5,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 2,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.LOGGING.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 100,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1.5,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 3,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.OVERPERM.LAMBDA.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 100,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1.5,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 5,\\n \\\"control_id\\\": \\\"CTL.LAMBDA.OVERPERM.S3PHI.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:lambda:us-east-1:111122223333:function:patient-lookup-tool\\\",\\n \\\"exposure_score\\\": 100,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1.5,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 4,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.OVERPERM.S3.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 75,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 6,\\n \\\"control_id\\\": \\\"CTL.S3.OWNERSHIP.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:s3:::patient-records\\\",\\n \\\"exposure_score\\\": 75,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 0,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.CLASSIC.DEPRECATED.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 50,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 50,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n }\\n ],\\n \\\"coverage_posture\\\": {\\n \\\"pmapper\\\": {\\n \\\"_unmatched\\\": {\\n \\\"covered\\\": 1,\\n \\\"total\\\": 0,\\n \\\"not_covered_checks\\\": []\\n }\\n },\\n \\\"prowler\\\": {\\n \\\"_unmatched\\\": {\\n \\\"covered\\\": 1,\\n \\\"total\\\": 0,\\n \\\"not_covered_checks\\\": []\\n },\\n \\\"iam\\\": {\\n \\\"covered\\\": 44,\\n \\\"total\\\": 47,\\n \\\"not_covered_checks\\\": [\\n \\\"iam_role_cross_account_readonlyaccess_policy\\\",\\n \\\"iam_root_credentials_management_enabled\\\",\\n \\\"iam_securityaudit_role_created\\\"\\n ]\\n },\\n \\\"s3\\\": {\\n \\\"covered\\\": 20,\\n \\\"total\\\": 21,\\n \\\"not_covered_checks\\\": [\\n \\\"s3_bucket_event_notifications_enabled\\\"\\n ]\\n }\\n }\\n },\\n \\\"extensions\\\": {\\n \\\"selected_controls_source\\\": \\\"dir\\\",\\n \\\"context_name\\\": \\\"workspace\\\",\\n \\\"resolved_paths\\\": {\\n \\\"controls\\\": \\\"\\\",\\n \\\"observations\\\": \\\"observations\\\"\\n }\\n }\\n}\\n\", \"stderr\": \"warning: 2 critical/high findings not in any chain (use --include-atomic to see)\\n\\u26a0 3 warnings suppressed. Run with --verbose to view.\\n\", \"needs_credentials\": true, \"needs_browser\": false}", "evidence": [] }, "runtime_revision": null, "agent_execution": "native_agent", "time_to_working_s": null, "usage_complete": true, "runtime": null, "architecture": null, "local_or_hosted": null, "agent_interfaces_note": null, "platform_details": null, "platforms_claimed": null, "maintenance": null, "evidence_strength": null, "purpose": "initial", "topic": null, "needs_which": null, "tested_with": null, "native_bundle": null, "agent_runtime": "claude-code", "maintenance_note": null, "runtime_version": null, "does_what_it_says": null, "commit": "6f44c6240953cf99416b69a7cf6162f76323898f", "failure_origin": null, "stuck_step": " apply --observations examples/demo-ai-security/fixtures/writeup-config/observations --eval-time 2026-05-10T00:00:00Z --max-unsafe 168h --format json", "repo_url": null, "needs": null, "checks": [ { "check": "operation", "status": "FAIL", "details": { "working": false, "argv": [ "apply", "--observations", "examples/demo-ai-security/fixtures/writeup-config/observations", "--eval-time", "2026-05-10T00:00:00Z", "--max-unsafe", "168h", "--format", "json" ], "kind": "cli", "returncode": 3, "stdout": "t bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \u2014 the dangerous combination is the join on a shared bucket ARN. The Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side's scope is its own ARN (asset.ID), which the resolver returns when the property path is absent on the storage asset.