terraform.tfvars.example

##############################################################################
# ACCOUNT CONFIGURATION
##############################################################################

# Production environment (enabled by default)
# NOTE: Account IDs are automatically derived from your AWS profiles!
#       You only need to specify the profile name - no account ID required.
enable_prod_environment  = true
prod_account_aws_profile = "your-aws-profile"
aws_region               = "us-west-2"  # Region where resources will be deployed

# Optional: For cross-account scenarios (leave commented for single-account mode)
# enable_dev_environment   = true
# dev_account_aws_profile  = "your-dev-profile"

# enable_ops_environment          = true
# operations_account_aws_profile  = "your-ops-profile"

# Optional: Attacker-controlled account (for scenarios with adversary-side infrastructure)
# enable_attacker_environment    = true
# attacker_account_aws_profile   = "your-attacker-profile"
#
# Advanced: Use IAM user credentials instead of AWS profile for attacker account
# (managed automatically by plabs CLI when "Create IAM admin user" mode is selected)
# attacker_account_use_iam_user  = true
# attacker_iam_user_access_key   = "AKIA..."
# attacker_iam_user_secret_key   = "..."

# Optional: Override auto-derived account IDs (rarely needed)
# prod_account_id       = "111111111111"
# dev_account_id        = "222222222222"
# operations_account_id = "333333333333"
# attacker_account_id  = "444444444444"

# Optional: For OIDC-GitHub challenge
# github_repo = "your-org/your-repo"

##############################################################################
# SERVICE-LINKED ROLE CREATION
# The plabs CLI auto-detects these. If running terraform directly, set to
# false for any service-linked role that already exists in your account.
##############################################################################
# create_autoscaling_slr = true
# create_spot_slr        = true
# create_apprunner_slr   = true

##############################################################################
# SCENARIO ENABLEMENT
# Set to true to enable a scenario, false to disable
##############################################################################

# SINGLE-ACCOUNT SELF-ESCALATION TO-ADMIN
enable_single_account_privesc_self_escalation_to_admin_iam_001_iam_createpolicyversion     = false
enable_single_account_privesc_self_escalation_to_admin_iam_005_iam_putrolepolicy           = false
enable_single_account_privesc_self_escalation_to_admin_iam_007_iam_putuserpolicy           = false
enable_single_account_privesc_self_escalation_to_admin_iam_008_iam_attachuserpolicy        = false
enable_single_account_privesc_self_escalation_to_admin_iam_009_iam_attachrolepolicy        = false
enable_single_account_privesc_self_escalation_to_admin_iam_010_iam_attachgrouppolicy       = false
enable_single_account_privesc_self_escalation_to_admin_iam_011_iam_putgrouppolicy          = false
enable_single_account_privesc_self_escalation_to_admin_iam_013_iam_addusertogroup          = false

# SINGLE-ACCOUNT SELF-ESCALATION TO-BUCKET
enable_single_account_privesc_self_escalation_to_bucket_iam_005_iam_putrolepolicy         = false
enable_single_account_privesc_self_escalation_to_bucket_iam_009_iam_attachrolepolicy      = false

