Skip to content

Commit eac34e1

Browse files
tas50claude
tas50
and
claude
authored
⭐ Add Bedrock, Control Tower, Security Lake, Verified Access, Private CA resources (#7136)
* ⭐ Add aws.bedrock, aws.controltower, aws.securitylake, aws.verifiedaccess, aws.privateca resources Add 5 new high-impact AWS services for security querying, covering GenAI governance, multi-account governance, security telemetry, zero-trust networking, and private PKI. New resources (22 total): - aws.bedrock: foundationModel, customModel, guardrail, modelInvocationLoggingConfiguration, provisionedModelThroughput - aws.controltower: landingZone, enabledBaseline - aws.securitylake: dataLake, subscriber - aws.verifiedaccess: instance, trustProvider, group, endpoint, instanceLoggingConfiguration - aws.privateca: certificateAuthority Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * 🐛 Add missing service-availability checks and fix log levels Add IsServiceNotAvailableInRegionError handling to all four Verified Access methods so queries don't fail in unsupported regions. Downgrade service-unavailable log messages from Warn to Debug across all new providers since these are expected and not actionable. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix spellcheck failure Signed-off-by: Tim Smith <tsmith84@gmail.com> * 🐛 Fix foundation model duplicates and privateca tags N+1 Foundation models: query once from default region instead of all regions, since ListFoundationModels returns a global catalog. Private CA tags: lazy-load via computed method to avoid N+1 ListTags calls during listing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * 🐛 Fix error handling, KMS key resolution, and typed security groups - Add access-denied/service-unavailable handling to foundationModels() - Guard Security Lake encryptionKmsKey() against non-ARN KMS key IDs - Add access-denied handling to Verified Access loggingConfiguration() - Add access-denied handling to Private CA tags() and policy() - Replace double-conversion with enumSliceToAny for subscriber accessTypes - Change endpoint securityGroupIds to typed securityGroups() references - Optimize landing zone query to use default region instead of all-region scan - Expose Region() on AwsConnection for default region access Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * 🧹 Address review comments: driftStatus as dict, use NewSecurityGroupArn - Change enabledBaseline driftStatus from extracted string to full dict, surfacing all drift information instead of only Types.Inheritance.Status - Use NewSecurityGroupArn helper instead of raw fmt.Sprintf for endpoint security group ARN construction Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * 🐛 Fix service-availability errors and timestamp parsing for new resources Fix four bugs found during live verification of the new aws.bedrock, aws.verifiedaccess, aws.controltower, and aws.privateca resources: - IsServiceNotAvailableInRegionError now catches InvalidAction (EC2 Verified Access in unsupported regions), UnknownOperationException and "Unknown operation" (Bedrock in unsupported regions) - parseAwsTimestamp falls back to parsing timestamps without timezone suffix (e.g. "2026-04-09T05:40:04" from EC2 Verified Access), assuming UTC - Control Tower APIs now handle the "AWSControlTowerAdmin" ValidationException gracefully when CT is not configured, returning empty results instead of erroring - Add unit tests for all fixes (24 test cases across 4 new test files) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Signed-off-by: Tim Smith <tsmith84@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 209756c commit eac34e1

22 files changed

+32741
-26907
lines changed

‎.github/actions/spelling/expect.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ ciscocatalyst
4141
clcerts
4242
chokepoint
4343
cloudflare
44+
claude
4445
Clusterwide
4546
cmdline
4647
cmek
@@ -50,6 +51,7 @@ cname
5051
compressratio
5152
cooldown
5253
cpe
54+
crowdstrike
5355
cryptokey
5456
ctx
5557
customresources
@@ -136,6 +138,7 @@ ipsetforwardedipconfig
136138
ipsetreferencestatement
137139
istio
138140
jira
141+
jamf
139142
jsonbody
140143
junos
141144
kerberoastable
@@ -224,6 +227,7 @@ posix
224227
postgre
225228
POWERUSER
226229
priorityclass
230+
privateca
227231
processingjob
228232
psc
229233
PTn
@@ -289,6 +293,7 @@ targetgroup
289293
tde
290294
testutils
291295
tgw
296+
throughputs
292297
timestream
293298
toplevel
294299
toport
@@ -306,6 +311,7 @@ Utc
306311
valkey
307312
VAULTNAME
308313
Vcpus
314+
verifiedaccess
309315
vdcs
310316
vdev
311317
vertexai

