sufield/stave

missing prerequisite cannot prove a working operation: {"returncode": 3, "stdout": "t bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \u2014 the dangerous combination is the join on a shared bucket ARN. The Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side's scope is its own ARN (asset.ID), which the resolver returns when the property path is absent on the storage asset.\\n\",\n \"controls_failing\": [\n \"CTL.BEDROCK.KB.MARKER.INDEXES.001\",\n \"CTL.S3.MARKER.PHI.001\"\n ],\n \"compound_score\": 18,\n \"severity\": \"critical\",\n \"narrative\": \"Bedrock knowledge base indexes an S3 bucket AND that bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \u2014 the dangerous combination is the join on a shared bucket ARN. The Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side's scope is its own ARN (asset.ID), which the resolver returns when the property path is absent on the storage asset.\\n Failing: CTL.BEDROCK.KB.MARKER.INDEXES.001, CTL.S3.MARKER.PHI.001.\"\n }\n ],\n \"near_miss_chains\": [\n {\n \"chain\": \"bedrock_agent_data_exfiltration\",\n \"description\": \"Bedrock agent execution role grants broad lambda:InvokeFunction on Resource: *, the agent's tool list references a Lambda that no longer exists (ghost reference), and the agent role has overbroad S3 write. An attacker who gains prompt control can invoke arbitrary Lambdas (including ones replaced by an adversary via the ghost ARN), and the agent role can write exfiltrated data to S3 buckets outside the intended tenant boundary. All three conditions must stack: broad Lambda reach provides the mechanism, the ghost reference provides the exploitation vector, and overbroad S3 provides the exfiltration destination. Drop any one and the chain breaks.\\n\",\n \"controls_failing\": [\n \"CTL.BEDROCK.AGENT.OVERPERM.LAMBDA.001\",\n \"CTL.BEDROCK.AGENT.OVERPERM.S3.001\"\n ],\n \"missing_control\": \"CTL.BEDROCK.AGENT.GHOST.LAMBDA.001\",\n \"severity\": \"critical\",\n \"scope_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\"\n },\n {\n \"chain\": \"bedrock_to_dynamodb_lateral\",\n \"description\": \"Bedrock agent has an overbroad IAM role and DynamoDB is accessible without a VPC endpoint policy restriction \u2014 a compromised or prompt-injected agent can read or write arbitrary DynamoDB tables via the public API. The first leg detects that the Bedrock agent's role grants overbroad S3 or data-access permissions (CTL.BEDROCK.AGENT.OVERPERM.S3.001) \u2014 the role is not scoped to specific resources. The second leg detects that no VPC endpoint enforces a restrictive policy on DynamoDB access (CTL.DYNAMODB.VPC.ENDPOINT.001) \u2014 the agent reaches DynamoDB over the public endpoint with no network-level constraint. Together: agent compromise via prompt injection or tool misuse yields unrestricted DynamoDB access across every table the overbroad role permits. Bedrock agents with knowledge bases commonly access DynamoDB for retrieval-augmented generation; this IAM-path lateral movement pattern is the agentic equivalent of the Lambda\u2192DynamoDB pattern. Removing either leg breaks the chain: scope the agent role to specific tables and actions, OR enforce a VPC endpoint policy that restricts DynamoDB access to authorized agent roles only.\\n\",\n \"controls_failing\": [\n \"CTL.BEDROCK.AGENT.OVERPERM.S3.001\"\n ],\n \"missing_control\": \"CTL.DYNAMODB.VPC.ENDPOINT.001\",\n \"severity\": \"high\",\n \"scope_id\": \"__global__\"\n },\n {\n \"chain\": \"cognito_unauth_phi_s3\",\n \"description\": \"Cognito identity pool admits anonymous AWS credentials AND its unauthenticated role carries S3 actions AND the action target is an S3 bucket tagged data-classification=phi. The compound describes an internet-to-PHI data path that no individual control catches: UNAUTH.S3 alone fires on any S3 access (over-broad signal); the PHI marker alone is the desired state. Their conjunction over a shared bucket ARN \u2014 surfaced via scope_field on the bucket's identity \u2014 is the HIPAA-reportable shape.