# SINGLE-ACCOUNT ONE-HOP TO-ADMIN
enable_single_account_privesc_one_hop_to_admin_amplify_001_iam_passrole_amplify_createapp_amplify_createbranch_amplify_startjob = false
enable_single_account_privesc_one_hop_to_admin_apprunner_001_iam_passrole_apprunner_createservice = false
enable_single_account_privesc_one_hop_to_admin_apprunner_002_apprunner_updateservice = false
enable_single_account_privesc_one_hop_to_admin_bedrock_001_iam_passrole_bedrockagentcore_codeinterpreter = false
enable_single_account_privesc_one_hop_to_admin_bedrock_002_bedrockagentcore_startsession_invoke = false
enable_single_account_privesc_one_hop_to_admin_batch_001_iam_passrole_batch_registerjobdefinition_batch_submitjob = false
enable_single_account_privesc_one_hop_to_admin_batch_002_batch_submitjob = false
enable_single_account_privesc_one_hop_to_admin_braket_001_iam_passrole_braket_createjob = false
enable_single_account_privesc_one_hop_to_admin_cloudformation_001_iam_passrole_cloudformation = false
enable_single_account_privesc_one_hop_to_admin_cloudformation_002_cloudformation_updatestack = false
enable_single_account_privesc_one_hop_to_admin_cloudformation_003_iam_passrole_cloudformation_createstackset_cloudformation_createstackinstances = false
enable_single_account_privesc_one_hop_to_admin_cloudformation_004_iam_passrole_cloudformation_updatestackset = false
enable_single_account_privesc_one_hop_to_admin_cloudformation_005_cloudformation_createchangeset_executechangeset = false
enable_single_account_privesc_one_hop_to_admin_codebuild_001_iam_passrole_codebuild_createproject_codebuild_startbuild = false
enable_single_account_privesc_one_hop_to_admin_codebuild_002_codebuild_startbuild  = false
enable_single_account_privesc_one_hop_to_admin_codebuild_003_codebuild_startbuildbatch = false
enable_single_account_privesc_one_hop_to_admin_codebuild_004_iam_passrole_codebuild_createproject_codebuild_startbuildbatch = false
enable_single_account_privesc_one_hop_to_admin_codedeploy_001_codedeploy_createdeployment = false
enable_single_account_privesc_one_hop_to_admin_cognito_identity_001_iam_passrole_cognito_identity_setidentitypoolroles = false
enable_single_account_privesc_one_hop_to_admin_ec2_001_iam_passrole_ec2_runinstances = false
enable_single_account_privesc_one_hop_to_admin_ec2_004_iam_passrole_ec2_requestspotinstances = false
enable_single_account_privesc_one_hop_to_admin_ec2_005_ec2_createlaunchtemplateversion_ec2_modifylaunchtemplate = false
enable_single_account_privesc_one_hop_to_admin_ecs_001_iam_passrole_ecs_createcluster_ecs_registertaskdefinition_ecs_createservice = false
enable_single_account_privesc_one_hop_to_admin_ecs_002_iam_passrole_ecs_createcluster_ecs_registertaskdefinition_ecs_runtask = false
enable_single_account_privesc_one_hop_to_admin_ecs_003_iam_passrole_ecs_registertaskdefinition_ecs_createservice = false
enable_single_account_privesc_one_hop_to_admin_ecs_004_iam_passrole_ecs_registertaskdefinition_ecs_runtask = false
enable_single_account_privesc_one_hop_to_admin_ecs_005_iam_passrole_ecs_registertaskdefinition_ecs_starttask = false
enable_single_account_privesc_one_hop_to_admin_ecs_006_ecs_executecommand_describetasks = false
enable_single_account_privesc_one_hop_to_admin_ecs_007_iam_passrole_ecs_starttask_ecs_registercontainerinstance = false
enable_single_account_privesc_one_hop_to_admin_ecs_008_iam_passrole_ecs_runtask = false
enable_single_account_privesc_one_hop_to_admin_ecs_009_iam_passrole_ecs_starttask = false
enable_single_account_privesc_one_hop_to_admin_emr_001_iam_passrole_elasticmapreduce_runjobflow = false
enable_single_account_privesc_one_hop_to_admin_emr_serverless_001_iam_passrole_emr_serverless_createapplication_emr_serverless_startjobrun = false
enable_single_account_privesc_one_hop_to_admin_gamelift_001_iam_passrole_gamelift_createbuild_gamelift_createfleet = false
enable_single_account_privesc_one_hop_to_admin_iam_002_iam_createaccesskey         = false
enable_single_account_privesc_one_hop_to_admin_iam_003_iam_deleteaccesskey_createaccesskey = false
enable_single_account_privesc_one_hop_to_admin_iam_004_iam_createloginprofile      = false
enable_single_account_privesc_one_hop_to_admin_iam_006_iam_updateloginprofile      = false
enable_single_account_privesc_one_hop_to_admin_iam_012_iam_updateassumerolepolicy  = false
enable_single_account_privesc_one_hop_to_admin_iam_014_iam_attachrolepolicy_sts_assumerole = false
enable_single_account_privesc_one_hop_to_admin_iam_015_iam_attachuserpolicy_iam_createaccesskey = false
enable_single_account_privesc_one_hop_to_admin_iam_016_iam_createpolicyversion_sts_assumerole = false
enable_single_account_privesc_one_hop_to_admin_iam_017_iam_putrolepolicy_sts_assumerole = false
enable_single_account_privesc_one_hop_to_admin_iam_018_iam_putuserpolicy_iam_createaccesskey = false
enable_single_account_privesc_one_hop_to_admin_iam_019_iam_attachrolepolicy_iam_updateassumerolepolicy = false
enable_single_account_privesc_one_hop_to_admin_iam_020_iam_createpolicyversion_iam_updateassumerolepolicy = false
enable_single_account_privesc_one_hop_to_admin_iam_021_iam_putrolepolicy_iam_updateassumerolepolicy = false
enable_single_account_privesc_one_hop_to_admin_imagebuilder_001_iam_passrole_imagebuilder_createcomponent_imagebuilder_createimagerecipe_imagebuilder_createinfrastructureconfiguration_imagebuilder_createimage = false
enable_single_account_privesc_one_hop_to_admin_kinesisanalytics_001_iam_passrole_kinesisanalytics_createapplication_kinesisanalytics_startapplication = false
enable_single_account_privesc_one_hop_to_admin_lambda_001_iam_passrole_lambda_createfunction_lambda_invokefunction = false
enable_single_account_privesc_one_hop_to_admin_lambda_002_iam_passrole_lambda_createfunction_createeventsourcemapping_dynamodb = false
enable_single_account_privesc_one_hop_to_admin_lambda_003_lambda_updatefunctioncode = false
enable_single_account_privesc_one_hop_to_admin_lambda_004_lambda_updatefunctioncode_lambda_invokefunction = false
enable_single_account_privesc_one_hop_to_admin_lambda_005_lambda_updatefunctioncode_lambda_addpermission = false
enable_single_account_privesc_one_hop_to_admin_lambda_006_iam_passrole_lambda_createfunction_lambda_addpermission = false
enable_single_account_privesc_one_hop_to_admin_omics_001_iam_passrole_omics_createworkflow_omics_startrun = false
enable_single_account_privesc_one_hop_to_admin_sts_001_sts_assumerole              = false

