Kinnaird McQuade kmcquade

Final Review - Comprehensive PR Review & Testing

Before starting, check the git history to determine if this is a follow-up review:

git log --oneline -10 | grep -i "Co-Authored-By: Claude"

A specification for declaring vulnerabilities in intentionally vulnerable applications ("vulnapps") to help scanners assess their own find rate.

A vulnerable application declares its vulnerabilities in an agreed schema in a .vulns.yml (or .vulns.json) file

This is a list of all the magic IP addresses that are addressible in AWS.

	acm-pca:CreateCertificateAuthority
	aws-marketplace:AcceptAgreementApprovalRequest
	aws-marketplace:Subscribe
	backup:PutBackupVaultLockConfiguration
	bedrock:CreateProvisionedModelThroughput
	bedrock:UpdateProvisionedModelThroughput
	devicefarm:PurchaseOffering
	dynamodb:PurchaseReservedCapacityOfferings
	ec2:ModifyReservedInstances
	ec2:PurchaseCapacityBlock

	#!/bin/bash

	# Delete Default VPCs
	# Deletes Default VPCs across an entire organization if there are no ENIs in
	# the default VPC.
	#
	# Assumes that ~/.aws/credentials has credentials to the root account for the
	# AWS Organization. Assumes that the user/role you're logged into in the
	# root account has permissions to assume the OrganizationAccountAccessRole in
	# each member account. Requires jq and aws cli be installed on the path.

	#---------Query MetaData for SubscriptionID---------#
	$response2 = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/instance?api-version=2018-02-01' -Method GET -Headers @{Metadata="true"} -UseBasicParsing
	$subID = ($response2.Content \| ConvertFrom-Json).compute.subscriptionId


	#---------Get OAuth Token---------#
	$response = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -Method GET -Headers @{Metadata="true"} -UseBasicParsing
	$content = $response.Content \| ConvertFrom-Json
	$ArmToken = $content.access_token

	import json

	from policy_sentry.analysis.analyze import analyze_by_access_level, determine_actions_to_expand
	from policy_sentry.shared.database import connect_db

	DB_SESSION = connect_db('bundled') # Use the bundled data that comes with Policy Sentry

	sample_policy = json.loads("""
	{
	"Statement":[

	function jq() {
	if [ -f $1 ]; then
	FILE=$1; shift
	# Move FILE at the end as expected by native jq
	command jq "$@" "$FILE"
	else
	command jq "$@"
	fi
	}