\\n\",\n \"controls_failing\": [\n \"CTL.BEDROCK.KB.MARKER.INDEXES.001\",\n \"CTL.S3.MARKER.PHI.001\"\n ],\n \"compound_score\": 18,\n \"severity\": \"critical\",\n \"narrative\": \"Bedrock knowledge base indexes an S3 bucket AND that bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \u2014 the dangerous combination i\n[excerpt truncated]", "stderr": "warning: 2 critical/high findings not in any chain (use --include-atomic to see)\n\u26a0 3 warnings suppressed. Run with --verbose to view.", "needs_credentials": true, "needs_browser": false, "blocker": "missing prerequisite cannot prove a working operation: {\"returncode\": 3, \"stdout\": \"t bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \\u2014 the dangerous combination is the join on a shared bucket ARN. The Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side's scope is its own ARN (asset.ID), which the resolver returns when the property path is absent on the storage asset.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.BEDROCK.KB.MARKER.INDEXES.001\\\",\\n \\\"CTL.S3.MARKER.PHI.001\\\"\\n ],\\n \\\"compound_score\\\": 18,\\n \\\"severity\\\": \\\"critical\\\",\\n \\\"narrative\\\": \\\"Bedrock knowledge base indexes an S3 bucket AND that bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \\u2014 the dangerous combination is the join on a shared bucket ARN. The Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side's scope is its own ARN (asset.ID), which the resolver returns when the property path is absent on the storage asset.\\\\n Failing: CTL.BEDROCK.KB.MARKER.INDEXES.001, CTL.S3.MARKER.PHI.001.\\\"\\n }\\n ],\\n \\\"near_miss_chains\\\": [\\n {\\n \\\"chain\\\": \\\"bedrock_agent_data_exfiltration\\\",\\n \\\"description\\\": \\\"Bedrock agent execution role grants broad lambda:InvokeFunction on Resource: *, the agent's tool list references a Lambda that no longer exists (ghost reference), and the agent role has overbroad S3 write. An attacker who gains prompt control can invoke arbitrary Lambdas (including ones replaced by an adversary via the ghost ARN), and the agent role can write exfiltrated data to S3 buckets outside the intended tenant boundary. All three conditions must stack: broad Lambda reach provides the mechanism, the ghost reference provides the exploitation vector, and overbroad S3 provides the exfiltration destination. Drop any one and the chain breaks.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.BEDROCK.AGENT.OVERPERM.LAMBDA.001\\\",\\n \\\"CTL.BEDROCK.AGENT.OVERPERM.S3.001\\\"\\n ],\\n \\\"missing_control\\\": \\\"CTL.BEDROCK.AGENT.GHOST.LAMBDA.001\\\",\\n \\\"severity\\\": \\\"critical\\\",\\n \\\"scope_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\"\\n },\\n {\\n \\\"chain\\\": \\\"bedrock_to_dynamodb_lateral\\\",\\n \\\"description\\\": \\\"Bedrock agent has an overbroad IAM role and DynamoDB is accessible without a VPC endpoint policy restriction \\u2014 a compromised or prompt-injected agent can read or write arbitrary DynamoDB tables via the public API. The first leg detects that the Bedrock agent's role grants overbroad S3 or data-access permissions (CTL.BEDROCK.AGENT.OVERPERM.S3.001) \\u2014 the role is not scoped to specific resources. The second leg detects that no VPC endpoint enforces a restrictive policy on DynamoDB access (CTL.DYNAMODB.VPC.ENDPOINT.001) \\u2014 the agent reaches