\\n\",\n \"controls_failing\": [\n \"CTL.S3.MARKER.PHI.001\"\n ],\n \"missing_control\": \"CTL.COGNITO.IDPOOL.UNAUTH.S3.001\",\n \"severity\": \"critical\",\n \"scope_id\": \"arn:aws:s3:::patient-records\"\n },\n {\n \"chain\": \"intent_expiry_unclassified_ai_datasource\",\n \"description\": \"Intent-expiry compound on AI data sources \u2014 a Bedrock knowledge base indexes an S3 bucket AND that bucket has no data-classification tag. The protection chains that detect sensitive-data exposure through AI tool chains (bedrock_rag_phi_exposure and others) all condition on the classification marker. When the marker is absent, those chains go silent \u2014 not because the data is safe, but because the operator has not declared what the bucket contains. If the bucket holds PHI, PII, or other sensitive data, the protection gap is invisible.\\nThis is the \\\"tag existed Monday, gone Tuesday\\\" failure mode surfaced on a single snapshot: any KB-indexed bucket missing the data-classification declaration is a coverage gap whether the tag was removed yesterday or was never applied. The failure mode is the absence of the declaration, not the history of how it disappeared.\\nSame scope_field pattern as bedrock_rag_phi_exposure: the Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side falls back to its own asset.ID (the bucket ARN) when the property path is absent, so the chain groups by the shared bucket ARN.\\n\",\n \"controls_failing\": [\n \"CTL.BEDROCK.KB.MARKER.INDEXES.001\"\n ],\n \"missing_control\": \"CTL.S3.CLASSIFY.COVERAGE.001\",\n \"severity\": \"high\",\n \"scope_id\": \"arn:aws:s3:::patient-records\"\n }\n ],\n \"issues\": [\n {\n \"issue_id\": \"sha256:7dc1980d74d52774\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"shared_keys\": [\n \"ai.agent\",\n \"ai.agent.guardrail_associated\",\n \"ai.agent.invocation_logging_enabled\",\n \"ai.agent.lambda_invoke_scope_broad\",\n \"ai.agent.s3_access_scope_broad\",\n \"ai.kind\"\n ],\n \"headline_finding_id\": \"sha256:6ba94d07bc8f4058\",\n \"member_finding_ids\": [\n \"sha256:3341778eee9e6787\",\n \"sha256:6ba94d07bc8f4058\",\n \"sha256:b67ada4bcce5ce5d\",\n \"sha256:bdfeaa27cfcbeb98\",\n \"sha256:c796b99eb9b808b9\"\n ],\n \"consolidated_score\": 100,\n \"consolidated_blast_radius\": 1\n },\n {\n \"issue_id\": \"sha256:5eca1e86755ea761\",\n \"asset_id\": \"arn:aws:lambda:us-east-1:111122223333:function:patient-lookup-tool\",\n \"shared_keys\": [\n \"compute.bedrock\",\n \"compute.bedrock.role_reaches_phi_bucket\"\n ],\n \"headline_finding_id\": \"sha256:ade5b73d64ba2615\",\n \"member_finding_ids\": [\n \"sha256:ade5b73d64ba2615\"\n ],\n \"consolidated_score\": 100,\n \"consolidated_blast_radius\": 1\n },\n {\n \"issue_id\": \"sha256:0b397ed316a32837\",\n \"asset_id\": \"arn:aws:s3:::patient-records\",\n \"shared_keys\": [\n \"storage.object_ownership\",\n \"storage.object_ownership.rule\"\n ],\n \"headline_finding_id\": \"sha256:f56a113f19738662\",\n \"member_finding_ids\": [\n \"sha256:f56a113f19738662\"\n ],\n \"consolidated_score\": 75,\n \"consolidated_blast_radius\": 1\n }\n ],\n \"top_exposures\": [\n {\n \"finding_index\": 1,\n \"control_id\": \"CTL.BEDROCK.AGENT.GUARDRAIL.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 100,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1.5,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 2,\n \"control_id\": \"CTL.BEDROCK.AGENT.LOGGING.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 100,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1.5,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 3,\n \"control_id\": \"CTL.BEDROCK.AGENT.OVERPERM.LAMBDA.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 100,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1.5,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 5,\n \"control_id\": \"CTL.LAMBDA.OVERPERM.S3PHI.001\",\n \"asset_id\": \"arn:aws:lambda:us-east-1:111122223333:function:patient-lookup-tool\",\n \"exposure_score\": 100,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1.5,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 4,\n \"control_id\": \"CTL.BEDROCK.AGENT.OVERPERM.S3.