# SINGLE-ACCOUNT ONE-HOP TO-ADMIN NON-FREE SCENARIOS
enable_single_account_privesc_one_hop_to_admin_ec2_002_ec2_modifyinstanceattribute_stopinstances_startinstances = false
enable_single_account_privesc_one_hop_to_admin_ec2_003_ec2_instance_connect_sendsshpublickey = false
enable_single_account_privesc_one_hop_to_admin_glue_001_iam_passrole_glue_createdevendpoint = false
enable_single_account_privesc_one_hop_to_admin_glue_002_glue_updatedevendpoint     = false
enable_single_account_privesc_one_hop_to_admin_glue_003_iam_passrole_glue_createjob_glue_startjobrun = false
enable_single_account_privesc_one_hop_to_admin_glue_004_iam_passrole_glue_createjob_glue_createtrigger = false
enable_single_account_privesc_one_hop_to_admin_glue_005_iam_passrole_glue_updatejob_glue_startjobrun = false
enable_single_account_privesc_one_hop_to_admin_glue_006_iam_passrole_glue_updatejob_glue_createtrigger = false
enable_single_account_privesc_one_hop_to_admin_glue_007_iam_passrole_glue_createsession_glue_runstatement = false
enable_single_account_privesc_one_hop_to_admin_sagemaker_001_iam_passrole_sagemaker_createnotebookinstance = false
enable_single_account_privesc_one_hop_to_admin_sagemaker_002_iam_passrole_sagemaker_createtrainingjob = false
enable_single_account_privesc_one_hop_to_admin_sagemaker_003_iam_passrole_sagemaker_createprocessingjob = false
enable_single_account_privesc_one_hop_to_admin_sagemaker_004_sagemaker_createpresignednotebookinstanceurl = false
enable_single_account_privesc_one_hop_to_admin_sagemaker_005_sagemaker_updatenotebook_lifecycle_config = false
enable_single_account_privesc_one_hop_to_admin_stepfunctions_001_iam_passrole_states_createstatemachine_states_startexecution = false
enable_single_account_privesc_one_hop_to_admin_stepfunctions_002_states_updatestatemachine_states_startexecution = false
enable_single_account_privesc_one_hop_to_admin_scheduler_001                                        = false
enable_single_account_privesc_one_hop_to_admin_ssm_001_ssm_startsession            = false
enable_single_account_privesc_one_hop_to_admin_ssm_002_ssm_sendcommand             = false
enable_single_account_privesc_one_hop_to_admin_ssm_003_ssm_createdocument_ssm_startautomationexecution = false

# SINGLE-ACCOUNT ONE-HOP TO-BUCKET
enable_single_account_privesc_one_hop_to_bucket_iam_002_iam_createaccesskey        = false
enable_single_account_privesc_one_hop_to_bucket_iam_003_iam_deleteaccesskey_createaccesskey = false
enable_single_account_privesc_one_hop_to_bucket_iam_004_iam_createloginprofile     = false
enable_single_account_privesc_one_hop_to_bucket_iam_006_iam_updateloginprofile     = false
enable_single_account_privesc_one_hop_to_bucket_iam_012_iam_updateassumerolepolicy = false
enable_single_account_privesc_one_hop_to_bucket_lambda_001_iam_passrole_lambda_createfunction_lambda_invokefunction = false
enable_single_account_privesc_one_hop_to_bucket_lambda_002_iam_passrole_lambda_createfunction_createeventsourcemapping_dynamodb = false
enable_single_account_privesc_one_hop_to_bucket_lambda_003_lambda_updatefunctioncode = false
enable_single_account_privesc_one_hop_to_bucket_lambda_004_lambda_updatefunctioncode_lambda_invokefunction = false
enable_single_account_privesc_one_hop_to_bucket_lambda_005_lambda_updatefunctioncode_lambda_addpermission = false
enable_single_account_privesc_one_hop_to_bucket_lambda_006_iam_passrole_lambda_createfunction_lambda_addpermission = false
enable_single_account_privesc_one_hop_to_bucket_sts_001_sts_assumerole             = false

