Validation Rules

Maps claim IDs to AWS CLI commands for verification. Covers common security check IDs (qa-*), external accessibility probes, and guidance for ad-hoc security queries. Inventory queries bypass this file entirely.

For how to interpret results, status definitions, scoring, and suppression handling see agents/roles.md → Expert Validation Process.

---

Rule Format

check_id:
  cli: <command with {{placeholders}}>
  confirmed: <condition that confirms issue>
  false_positive: <condition that disproves issue>

---

File Index

File	Contents
probes.md	External accessibility probes — S3, EC2, API Gateway, Lambda, RDS, SNS, SQS, TLS/SSL (testssl.sh)
iam.md	IAM users, roles, password policy, MFA condition evaluation, SLR abuse, SCP cross-reference
compute.md	EC2 instances, security groups, EBS encryption, Lambda function URLs, Lambda privilege escalation
storage.md	S3 buckets, KMS key rotation, RDS instances
detection.md	CloudTrail, GuardDuty, Security Hub, Access Analyzer, AWS Config, Inspector
common-checks.md	qa-01 to qa-10 baseline checks, ad-hoc query guidance, constraints

---

Claim ID → File Lookup

Claim ID prefix	File
iam_*, scp_*	iam.md
ec2_*, vpc_*, lambda_*	compute.md
s3_*, rds_*, kms_*	storage.md
cloudtrail_*, guardduty_*, securityhub_*, accessanalyzer_*, config_*, inspector*	detection.md
qa-01 to qa-10, adhoc-*	common-checks.md
Accessibility probes (curl/nmap/testssl.sh)	probes.md