Add CloudTrail S3 admin audit helper#75
Open
jamilahmadzai wants to merge 2 commits into
Open
Conversation
68 tasks
📝 WalkthroughWalkthroughThis PR introduces a complete offline CloudTrail S3 admin event auditing workflow: a Node.js CLI script that parses CloudTrail JSON exports, filters for bucket-admin events, and renders Markdown or CSV reports; a test fixture with representative events; a verification script that validates audit output against expected content; and user documentation describing scope, usage, privacy redaction, and how to verify the tool via the synthetic fixture. ChangesCloudTrail S3 Admin Audit Feature
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tools/audit-cloudtrail-s3-admin-events.mjs`:
- Around line 112-113: The JSON.parse in function readRecords can throw without
indicating which file failed; wrap the parse in a try/catch around
JSON.parse(fs.readFileSync(filePath, "utf8")) inside readRecords, and on error
either throw a new Error that includes the filePath and the original error
message (e.g., `new Error(\`Failed to parse JSON for ${filePath}:
${err.message}\`)`) or log the filePath plus err before rethrowing so callers
can identify the bad file; ensure you preserve the original error stack/message
when rethrowing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7ecbfafc-e46b-4ac5-b522-c1e745e00453
📒 Files selected for processing (4)
docs/security/cloudtrail-s3-admin-audit.mdtools/audit-cloudtrail-s3-admin-events.mjstools/check-cloudtrail-s3-admin-audit.mjstools/fixtures/cloudtrail-s3-admin-events.sample.json
There was a problem hiding this comment.
🧹 Nitpick comments (1)
tools/check-cloudtrail-s3-admin-audit.mjs (1)
45-60: ⚡ Quick winHarden the negative-test flow and always clean temporary fixtures.
The current
try/catchcatches its own sentinel failure path, which can blur diagnostics, and the temp dir is never removed.Proposed patch
const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "studenthub-cloudtrail-")); const invalidFixture = path.join(tempDir, "invalid.json"); fs.writeFileSync(invalidFixture, "{not-json"); -try { - execFileSync(process.execPath, [auditScript, invalidFixture], { - encoding: "utf8", - stdio: ["ignore", "pipe", "pipe"], - }); - throw new Error("Expected invalid JSON input to fail"); -} catch (error) { - const stderr = String(error.stderr ?? ""); - if (!stderr.includes("Failed to parse JSON") || !stderr.includes(invalidFixture)) { - throw new Error("Invalid JSON errors should include the failing file path"); - } -} +let invalidRunError; +try { + execFileSync(process.execPath, [auditScript, invalidFixture], { + encoding: "utf8", + stdio: ["ignore", "pipe", "pipe"], + }); +} catch (error) { + invalidRunError = error; +} finally { + fs.rmSync(tempDir, { recursive: true, force: true }); +} + +if (!invalidRunError) { + throw new Error("Expected invalid JSON input to fail"); +} + +const stderr = String(invalidRunError.stderr ?? ""); +if (!stderr.includes("Failed to parse JSON") || !stderr.includes(invalidFixture)) { + throw new Error("Invalid JSON errors should include the failing file path"); +}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/check-cloudtrail-s3-admin-audit.mjs` around lines 45 - 60, The negative test currently throws a sentinel error inside the try block and then catches it, and it never cleans up tempDir; change the flow to track whether execFileSync failed (e.g., let execFailed = false), run execFileSync(process.execPath, [auditScript, invalidFixture], ...) inside try and set execFailed = true in the catch where you validate stderr includes "Failed to parse JSON" and invalidFixture, and after the try/catch throw a failure if execFailed is false (meaning the command unexpectedly succeeded); ensure you always remove the temporary fixture and directory in a finally block using fs.rmSync(tempDir, { recursive: true, force: true }) or equivalent; refer to the existing symbols tempDir, invalidFixture, execFileSync, and the stderr validation code when applying this change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@tools/check-cloudtrail-s3-admin-audit.mjs`:
- Around line 45-60: The negative test currently throws a sentinel error inside
the try block and then catches it, and it never cleans up tempDir; change the
flow to track whether execFileSync failed (e.g., let execFailed = false), run
execFileSync(process.execPath, [auditScript, invalidFixture], ...) inside try
and set execFailed = true in the catch where you validate stderr includes
"Failed to parse JSON" and invalidFixture, and after the try/catch throw a
failure if execFailed is false (meaning the command unexpectedly succeeded);
ensure you always remove the temporary fixture and directory in a finally block
using fs.rmSync(tempDir, { recursive: true, force: true }) or equivalent; refer
to the existing symbols tempDir, invalidFixture, execFileSync, and the stderr
validation code when applying this change.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: cdebb631-dd46-4b51-a303-4e6cf6dca8d4
📒 Files selected for processing (2)
tools/audit-cloudtrail-s3-admin-events.mjstools/check-cloudtrail-s3-admin-audit.mjs
🚧 Files skipped from review as they are similar to previous changes (1)
- tools/audit-cloudtrail-s3-admin-events.mjs
jamilahmadzai
force-pushed
the
security/cloudtrail-s3-admin-audit
branch
from
93537b5 to
d9eee09
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/claim #55
Summary
Safety boundary
No live AWS/IAM calls, bucket policy changes, key rotation, candidate data, raw CloudTrail exports, account IDs, access keys, or secret keys are included. The report prints access-key suffixes only.
Verification
node tools/check-cloudtrail-s3-admin-audit.mjsnode tools/audit-cloudtrail-s3-admin-events.mjs tools/fixtures/cloudtrail-s3-admin-events.sample.json --format csvgit diff --check HEAD~1Summary by CodeRabbit
New Features
Documentation
Tests
Payout
PayPal: jamilurrehman722@gmail.com (if a direct payout method is needed).
Payment method: Algora bounty-platform payout to GitHub user @jamilahmadzai for issue #55.