# SINGLE-ACCOUNT ONE-HOP TO-BUCKET NON-FREE SCENARIOS
enable_single_account_privesc_one_hop_to_bucket_ec2_003_ec2_instance_connect_sendsshpublickey = false
enable_single_account_privesc_one_hop_to_bucket_glue_001_iam_passrole_glue_createdevendpoint = false
enable_single_account_privesc_one_hop_to_bucket_glue_002_glue_updatedevendpoint    = false
enable_single_account_privesc_one_hop_to_bucket_ssm_001_ssm_startsession           = false
enable_single_account_privesc_one_hop_to_bucket_ssm_002_ssm_sendcommand            = false

# SINGLE-ACCOUNT MULTI-HOP TO-ADMIN
enable_single_account_privesc_multi_hop_to_admin_lambda_004_to_iam_002             = false
enable_single_account_privesc_multi_hop_to_admin_multiple_paths_combined           = false
enable_single_account_privesc_multi_hop_to_admin_putrolepolicy_on_other            = false
enable_single_account_privesc_multi_hop_to_admin_sts_001_to_ecs_002_to_admin       = false

# SINGLE-ACCOUNT MULTI-HOP TO-BUCKET
enable_single_account_privesc_multi_hop_to_bucket_role_chain_to_s3                 = false

# TOOL TESTING
enable_tool_testing_exclusive_resource_policy                                      = false
enable_tool_testing_resource_policy_bypass                                         = false
enable_tool_testing_test_effective_permissions_evaluation                          = false
enable_tool_testing_test_reverse_blast_radius_direct_and_indirect_through_admin    = false
enable_tool_testing_test_reverse_blast_radius_direct_and_indirect_to_bucket        = false

# SINGLE-ACCOUNT CSPM-TOXIC-COMBO
enable_single_account_cspm_toxic_combo_public_lambda_with_admin                    = false

# CROSS-ACCOUNT DEV-TO-PROD
enable_cross_account_dev_to_prod_multi_hop_lambda_invoke_update                    = false
enable_cross_account_dev_to_prod_multi_hop_multi_hop_both_sides                    = false
enable_cross_account_dev_to_prod_multi_hop_passrole_lambda_admin                   = false
enable_cross_account_dev_to_prod_multi_hop_ssm_startsession_ec2_admin             = false
enable_cross_account_dev_to_prod_one_hop_root_trust_role_assumption                = false
enable_cross_account_dev_to_prod_one_hop_simple_role_assumption                    = false

# CROSS-ACCOUNT OPS-TO-PROD
enable_cross_account_ops_to_prod_one_hop_simple_role_assumption                    = false
enable_cross_account_ops_to_prod_github_oidc_pivot                                 = false

# Per-scenario config: set GitHub repo via: plabs config github-oidc-cross-account-pivot set github_repo org/repo
github_oidc_cross_account_pivot_github_repo = ""

##############################################################################
# CTF SCENARIOS
##############################################################################

# CTF
enable_ctf_ai_chatbot_to_admin                                                     = false
enable_ctf_ai_chatbot_lambda_pivot                                                 = false

##############################################################################
# ATTACK SIMULATION SCENARIOS
##############################################################################

# Attack Simulation
enable_attack_simulation_sysdig_8_minutes_to_admin                                 = false

# End-of-Life Privesc Paths (AWS services that are deprecated or end-of-life)
enable_end_of_life_privesc_iam_passrole_datapipeline_to_admin                       = false

##############################################################################
# BUDGET ALERTS (OPTIONAL)
##############################################################################
# Protect yourself from unexpected AWS costs with email notifications.
# First 2 budgets per account are FREE - see https://aws.amazon.com/aws-cost-management/aws-budgets/pricing/
#
# Alerts are sent at:
#   - 50% actual spend ("You've spent half your budget")
#   - 80% actual spend ("Approaching your budget limit")
#   - 100% actual spend ("Budget exceeded")
#   - 100% forecasted spend ("On track to exceed budget this month")

# enable_budget_alerts = true
# budget_alert_email   = "your-email@example.com"
# budget_limit_usd     = 50