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 75,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 6,\n \"control_id\": \"CTL.S3.OWNERSHIP.001\",\n \"asset_id\": \"arn:aws:s3:::patient-records\",\n \"exposure_score\": 75,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 0,\n \"control_id\": \"CTL.BEDROCK.AGENT.CLASSIC.DEPRECATED.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 50,\n \"breakdown\": {\n \"base_score\": 50,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n }\n ],\n \"coverage_posture\": {\n \"pmapper\": {\n \"_unmatched\": {\n \"covered\": 1,\n \"total\": 0,\n \"not_covered_checks\": []\n }\n },\n \"prowler\": {\n \"_unmatched\": {\n \"covered\": 1,\n \"total\": 0,\n \"not_covered_checks\": []\n },\n \"iam\": {\n \"covered\": 44,\n \"total\": 47,\n \"not_covered_checks\": [\n \"iam_role_cross_account_readonlyaccess_policy\",\n \"iam_root_credentials_management_enabled\",\n \"iam_securityaudit_role_created\"\n ]\n },\n \"s3\": {\n \"covered\": 20,\n \"total\": 21,\n \"not_covered_checks\": [\n \"s3_bucket_event_notifications_enabled\"\n ]\n }\n }\n },\n \"extensions\": {\n \"selected_controls_source\": \"dir\",\n \"context_name\": \"workspace\",\n \"resolved_paths\": {\n \"controls\": \"\",\n \"observations\": \"observations\"\n }\n }\n}\n", "stderr": "warning: 2 critical/high findings not in any chain (use --include-atomic to see)\n\u26a0 3 warnings suppressed. Run with --verbose to view.\n", "needs_credentials": true, "needs_browser": false}

• Haiku 5.5 · 2026-10-18

Full run evidence and history

We check claims after it’s running.

Skipped checks count as neither passes nor failures.

Setups: 1 skipped

• Linux / Haiku (2026-10-18): missing prerequisite cannot prove a working operation: {"returncode": 3, "stdout": "t bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \u2014 the dangerous combination is the join on a shared bucket ARN. The Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side's scope is its own ARN (asset.ID), which the resolver returns when the property path is absent on the storage asset.\\n\",\n \"controls_failing\": [\n \"CTL.BEDROCK.KB.MARKER.INDEXES.001\",\n \"CTL.S3.MARKER.PHI.001\"\n ],\n \"compound_score\": 18,\n \"severity\": \"critical\",\n \"narrative\": \"Bedrock knowledge base indexes an S3 bucket AND that bucket carries the data-classification=phi marker. RAG retrieval through the agent connected to this knowledge base returns PHI to whoever queries the agent. Same compound shape as cognito_unauth_phi_s3 but on the AI-data axis: each side is a fact-recording marker (KB indexes bucket X; bucket X is PHI), neither a violation alone \u2014 the dangerous combination is the join on a shared bucket ARN. The Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side's scope is its own ARN (asset.ID), which the resolver returns when the property path is absent on the storage asset.\\n Failing: CTL.BEDROCK.KB.MARKER.INDEXES.001, CTL.S3.MARKER.PHI.001.\"\n }\n ],\n \"near_miss_chains\": [\n {\n \"chain\": \"bedrock_agent_data_exfiltration\",\n \"description\": \"Bedrock agent execution role grants broad lambda:InvokeFunction on Resource: *, the agent's tool list references a Lambda that no longer exists (ghost reference), and the agent role has overbroad S3 write. An attacker who gains prompt control can invoke arbitrary Lambdas (including ones replaced by an adversary via the ghost ARN), and the agent role can write exfiltrated data to S3 buckets outside the intended tenant boundary. All three conditions must stack: broad Lambda reach provides the mechanism, the ghost reference provides the exploitation vector, and overbroad S3 provides the exfiltration destination. Drop any one and the chain breaks.