DynamoDB over the public endpoint with no network-level constraint. Together: agent compromise via prompt injection or tool misuse yields unrestricted DynamoDB access across every table the overbroad role permits. Bedrock agents with knowledge bases commonly access DynamoDB for retrieval-augmented generation; this IAM-path lateral movement pattern is the agentic equivalent of the Lambda\\u2192DynamoDB pattern. Removing either leg breaks the chain: scope the agent role to specific tables and actions, OR enforce a VPC endpoint policy that restricts DynamoDB access to authorized agent roles only.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.BEDROCK.AGENT.OVERPERM.S3.001\\\"\\n ],\\n \\\"missing_control\\\": \\\"CTL.DYNAMODB.VPC.ENDPOINT.001\\\",\\n \\\"severity\\\": \\\"high\\\",\\n \\\"scope_id\\\": \\\"__global__\\\"\\n },\\n {\\n \\\"chain\\\": \\\"cognito_unauth_phi_s3\\\",\\n \\\"description\\\": \\\"Cognito identity pool admits anonymous AWS credentials AND its unauthenticated role carries S3 actions AND the action target is an S3 bucket tagged data-classification=phi. The compound describes an internet-to-PHI data path that no individual control catches: UNAUTH.S3 alone fires on any S3 access (over-broad signal); the PHI marker alone is the desired state. Their conjunction over a shared bucket ARN \\u2014 surfaced via scope_field on the bucket's identity \\u2014 is the HIPAA-reportable shape.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.S3.MARKER.PHI.001\\\"\\n ],\\n \\\"missing_control\\\": \\\"CTL.COGNITO.IDPOOL.UNAUTH.S3.001\\\",\\n \\\"severity\\\": \\\"critical\\\",\\n \\\"scope_id\\\": \\\"arn:aws:s3:::patient-records\\\"\\n },\\n {\\n \\\"chain\\\": \\\"intent_expiry_unclassified_ai_datasource\\\",\\n \\\"description\\\": \\\"Intent-expiry compound on AI data sources \\u2014 a Bedrock knowledge base indexes an S3 bucket AND that bucket has no data-classification tag. The protection chains that detect sensitive-data exposure through AI tool chains (bedrock_rag_phi_exposure and others) all condition on the classification marker. When the marker is absent, those chains go silent \\u2014 not because the data is safe, but because the operator has not declared what the bucket contains. If the bucket holds PHI, PII, or other sensitive data, the protection gap is invisible.\\\\nThis is the \\\\\\\"tag existed Monday, gone Tuesday\\\\\\\" failure mode surfaced on a single snapshot: any KB-indexed bucket missing the data-classification declaration is a coverage gap whether the tag was removed yesterday or was never applied. The failure mode is the absence of the declaration, not the history of how it disappeared.\\\\nSame scope_field pattern as bedrock_rag_phi_exposure: the Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side falls back to its own asset.ID (the bucket ARN) when the property path is absent, so the chain groups by the shared bucket ARN.\\\\n\\\",\\n \\\"controls_failing\\\": [\\n \\\"CTL.BEDROCK.KB.MARKER.INDEXES.001\\\"\\n ],\\n \\\"missing_control\\\": \\\"CTL.S3.CLASSIFY.COVERAGE.001\\\",\\n \\\"severity\\\": \\\"high\\\",\\n \\\"scope_id\\\": \\\"arn:aws:s3:::patient-records\\\"\\n }\\n ],\\n \\\"issues\\\": [\\n {\\n \\\"issue_id\\\": \\\"sha256:7dc1980d74d52774\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"shared_keys\\\": [\\n \\\"ai.agent\\\",\\n \\\"ai.agent.guardrail_associated\\\",\\n \\\"ai.agent.invocation_logging_enabled\\\",\\n \\\"ai.agent.lambda_invoke_scope_broad\\\",\\n \\\"ai.agent.s3_access_scope_broad\\\",\\n \\\"ai.kind\\\"\\n ],\\n \\\"headline_finding_id\\\": \\\"sha256:6ba94d07bc8f4058\\\",\\n \\\"member_finding_ids\\\": [\\n \\\"sha256:3341778eee9e6787\\\",\\n \\\"sha256:6ba94d07bc8f4058\\\",\\n \\\"sha256:b67ada4bcce5ce5d\\\",\\n \\\"sha256:bdfeaa27cfcbeb98\\\",\\n \\\"sha256:c796b99eb9b808b9\\\"\\n ],\\n \\\"consolidated_score\\\": 100,\\n \\\"consolidated_blast_radius\\\": 1\\n },\\n {\\n \\\"issue_id\\\": \\\"sha256:5eca1e86755ea761\\\",\\n \\\"asset_id\\\": \\\"arn:aws:lambda:us-east-1:111122223333:function:patient-lookup-tool\\\",\\n \\\"shared_keys\\\": [\\n \\\"compute.bedrock\\\",\\n \\\"compute.bedrock.role_reaches_phi_bucket\\\"\\n ],\\n \\\"headline_finding_id\\\": \\\"sha256:ade5b73d64ba2615\\\",\\n \\\"member_finding_ids\\\": [\\n \\\"sha256:ade5b73d64ba2615\\\"\\n ],\\n \\\"consolidated_score\\\": 100,\\n \\\"consolidated_blast_radius\\\": 1\\n },\\n {\\n \\\"issue_id\\\": \\\"sha256:0b397ed316a32837\\\",\\n \\\"asset_id\\\": \\\"arn:aws:s3:::patient-records\\\",\\n \\\"shared_keys\\\": [\\n \\\"storage.object_ownership\\\",\\n \\\"storage.object_ownership.rule\\\"\\n ],\\n \\\"headline_finding_id\\\": \\\"sha256:f56a113f19738662\\\",\\n \\\"member_finding_ids\\\": [\\n \\\"sha256:f56a113f19738662\\\"\\n ],\\n \\\"consolidated_score\\\": 75,\\n \\\"consolidated_blast_radius\\\": 1\\n }\\n ],\\n \\\"top_exposures\\\": [\\n {\\n \\\"finding_index\\\": 1,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.GUARDRAIL.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 100,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1.5,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 2,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.LOGGING.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 100,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1.5,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 3,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.OVERPERM.LAMBDA.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 100,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1.5,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 5,\\n \\\"control_id\\\": \\\"CTL.LAMBDA.OVERPERM.S3PHI.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:lambda:us-east-1:111122223333:function:patient-lookup-tool\\\",\\n \\\"exposure_score\\\": 100,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1.5,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 4,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.OVERPERM.S3.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 75,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 6,\\n \\\"control_id\\\": \\\"CTL.S3.OWNERSHIP.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:s3:::patient-records\\\",\\n \\\"exposure_score\\\": 75,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 75,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n },\\n {\\n \\\"finding_index\\\": 0,\\n \\\"control_id\\\": \\\"CTL.BEDROCK.AGENT.CLASSIC.DEPRECATED.001\\\",\\n \\\"asset_id\\\": \\\"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\\\",\\n \\\"exposure_score\\\": 50,\\n \\\"breakdown\\\": {\\n \\\"base_score\\\": 50,\\n \\\"duration_factor\\\": 1,\\n \\\"blast_multiplier\\\": 1,\\n \\\"exposure_multiplier\\\": 1,\\n \\\"chain_bonus\\\": 1,\\n \\\"blind_multiplier\\\": 1,\\n \\\"days_blind\\\": 0\\n },\\n \\\"silent_killer\\\": false\\n }\\n ],\\n \\\"coverage_posture\\\": {\\n \\\"pmapper\\\": {\\n \\\"_unmatched\\\": {\\n \\\"covered\\\": 1,\\n \\\"total\\\": 0,\\n \\\"not_covered_checks\\\": []\\n }\\n },\\n \\\"prowler\\\": {\\n \\\"_unmatched\\\": {\\n \\\"covered\\\": 1,\\n \\\"total\\\": 0,\\n \\\"not_covered_checks\\\": []\\n },\\n \\\"iam\\\": {\\n \\\"covered\\\": 44,\\n \\\"total\\\": 47,\\n \\\"not_covered_checks\\\": [\\n \\\"iam_role_cross_account_readonlyaccess_policy\\\",\\n \\\"iam_root_credentials_management_enabled\\\",\\n \\\"iam_securityaudit_role_created\\\"\\n ]\\n },\\n \\\"s3\\\": {\\n \\\"covered\\\": 20,\\n \\\"total\\\": 21,\\n \\\"not_covered_checks\\\": [\\n \\\"s3_bucket_event_notifications_enabled\\\"\\n ]\\n }\\n }\\n },\\n \\\"extensions\\\": {\\n \\\"selected_controls_source\\\": \\\"dir\\\",\\n \\\"context_name\\\": \\\"workspace\\\",\\n \\\"resolved_paths\\\": {\\n \\\"controls\\\": \\\"\\\",\\n \\\"observations\\\": \\\"observations\\\"\\n }\\n }\\n}\\n\", \"stderr\": \"warning: 2 critical/high findings not in any chain (use --include-atomic to see)\\n\\u26a0 3 warnings suppressed. Run with --verbose to view.