‎.github/actions/spelling/line_forbidden.patterns‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -387,7 +387,7 @@
387387

388388
# s.b. CrowdStrike
389389
\bCrowd Strike\b
390-
\b[Cc]rowdstrike\b
390+
# \b[Cc]rowdstrike\b # false positive with enum in aws provider
391391

392392
# s.b. Zendesk
393393
\bZenDesk\b

‎providers/aws/config/config.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import (
1414
var Config = plugin.Provider{
1515
Name: "aws",
1616
ID: "go.mondoo.com/cnquery/v9/providers/aws",
17-
Version: "13.9.0",
17+
Version: "13.10.0",
1818
ConnectionTypes: []string{provider.DefaultConnectionType, string(awsec2ebsconn.EBSConnectionType)},
1919
Connectors: []plugin.Connector{
2020
{

‎providers/aws/connection/clients.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"github.com/aws/aws-sdk-go-v2/service/accessanalyzer"
1010
"github.com/aws/aws-sdk-go-v2/service/account"
1111
"github.com/aws/aws-sdk-go-v2/service/acm"
12+
"github.com/aws/aws-sdk-go-v2/service/acmpca"
1213
"github.com/aws/aws-sdk-go-v2/service/apigateway"
1314
"github.com/aws/aws-sdk-go-v2/service/applicationautoscaling"
1415
"github.com/aws/aws-sdk-go-v2/service/appmesh"
@@ -17,6 +18,7 @@ import (
1718
"github.com/aws/aws-sdk-go-v2/service/autoscaling"
1819
"github.com/aws/aws-sdk-go-v2/service/backup"
1920
"github.com/aws/aws-sdk-go-v2/service/batch"
21+
"github.com/aws/aws-sdk-go-v2/service/bedrock"
2022
"github.com/aws/aws-sdk-go-v2/service/cloudformation"
2123
"github.com/aws/aws-sdk-go-v2/service/cloudfront"
2224
"github.com/aws/aws-sdk-go-v2/service/cloudtrail"
@@ -27,6 +29,7 @@ import (
2729
"github.com/aws/aws-sdk-go-v2/service/cognitoidentity"
2830
"github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider"
2931
"github.com/aws/aws-sdk-go-v2/service/configservice"
32+
"github.com/aws/aws-sdk-go-v2/service/controltower"
3033
"github.com/aws/aws-sdk-go-v2/service/databasemigrationservice"
3134
"github.com/aws/aws-sdk-go-v2/service/dax"
3235
"github.com/aws/aws-sdk-go-v2/service/directoryservice"
@@ -77,6 +80,7 @@ import (
7780
"github.com/aws/aws-sdk-go-v2/service/scheduler"
7881
"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
7982
"github.com/aws/aws-sdk-go-v2/service/securityhub"
83+
"github.com/aws/aws-sdk-go-v2/service/securitylake"
8084
"github.com/aws/aws-sdk-go-v2/service/sfn"
8185
"github.com/aws/aws-sdk-go-v2/service/shield"
8286
"github.com/aws/aws-sdk-go-v2/service/sns"
@@ -2057,3 +2061,71 @@ func (t *AwsConnection) SsoAdmin(region string) *ssoadmin.Client {
20572061
t.clientcache.Store(cacheVal, &CacheEntry{Data: client})
20582062
return client
20592063
}
2064+
2065+
func (t *AwsConnection) Acmpca(region string) *acmpca.Client {
2066+
if len(region) == 0 {
2067+
region = t.cfg.Region
2068+
}
2069+
cacheVal := "_acmpca_" + region
2070+
c, ok := t.clientcache.Load(cacheVal)
2071+
if ok {
2072+
log.Debug().Msg("use cached acmpca client")
2073+
return c.Data.(*acmpca.Client)
2074+
}
2075+
cfg := t.cfg.Copy()
2076+
cfg.Region = region
2077+
client := acmpca.NewFromConfig(cfg)
2078+
t.clientcache.Store(cacheVal, &CacheEntry{Data: client})
2079+
return client
2080+
}
2081+
2082+
func (t *AwsConnection) Bedrock(region string) *bedrock.Client {
2083+
if len(region) == 0 {
2084+
region = t.cfg.Region
2085+
}
2086+
cacheVal := "_bedrock_" + region
2087+
c, ok := t.clientcache.Load(cacheVal)
2088+
if ok {
2089+
log.Debug().Msg("use cached bedrock client")
2090+
return c.Data.(*bedrock.Client)
2091+
}
2092+
cfg := t.cfg.Copy()
2093+
cfg.Region = region
2094+
client := bedrock.NewFromConfig(cfg)
2095+
t.clientcache.Store(cacheVal, &CacheEntry{Data: client})
2096+
return client
2097+
}
2098+
2099+
func (t *AwsConnection) Controltower(region string) *controltower.Client {
2100+
if len(region) == 0 {
2101+
region = t.cfg.Region
2102+
}
2103+
cacheVal := "_controltower_" + region
2104+
c, ok := t.clientcache.Load(cacheVal)
2105+
if ok {
2106+
log.Debug().Msg("use cached controltower client")
2107+
return c.Data.(*controltower.Client)
2108+
}
2109+
cfg := t.cfg.Copy()
2110+
cfg.Region = region
2111+
client := controltower.NewFromConfig(cfg)
2112+
t.clientcache.Store(cacheVal, &CacheEntry{Data: client})
2113+
return client
2114+
}
2115+
2116+
func (t *AwsConnection) Securitylake(region string) *securitylake.Client {
2117+
if len(region) == 0 {
2118+
region = t.cfg.Region
2119+
}
2120+
cacheVal := "_securitylake_" + region
2121+
c, ok := t.clientcache.Load(cacheVal)
2122+
if ok {
2123+
log.Debug().Msg("use cached securitylake client")
2124+
return c.Data.(*securitylake.Client)
2125+
}
2126+
cfg := t.cfg.Copy()
2127+
cfg.Region = region
2128+
client := securitylake.NewFromConfig(cfg)
2129+
t.clientcache.Store(cacheVal, &CacheEntry{Data: client})
2130+
return client
2131+
}