\\n\",\n \"controls_failing\": [\n \"CTL.BEDROCK.AGENT.OVERPERM.LAMBDA.001\",\n \"CTL.BEDROCK.AGENT.OVERPERM.S3.001\"\n ],\n \"missing_control\": \"CTL.BEDROCK.AGENT.GHOST.LAMBDA.001\",\n \"severity\": \"critical\",\n \"scope_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\"\n },\n {\n \"chain\": \"bedrock_to_dynamodb_lateral\",\n \"description\": \"Bedrock agent has an overbroad IAM role and DynamoDB is accessible without a VPC endpoint policy restriction \u2014 a compromised or prompt-injected agent can read or write arbitrary DynamoDB tables via the public API. The first leg detects that the Bedrock agent's role grants overbroad S3 or data-access permissions (CTL.BEDROCK.AGENT.OVERPERM.S3.001) \u2014 the role is not scoped to specific resources. The second leg detects that no VPC endpoint enforces a restrictive policy on DynamoDB access (CTL.DYNAMODB.VPC.ENDPOINT.001) \u2014 the agent reaches DynamoDB over the public endpoint with no network-level constraint. Together: agent compromise via prompt injection or tool misuse yields unrestricted DynamoDB access across every table the overbroad role permits. Bedrock agents with knowledge bases commonly access DynamoDB for retrieval-augmented generation; this IAM-path lateral movement pattern is the agentic equivalent of the Lambda\u2192DynamoDB pattern. Removing either leg breaks the chain: scope the agent role to specific tables and actions, OR enforce a VPC endpoint policy that restricts DynamoDB access to authorized agent roles only.\\n\",\n \"controls_failing\": [\n \"CTL.BEDROCK.AGENT.OVERPERM.S3.001\"\n ],\n \"missing_control\": \"CTL.DYNAMODB.VPC.ENDPOINT.001\",\n \"severity\": \"high\",\n \"scope_id\": \"__global__\"\n },\n {\n \"chain\": \"cognito_unauth_phi_s3\",\n \"description\": \"Cognito identity pool admits anonymous AWS credentials AND its unauthenticated role carries S3 actions AND the action target is an S3 bucket tagged data-classification=phi. The compound describes an internet-to-PHI data path that no individual control catches: UNAUTH.S3 alone fires on any S3 access (over-broad signal); the PHI marker alone is the desired state. Their conjunction over a shared bucket ARN \u2014 surfaced via scope_field on the bucket's identity \u2014 is the HIPAA-reportable shape.\\n\",\n \"controls_failing\": [\n \"CTL.S3.MARKER.PHI.001\"\n ],\n \"missing_control\": \"CTL.COGNITO.IDPOOL.UNAUTH.S3.001\",\n \"severity\": \"critical\",\n \"scope_id\": \"arn:aws:s3:::patient-records\"\n },\n {\n \"chain\": \"intent_expiry_unclassified_ai_datasource\",\n \"description\": \"Intent-expiry compound on AI data sources \u2014 a Bedrock knowledge base indexes an S3 bucket AND that bucket has no data-classification tag. The protection chains that detect sensitive-data exposure through AI tool chains (bedrock_rag_phi_exposure and others) all condition on the classification marker. When the marker is absent, those chains go silent \u2014 not because the data is safe, but because the operator has not declared what the bucket contains. If the bucket holds PHI, PII, or other sensitive data, the protection gap is invisible.\\nThis is the \\\"tag existed Monday, gone Tuesday\\\" failure mode surfaced on a single snapshot: any KB-indexed bucket missing the data-classification declaration is a coverage gap whether the tag was removed yesterday or was never applied. The failure mode is the absence of the declaration, not the history of how it disappeared.\\nSame scope_field pattern as bedrock_rag_phi_exposure: the Bedrock side stamps target_bucket_arn on the knowledge base; the S3 side falls back to its own asset.ID (the bucket ARN) when the property path is absent, so the chain groups by the shared bucket ARN.