\\n\", \"needs_credentials\": true, \"needs_browser\": false}" } } ], "open_issues": null, "agent_runtime_version": "2.1.300 (Claude Code)", "verifies_run_id": null, "total_s": 403.9182164669037, "license": null, "tool_calls": 13, "model_version": "claude-haiku-5-5", "example_checks": [], "mcp": null, "other_model": null, "first_use_s": null, "native_tool_calls": 13, "last_commit_at": null, "source": "https://github.com/sufield/stave", "models_agree": null, "maintenance_verdict": null, "cost_usd": 0.008088960000000001, "safety": null, "answered_issues": null, "what_failed": null, "steps": [ "cd && ls -la && cat README.md 2>/dev/null | head -200", "cat 2>/dev/null | head -80; echo; echo CDP=$CDP_URL $; which python3 go cargo node npm pip3 2>&1", "cd && sed -n 200,400p README.md | grep -n -A12 -i \"^## \\|^### \" | head -150; echo ---; which go make; go version 2>&1; cat VERSION", "cd && grep -m3 \"^go \\|^toolchain\" go.mod; grep -n \"^build:\" -A6 Makefile; (sudo apt-get update -qq && sudo apt-get install -y -qq golang-go make >/tmp/apt.log 2>&1; echo apt=$?); go version", "cd && make build > /tmp/build.log 2>&1; echo rc=$?; tail -15 /tmp/build.log; ls -la stave 2>&1", "cd && ./stave --version; ./stave apply --help 2>&1 | head -30; ls examples/demo-ai-security/ 2>&1; ls testdata | head; sed -n 80,200p | grep -n \"validate\\|probe.json\\|report\" | head -30", "cd && ls testdata/s3-snapshots | head; ./stave apply --observations testdata/s3-snapshots --format json > /tmp/apply1.json 2>/tmp/apply1.err; echo rc=$?; head -c 600 /tmp/apply1.json; echo; tail -5 /tmp/apply1.err", "cd && ls testdata/s3-snapshots/public | head; ./stave apply --observations testdata/s3-snapshots/public --controls ./controls --format json > /tmp/apply2.json 2>/tmp/apply2.err; echo rc=$?; head -c 500 /tmp/apply2.json; echo; tail -5 /tmp/apply2.err; ls controls 2>&1 | head -3", "cd && cat examples/demo-ai-security/run.sh | head -60; ls examples/demo-ai-security/fixtures | head", "cd && ./stave apply --observations examples/demo-ai-security/fixtures/writeup-config/observations --eval-time 2026-05-10T00:00:00Z --max-unsafe 168h --format json > /tmp/demo.json 2>/tmp/demo.err; echo rc=$?; head -c 700 /tmp/demo.json; echo; tail -3 /tmp/demo.err; python3 -c \"import json;d=json.load(open('/tmp/demo.json'));print(type(d), list(d)[:10] if isinstance(d,dict) else len(d))\"", "cd && ./stave --help 2>&1 | grep -i -n \"mcp\\|serve\" ; ./stave mcp --help 2>&1 | head -20", "cd && ls -la .coldpass 2>&1; sed -n 200,330p | grep -n \"expected_text\\|expected_returncode\\|def validate\\|'checks'\" | head -20", "mkdir -p && cd && cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"cli\",\"argv\":[\"\",\"apply\",\"--observations\",\"examples/demo-ai-security/fixtures/writeup-config/observations\",\"--eval-time\",\"2026-05-10T00:00:00Z\",\"--max-unsafe\",\"168h\",\"--format\",\"json\"],\"cwd\":\"\",\"expected_returncode\":3,\"expected_text\":\"\\\"violations\\\": 7\"}\nEOF\ncat > .coldpass/report.json <<'EOF'\n{\"outcome\":\"working\",\"operation\":\"Built stave from source (make build) and ran the demo evaluation: stave apply --observations examples/demo-ai-security/fixtures/writeup-config/observations --eval-time 2026-05-10T00:00:00Z --max-unsafe 168h --format json. It evaluated 1 snapshot, reported 4 assets, 7 violations, exit code 3 (findings present, as the demo documents).