‎providers/aws/connection/connection.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,10 @@ func (p *AwsConnection) AccountId() string {
145145
return p.accountId
146146
}
147147

148+
func (p *AwsConnection) Region() string {
149+
return p.cfg.Region
150+
}
151+
148152
func parseFlagsForConnectionOptions(m map[string]string, creds []*vault.Credential) []ConnectionOption {
149153
o := make([]ConnectionOption, 0)
150154
if apiEndpoint, ok := m["endpoint-url"]; ok {

‎providers/aws/go.mod‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ require (
1212
github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.47.0
1313
github.com/aws/aws-sdk-go-v2/service/account v1.30.5
1414
github.com/aws/aws-sdk-go-v2/service/acm v1.38.1
15+
github.com/aws/aws-sdk-go-v2/service/acmpca v1.46.12
1516
github.com/aws/aws-sdk-go-v2/service/apigateway v1.39.1
1617
github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.14
1718
github.com/aws/aws-sdk-go-v2/service/appmesh v1.35.12
@@ -20,6 +21,7 @@ require (
2021
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.65.0
2122
github.com/aws/aws-sdk-go-v2/service/backup v1.55.0
2223
github.com/aws/aws-sdk-go-v2/service/batch v1.63.2
24+
github.com/aws/aws-sdk-go-v2/service/bedrock v1.59.0
2325
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.71.9
2426
github.com/aws/aws-sdk-go-v2/service/cloudfront v1.61.0
2527
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.9
@@ -30,6 +32,7 @@ require (
3032
github.com/aws/aws-sdk-go-v2/service/cognitoidentity v1.33.22
3133
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.59.3
3234
github.com/aws/aws-sdk-go-v2/service/configservice v1.62.1
35+
github.com/aws/aws-sdk-go-v2/service/controltower v1.28.9
3336
github.com/aws/aws-sdk-go-v2/service/databasemigrationservice v1.62.0
3437
github.com/aws/aws-sdk-go-v2/service/dax v1.29.16
3538
github.com/aws/aws-sdk-go-v2/service/directoryservice v1.38.16
@@ -80,6 +83,7 @@ require (
8083
github.com/aws/aws-sdk-go-v2/service/scheduler v1.17.22
8184
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.5
8285
github.com/aws/aws-sdk-go-v2/service/securityhub v1.68.3
86+
github.com/aws/aws-sdk-go-v2/service/securitylake v1.25.13
8387
github.com/aws/aws-sdk-go-v2/service/sfn v1.40.10
8488
github.com/aws/aws-sdk-go-v2/service/shield v1.34.21
8589
github.com/aws/aws-sdk-go-v2/service/sns v1.39.15