\\n\",\n \"controls_failing\": [\n \"CTL.BEDROCK.KB.MARKER.INDEXES.001\"\n ],\n \"missing_control\": \"CTL.S3.CLASSIFY.COVERAGE.001\",\n \"severity\": \"high\",\n \"scope_id\": \"arn:aws:s3:::patient-records\"\n }\n ],\n \"issues\": [\n {\n \"issue_id\": \"sha256:7dc1980d74d52774\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"shared_keys\": [\n \"ai.agent\",\n \"ai.agent.guardrail_associated\",\n \"ai.agent.invocation_logging_enabled\",\n \"ai.agent.lambda_invoke_scope_broad\",\n \"ai.agent.s3_access_scope_broad\",\n \"ai.kind\"\n ],\n \"headline_finding_id\": \"sha256:6ba94d07bc8f4058\",\n \"member_finding_ids\": [\n \"sha256:3341778eee9e6787\",\n \"sha256:6ba94d07bc8f4058\",\n \"sha256:b67ada4bcce5ce5d\",\n \"sha256:bdfeaa27cfcbeb98\",\n \"sha256:c796b99eb9b808b9\"\n ],\n \"consolidated_score\": 100,\n \"consolidated_blast_radius\": 1\n },\n {\n \"issue_id\": \"sha256:5eca1e86755ea761\",\n \"asset_id\": \"arn:aws:lambda:us-east-1:111122223333:function:patient-lookup-tool\",\n \"shared_keys\": [\n \"compute.bedrock\",\n \"compute.bedrock.role_reaches_phi_bucket\"\n ],\n \"headline_finding_id\": \"sha256:ade5b73d64ba2615\",\n \"member_finding_ids\": [\n \"sha256:ade5b73d64ba2615\"\n ],\n \"consolidated_score\": 100,\n \"consolidated_blast_radius\": 1\n },\n {\n \"issue_id\": \"sha256:0b397ed316a32837\",\n \"asset_id\": \"arn:aws:s3:::patient-records\",\n \"shared_keys\": [\n \"storage.object_ownership\",\n \"storage.object_ownership.rule\"\n ],\n \"headline_finding_id\": \"sha256:f56a113f19738662\",\n \"member_finding_ids\": [\n \"sha256:f56a113f19738662\"\n ],\n \"consolidated_score\": 75,\n \"consolidated_blast_radius\": 1\n }\n ],\n \"top_exposures\": [\n {\n \"finding_index\": 1,\n \"control_id\": \"CTL.BEDROCK.AGENT.GUARDRAIL.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 100,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1.5,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 2,\n \"control_id\": \"CTL.BEDROCK.AGENT.LOGGING.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 100,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1.5,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 3,\n \"control_id\": \"CTL.BEDROCK.AGENT.OVERPERM.LAMBDA.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 100,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1.5,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 5,\n \"control_id\": \"CTL.LAMBDA.OVERPERM.S3PHI.001\",\n \"asset_id\": \"arn:aws:lambda:us-east-1:111122223333:function:patient-lookup-tool\",\n \"exposure_score\": 100,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1.5,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 4,\n \"control_id\": \"CTL.BEDROCK.AGENT.OVERPERM.S3.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 75,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 6,\n \"control_id\": \"CTL.S3.OWNERSHIP.001\",\n \"asset_id\": \"arn:aws:s3:::patient-records\",\n \"exposure_score\": 75,\n \"breakdown\": {\n \"base_score\": 75,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n },\n {\n \"finding_index\": 0,\n \"control_id\": \"CTL.BEDROCK.AGENT.CLASSIC.DEPRECATED.001\",\n \"asset_id\": \"arn:aws:bedrock:us-east-1:111122223333:agent/CUSTSUPPORTAGENT\",\n \"exposure_score\": 50,\n \"breakdown\": {\n \"base_score\": 50,\n \"duration_factor\": 1,\n \"blast_multiplier\": 1,\n \"exposure_multiplier\": 1,\n \"chain_bonus\": 1,\n \"blind_multiplier\": 1,\n \"days_blind\": 0\n },\n \"silent_killer\": false\n }\n ],\n \"coverage_posture\": {\n \"pmapper\": {\n \"_unmatched\": {\n \"covered\": 1,\n \"total\": 0,\n \"not_covered_checks\": []\n }\n },\n \"prowler\": {\n \"_unmatched\": {\n \"covered\": 1,\n \"total\": 0,\n \"not_covered_checks\": []\n },\n \"iam\": {\n \"covered\": 44,\n \"total\": 47,\n \"not_covered_checks\": [\n \"iam_role_cross_account_readonlyaccess_policy\",\n \"iam_root_credentials_management_enabled\",\n \"iam_securityaudit_role_created\"\n ]\n },\n \"s3\": {\n \"covered\": 20,\n \"total\": 21,\n \"not_covered_checks\": [\n \"s3_bucket_event_notifications_enabled\"\n ]\n }\n }\n },\n \"extensions\": {\n \"selected_controls_source\": \"dir\",\n \"context_name\": \"workspace\",\n \"resolved_paths\": {\n \"controls\": \"\",\n \"observations\": \"observations\"\n }\n }\n}\n", "stderr": "warning: 2 critical/high findings not in any chain (use --include-atomic to see)\n\u26a0 3 warnings suppressed. Run with --verbose to view.\n", "needs_credentials": true, "needs_browser": false}

Needs a key or login on some setups