\",\"operation_scope\":\"Offline evaluation of local fixture JSON only; no AWS credentials or live API needed. MCP start/tools/list not applicable: the stave binary has no mcp command (stave mcp -> 'unknown command'). Browser (CDP) not needed.\",\"steps\":[\"apt-get install golang-go make (Go toolchain; go.mod requires go 1.27.2, fetched automatically via GOTOOLCHAIN)\",\"make build (sync-schemas/controls/chains/alternatives then go build -> ./stave, version edge)\",\"./stave --version\",\"./stave apply --observations examples/demo-ai-security/fixtures/writeup-config/observations --eval-time 2026-05-10T00:00:00Z --max-unsafe 168h --format json (rc=3, 7 violations)\"],\"deviations\":[\"README Install 'make build' needed Go, which was absent; installed golang-go and make via apt. Go 1.27.2 was then downloaded by the Go toolchain mechanism.\",\"'stave apply --observations ' with no --controls failed in testdata/s3-snapshots/public (default controls/ dir missing in this checkout); used the demo fixture path from examples/demo-ai-security/run.sh which works.\",\"make build emitted '/bin/sh: [: 0: unexpected operator' warning during sync steps; build still succeeded (rc=0).\"],\"stuck_step\":null,\"main_blocker\":null,\"suggested_fix\":null}\nEOF\n= python3 -I --validate; echo rc=$?" ], "platform_conflicts": null, "claims_note": null, "maintained_note": null, "repo": "sufield/stave", "service_tier": null, "maintained": null, "source_pin": null, "operation_scope": "Offline evaluation of local fixture JSON only; no AWS credentials or live API needed. MCP start/tools/list not applicable: the stave binary has no mcp command (stave mcp -> 'unknown command'). Browser (CDP) not needed.", "reasoning": "low", "claims": [], "platform": "linux", "cost_to_try": null, "backend": null, "tool_transport": "mcp-assigned-vm", "hardware": null, "agent_interface": null, "profile": { "model": "claude-haiku-5-5", "reasoning": "low" }, "date": "2026-10-18T01:48:27.017388+00:00", "kind": "repo", "resources": { "cpus": 2, "memory_mib": 2048, "disk_mib": 16384 }, "error_excerpt": "missing prerequisite cannot prove a working operation: {\"returncode\": 3, \"stdout\": \"t bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the ", "pass": null, "evidence_version": null, "source_revision": null, "run_id": "sufield--stave-claude-haiku-5-5-1792287703099155380", "last_release_at": null, "furthest_model": null, "model": "claude-haiku-5-5", "what_it_did": "Built stave from source (make build) and ran the demo evaluation: stave apply --observations examples/demo-ai-security/fixtures/writeup-config/observations --eval-time 2026-05-10T00:00:00Z --max-unsafe 168h --format json. It evaluated 1 snapshot, reported 4 assets, 7 violations, exit code 3 (findings present, as the demo documents).", "sandbox_source": null, "other_run_id": null, "hosting": null, "tested_commit": null, "guest_setup": null, "mcp_context": null, "agent_interfaces": [], "setup_identity": null, "works": null, "install_s": null, "fix_id": null, "tokens_in": 209324, "tested_at": null, "test_version": "readme-e6a0dc12478670826ea8024db79a4042e6ced638fcebab68b07bdd51e6eb2383", "recovery": { "source": "legacy-oct16-18", "original_run_id": "sufield--stave-claude-haiku-5-5-1792287703099155380", "historical": true, "ledger_sha256": "c5e6a833c182c1e2aecf69d0bd0020aec63c65d98f3e933e4b32232340312736" }, "transcript_url": "/transcripts/sufield--stave-claude-haiku-5-5-1792287703099155380.txt", "report_url": "/reports/sufield--stave-claude-haiku-5-5-1792287703099155380.json" }