zhaolei
6f402ffcee
- 后端: coworker 智能体框架, WS API, 文件上传, 附件处理 - 前端: Open WebUI, 文件全量走 upload API (含 MD/TXT/JSON 等文本类) - 技能: md-to-office (pandoc + wkhtmltopdf) - 修复: 上传文件路径丢失, Agent 搜索浪费, 输出文件跑到 uploads/ - 打包: PyInstaller one-dir, 预打包 pandoc/wkhtmltopdf/chromium
1.7 KiB
1.7 KiB
name, description
| name | description |
|---|---|
| aws-posture | Read-only AWS posture check — public exposure, IAM blast radius, hygiene |
Check the live AWS account's security posture using strictly read-only CLI calls, then fix root causes in the IaC.
HARD RULE: read-only means read-only — describe/list/get/simulate calls only. No
create/put/update/delete/attach, no terraform apply, ever. If a fix is needed, it goes
into Terraform for the team to apply.
- Confirm access and scope:
aws sts get-caller-identity(mask the account id to its last 4 digits in anything you write). Ask which regions matter; default to the ones the Terraform state uses. - Sweep the high-signal surfaces, most exposed first:
- Public entry points: S3 buckets (
get-public-access-block, bucket policies), security groups open to 0.0.0.0/0 on sensitive ports, public RDS/ES endpoints, ALB listeners without TLS. - IAM blast radius: users with attached admin policies, wildcard
Action/Resourcein customer-managed policies, stale access keys (iam get-credential-report), roles with overly broad trust policies. - Hygiene: CloudTrail on and multi-region, default EBS/S3 encryption, root-account MFA (from the credential report).
- Public entry points: S3 buckets (
- Cross-reference each finding against the repo's Terraform: is the risky config defined in code (fix it there), drifted from code (flag the drift), or unmanaged (propose importing it)?
- Deliver: an exposure-ranked posture report (finding · resource · evidence command · where it's defined · action), the IaC fix branch for what's code-managed, and a short list of items needing a human decision. Every claim carries the exact read-only command that evidences it, so the team can re-run and verify.