‎providers/aws/go.sum‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,8 @@ github.com/aws/aws-sdk-go-v2/service/account v1.30.5 h1:mBCX+sC+HpY0uvgGjBKlUaRo
171171
github.com/aws/aws-sdk-go-v2/service/account v1.30.5/go.mod h1:0Yr7MY5U8hHfqLWVyzcs+MrkmcVlNqgXijaK3ryIHLc=
172172
github.com/aws/aws-sdk-go-v2/service/acm v1.38.1 h1:41vgMbK0HvVfv5+549nVLMDWIsWFP/0FNAYDos5lKGA=
173173
github.com/aws/aws-sdk-go-v2/service/acm v1.38.1/go.mod h1:0XoAyD03Stvqf8e/vVCk/1FP2aaF+xUluP7K9MrHWcQ=
174+
github.com/aws/aws-sdk-go-v2/service/acmpca v1.46.12 h1:jnLzSmGRlTl7SYhecRKMgeKeg8lkCkOzRLT1B3GSpSY=
175+
github.com/aws/aws-sdk-go-v2/service/acmpca v1.46.12/go.mod h1:6o9TY7hinjyo61EUZSJN9IX+IcKe3DDjbTyFcH8GxlI=
174176
github.com/aws/aws-sdk-go-v2/service/apigateway v1.39.1 h1:r3dXvi6tMfv4D48pyantOgDL48ifV6Ibj1eU1ca0C3k=
175177
github.com/aws/aws-sdk-go-v2/service/apigateway v1.39.1/go.mod h1:nhYOLBwQu7P3ckR+L4gZkY0DT0nAhrQuZkI51jR1vTE=
176178
github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.14 h1:0aYQ2UaSB1ccXZXUQ4a5XanrHEykKNzMLFgLEDhf8PU=
@@ -187,6 +189,8 @@ github.com/aws/aws-sdk-go-v2/service/backup v1.55.0 h1:p/1UY5ijuHkzGNTmRyvfU5t/f
187189
github.com/aws/aws-sdk-go-v2/service/backup v1.55.0/go.mod h1:H59xrHDDsJO4OMJ9bznKryHxZdMOvoZb+4dKW+A9TKo=
188190
github.com/aws/aws-sdk-go-v2/service/batch v1.63.2 h1:9bsy0RFJYSspgVBhJ9rArmHOMS9XYYHdg1IgpuZqUO4=
189191
github.com/aws/aws-sdk-go-v2/service/batch v1.63.2/go.mod h1:T/6gED/2b8Qh8ZOOke4oG/JCjUewh+YFkTDF7GODXQ0=
192+
github.com/aws/aws-sdk-go-v2/service/bedrock v1.59.0 h1:iddGKq5eJ8ABEDE543752cUuI0mSAJOBDuoC1RcS+bQ=
193+
github.com/aws/aws-sdk-go-v2/service/bedrock v1.59.0/go.mod h1:C8KxG3IPteAlDQUCBVIXfkn81kDh9iIBZ4SS8B5UbDE=
190194
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.71.9 h1:AISf54dn2oMUmhoWt4UH80xC8GqlZectZIcffiJzp6U=
191195
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.71.9/go.mod h1:YWA53lezhB2wltdgeVvDQEIwGVKWh/n+yU5Wh0YTxCw=
192196
github.com/aws/aws-sdk-go-v2/service/cloudfront v1.61.0 h1:Yx6+Np7TIPx2/j15dWnuGadv+w11ysw5KHgKpaiZsYM=
@@ -207,6 +211,8 @@ github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.59.3 h1:iO0QRVlR
207211
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.59.3/go.mod h1:XPkppF4ijOR6oZvwXB2tjQDLjkTEGCFn8Onl26v4GHQ=
208212
github.com/aws/aws-sdk-go-v2/service/configservice v1.62.1 h1:0kqK/rGcsuDGDyLLBjLSH95zC3k8lIkW0nksCYEU72g=
209213
github.com/aws/aws-sdk-go-v2/service/configservice v1.62.1/go.mod h1:9dXB7G3BUakIT/aCgH8si8fCl//iWvR8wpkWuVKY22A=
214+
github.com/aws/aws-sdk-go-v2/service/controltower v1.28.9 h1:FKQ4VPl2Vp3qrfEQ1DA7CrBXVbMW9axovux13CbLtaY=
215+
github.com/aws/aws-sdk-go-v2/service/controltower v1.28.9/go.mod h1:BV/X4lbe2tx+pUSdSoDp/oJEVSakBFkdBo0nwnmPKDc=
210216
github.com/aws/aws-sdk-go-v2/service/databasemigrationservice v1.62.0 h1:aGmD/oKKz23xhUe7xA8Fij4wLdcgLIEPfCLwCRvVsQ0=
211217
github.com/aws/aws-sdk-go-v2/service/databasemigrationservice v1.62.0/go.mod h1:RTEJQr3mkkqxxLUgBhmN5sc9ASrdGMlI+Gmv2CQhbDM=
212218
github.com/aws/aws-sdk-go-v2/service/dax v1.29.16 h1:QscUGVecME2laCqDmkUwK/Vp0xri5Ymujq3+NGLUn3o=
@@ -319,6 +325,8 @@ github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.5 h1:z2ayoK3pOvf8ODj/v
319325
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.5/go.mod h1:mpZB5HAl4ZIISod9qCi12xZ170TbHX9CCJV5y7nb7QU=
320326
github.com/aws/aws-sdk-go-v2/service/securityhub v1.68.3 h1:Nz5/FeXnKq+7YtIeNtHIuDeX/ZeFWDETL0oaqf8V0VI=
321327
github.com/aws/aws-sdk-go-v2/service/securityhub v1.68.3/go.mod h1:wFhqYLcoMThnIKlNsl048lq9FmCA20hJV1GY0TvS7MI=
328+
github.com/aws/aws-sdk-go-v2/service/securitylake v1.25.13 h1:RfJQCcBl1LbCq0aiDXiB4cxrhOV7P+7YAytFnpa/ENI=
329+
github.com/aws/aws-sdk-go-v2/service/securitylake v1.25.13/go.mod h1:I4Wy1npPxCFEvynpbEM8orrnq5a34kGKY29DzGKeGqo=
322330
github.com/aws/aws-sdk-go-v2/service/sfn v1.40.10 h1:R6zfaJNZcopLNZujk02QwmE78cMOL1KRx08FtxTyI88=
323331
github.com/aws/aws-sdk-go-v2/service/sfn v1.40.10/go.mod h1:Csc9j7BBtxws0bI2Aj+ALQpDkWaySstkqB37+1XyyJ8=
324332
github.com/aws/aws-sdk-go-v2/service/shield v1.34.21 h1:mO+bATVTYarn2BlIWGoZ8i+X4+GEARDp940psUNh0f4=

