mirror of
https://github.com/Sea-Haven-Industries/sh-openswe-traces.git
synced 2026-10-06 13:32:18 +00:00
dbd41bb52c
Some checks failed
Deploy / deploy (push) Has been cancelled
Moves proof-or-kill-verified checkov false positives on bootstrap.yaml ExecRole (CFN-only role, ARN-scoped IAM-user actions gated by an explicit anti-escalation Deny; KMS CreateKey Resource:* inherent to key creation) from machine-level to a tracked repo-local .security-review/suppressions.json so the Open SWE daily-report automation resolves them. Machine-level copy retained until merge.
12 lines
1.3 KiB
JSON
12 lines
1.3 KiB
JSON
{
|
|
"suppressions": [
|
|
{
|
|
"id": "checkov-CKV_AWS_109-13",
|
|
"justification": "False positive. bootstrap.yaml ExecRole (line 13) is a CloudFormation execution role assumable ONLY by cloudformation.amazonaws.com and gated by aws:SourceAccount == this account. CKV_AWS_109 fires on the IAM user actions (iam:CreateUser/PutUserPolicy in the ExportUser block), but those are ARN-scoped to arn:aws:iam::${AWS::AccountId}:user/sh-openswe-traces-* (not Resource:*), AND the explicit DenyUserCredentialAndEscalation block denies CreateAccessKey/CreateLoginProfile/UpdateLoginProfile/AttachUserPolicy/CreateServiceSpecificCredential and boundary tampering, so any created user is credential-inert. No privesc path. iam:PassRole is conditioned to cloudformation.amazonaws.com. Verified proof-or-kill 2026-07-13."
|
|
},
|
|
{
|
|
"id": "checkov-CKV_AWS_111-13",
|
|
"justification": "False positive. Same ExecRole. CKV_AWS_111 (write without constraint on Resource:*) fires on the KMS block (kms:CreateKey/CreateAlias), which is inherent to key creation — not-yet-existent keys cannot be ARN-scoped — with blast radius bounded to this stack's deploys. The other Resource:* statement is a Deny (flagging a Deny as over-permissive is nonsensical). CFN-only assumable, SourceAccount-conditioned. Verified proof-or-kill 2026-07-13."
|
|
}
|
|
]
|
|
}
|