read-only aws lockdowns: audit-row without argv gate is a leak surface, not a boundary #54

New issue

Open

opened 2026-05-23 20:54:03 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-23 20:54:03 +00:00

Owner

Originally filed by @coilysiren on 2026-05-05T11:21:53Z - https://github.com/coilysiren/coily/issues/58

Proposal

Extend the coily ops aws argv gate to cover read-only sub-verbs against sensitive resource patterns (buckets, roles, regions, account boundaries). Today read-only aws verbs land an audit row but pass through without argv validation. The audit row documents the leak; it does not stop it.

Why

Surfaced 2026-05-05 while seeding coily-ops-aws-meta's anti-signal catalogue. The framing "read-only aws verbs do not need an audit row" is false (audit is the trail), but the inverse is also wrong: "audit row is sufficient for read-only verbs" treats the trail as the gate. It is not. Read-only invocations exfiltrate (s3 ls on a sensitive bucket), confirm threat-model state (sts get-caller-identity after an unauthorized role assumption), and enumerate (ec2 describe-*, iam list-*).

The boundary needs a pre-send deny on read-only patterns the operator did not intend to expose. iam scoping is wider than the runtime needs (lazy role reuse) and CloudTrail is post-hoc - neither is the layer that prevents the read from happening in the first place.

Mechanical scope

pkg/policy learns a read-only-pattern deny list for aws (sensitive bucket name globs, role-arn patterns, account boundaries).
Default-deny on the patterns; explicit allow via config or per-invocation flag.
Audit row continues to land for both denied and allowed reads; verb name distinguishes (ops.aws.read.denied vs ops.aws.read.allowed or similar).
Tests in cmd/coily/security_claims_test.go family pin the new claims so prose and runtime move together.
Doc update in SECURITY.md adding the read-only-deny claim.

Out of scope

Destructive-verb gate changes. That layer already has policy coverage; this issue is the read-side gap.
iam policy tightening on the AWS account itself. Different layer; the coily gate is the runtime narrowing of an iam surface that is already (correctly) wider than the runtime needs.
Cross-host shadow of the audit log. Tracked in #55.

Originating thread

coily-ops-aws-meta skill seeding, 2026-05-05. The skill's anti-signal catalogue (section 1) cites this issue once filed.

_Originally filed by @coilysiren on 2026-05-05T11:21:53Z - [https://github.com/coilysiren/coily/issues/58](https://github.com/coilysiren/coily/issues/58)_ ## Proposal Extend the `coily ops aws` argv gate to cover read-only sub-verbs against sensitive resource patterns (buckets, roles, regions, account boundaries). Today read-only aws verbs land an audit row but pass through without argv validation. The audit row documents the leak; it does not stop it. ## Why Surfaced 2026-05-05 while seeding `coily-ops-aws-meta`'s anti-signal catalogue. The framing "read-only aws verbs do not need an audit row" is false (audit is the trail), but the inverse is also wrong: "audit row is sufficient for read-only verbs" treats the trail as the gate. It is not. Read-only invocations exfiltrate (`s3 ls` on a sensitive bucket), confirm threat-model state (`sts get-caller-identity` after an unauthorized role assumption), and enumerate (`ec2 describe-*`, `iam list-*`). The boundary needs a *pre-send* deny on read-only patterns the operator did not intend to expose. iam scoping is wider than the runtime needs (lazy role reuse) and CloudTrail is post-hoc - neither is the layer that prevents the read from happening in the first place. ## Mechanical scope - `pkg/policy` learns a read-only-pattern deny list for aws (sensitive bucket name globs, role-arn patterns, account boundaries). - Default-deny on the patterns; explicit allow via config or per-invocation flag. - Audit row continues to land for both denied and allowed reads; verb name distinguishes (`ops.aws.read.denied` vs `ops.aws.read.allowed` or similar). - Tests in `cmd/coily/security_claims_test.go` family pin the new claims so prose and runtime move together. - Doc update in `SECURITY.md` adding the read-only-deny claim. ## Out of scope - Destructive-verb gate changes. That layer already has policy coverage; this issue is the read-side gap. - iam policy tightening on the AWS account itself. Different layer; the coily gate is the runtime narrowing of an iam surface that is already (correctly) wider than the runtime needs. - Cross-host shadow of the audit log. Tracked in #55. ## Originating thread `coily-ops-aws-meta` skill seeding, 2026-05-05. The skill's anti-signal catalogue (section 1) cites this issue once filed.

coilysiren added the

label

2026-05-31 01:52:44 +00:00

coilysiren added

and removed

labels

2026-05-31 06:59:48 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

coilyco-bridge/coily#54

No description provided.

Rows
Columns