‎providers/aws/resources/aws.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,16 +118,22 @@ func Is400InstanceNotFoundError(err error) bool {
118118
return false
119119
}
120120

121-
// IsServiceNotAvailableInRegionError checks if the error indicates the service is not available in the region.
122-
// This typically happens with DNS lookup failures for regional services like MemoryDB.
121+
// IsServiceNotAvailableInRegionError checks if the error indicates the service or API action
122+
// is not available in the region. This includes DNS lookup failures for regional services,
123+
// InvalidAction errors for EC2 actions not yet deployed to a region (e.g., Verified Access),
124+
// and UnknownOperationException for services like Bedrock in unsupported regions.
123125
func IsServiceNotAvailableInRegionError(err error) bool {
124126
if err == nil {
125127
return false
126128
}
127129
errStr := err.Error()
128130
return strings.Contains(errStr, "no such host") ||
129131
strings.Contains(errStr, "UnknownEndpoint") ||
130-
strings.Contains(errStr, "could not resolve endpoint")
132+
strings.Contains(errStr, "could not resolve endpoint") ||
133+
strings.Contains(errStr, "InvalidAction") ||
134+
strings.Contains(errStr, "UnknownOperationException") ||
135+
strings.Contains(errStr, "Unknown operation") ||
136+
strings.Contains(errStr, "Unknown Operation")
131137
}
132138

133139
func toInterfaceMap(m map[string]string) map[string]any {

0 commit comments

Comments
 (0)