[FinServAssessments] Add 64 FinServ GenAI risk checks (FS-01 to FS-69)

.ash/.ash.yaml

@@ -0,0 +1,235 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/awslabs/automated-security-helper/refs/heads/main/automated_security_helper/schemas/AshConfig.json
+project_name: sample-aiml-security-assessment
+global_settings:
+  severity_threshold: MEDIUM
+  ignore_paths:
+    # SAM build cache — transitively scanned pydantic/bs4/botocore deps
+    # produce thousands of non-actionable Bandit findings in third-party code.
+    # CI scans only changed files, so it never touches .aws-sam/ either.
+    - path: "aiml-security-assessment/.aws-sam/**"
+      reason: "SAM build cache; contains third-party deps, not project source"
+    - path: "**/.aws-sam/**"
+      reason: "SAM build cache at any depth (deps/, build/, etc.)"
+    # Pre-existing static HTML sample reports; the embedded base64 SVG logos
+    # are flagged as high-entropy strings by detect-secrets.
+    - path: "sample-reports/**"
+      reason: "Static HTML sample outputs with embedded base64 SVG icons (upstream)"
+    # ASH's own output directory.
+    - path: ".ash/ash_output/**"
+      reason: "ASH output directory; scanning it creates recursion"
+  suppressions:
+    # The 4 Checkov rules below flag every assessment Lambda in the upstream
+    # repo for: no VPC (CKV_AWS_117), no DLQ (CKV_AWS_116), no per-function
+    # concurrency cap (CKV_AWS_115), and no KMS-encrypted env vars
+    # (CKV_AWS_173). This matches the architecture choices made for all 6
+    # pre-existing Lambdas (BedrockSecurity, SagemakerSecurity,
+    # AgentCoreSecurity, GenerateConsolidatedReport, IAMPermissionCaching,
+    # CleanupBucket) and applied consistently to the new
+    # FinServSecurityAssessmentFunction. The assessment framework runs on an
+    # internal schedule with short-lived invocations and reads config from a
+    # non-sensitive bucket-name env var; hardening these four items for every
+    # Lambda in the stack is a framework-wide change that should be proposed
+    # in a separate PR.
+    - rule_id: "CKV_AWS_117"
+      path: "aiml-security-assessment/template.yaml"
+      reason: "Upstream convention: assessment Lambdas are non-VPC (applies to all 7 Lambdas)"
+    - rule_id: "CKV_AWS_117"
+      path: "aiml-security-assessment/template-multi-account.yaml"
+      reason: "Upstream convention: assessment Lambdas are non-VPC (applies to all 7 Lambdas)"
+    - rule_id: "CKV_AWS_116"
+      path: "aiml-security-assessment/template.yaml"
+      reason: "Upstream convention: assessment Lambdas have no DLQ (applies to all 7 Lambdas)"
+    - rule_id: "CKV_AWS_116"
+      path: "aiml-security-assessment/template-multi-account.yaml"
+      reason: "Upstream convention: assessment Lambdas have no DLQ (applies to all 7 Lambdas)"
+    - rule_id: "CKV_AWS_115"
+      path: "aiml-security-assessment/template.yaml"
+      reason: "Upstream convention: no per-function concurrency cap (applies to all 7 Lambdas)"
+    - rule_id: "CKV_AWS_115"
+      path: "aiml-security-assessment/template-multi-account.yaml"
+      reason: "Upstream convention: no per-function concurrency cap (applies to all 7 Lambdas)"
+    - rule_id: "CKV_AWS_173"
+      path: "aiml-security-assessment/template.yaml"
+      reason: "Upstream convention: env var is a non-sensitive bucket-name reference"
+    - rule_id: "CKV_AWS_173"
+      path: "aiml-security-assessment/template-multi-account.yaml"
+      reason: "Upstream convention: env var is a non-sensitive bucket-name reference"
+
+    # cdk-nag AwsSolutions-IAM5 flags any IAM statement with Resource: "*".
+    # The FinServ IAM statement I added to 1-aiml-security-member-roles.yaml
+    # uses the same pattern as every pre-existing Sid in that policy. The
+    # wildcard is required for list/describe operations that are not
+    # ARN-scopable (e.g., ListBuckets, ListTrails, ListRules, ListPolicies).
+    # If upstream tightens IAM across all assessment statements, the FinServ
+    # Sid should be tightened in the same PR.
+    - rule_id: "AwsSolutions-IAM5"
+      path: "deployment/1-aiml-security-member-roles.yaml"
+      reason: "Read-only list/describe actions that cannot be ARN-scoped (upstream convention)"
+    - rule_id: "AwsSolutions-IAM5"
+      path: "deployment/aiml-security-single-account.yaml"
+      reason: "Read-only list/describe actions that cannot be ARN-scoped (upstream convention)"
+    - rule_id: "CKV_AWS_173"
+      path: "aiml-security-assessment/template-multi-account.yaml"
+      reason: "Upstream convention: env var is a bucket name reference, not sensitive (same as BR/SM/AC)"
+fail_on_findings: true
+ash_plugin_modules: []
+external_reports_to_include: []
+converters:
+  archive:
+    enabled: true
+    options: {}
+  jupyter:
+    enabled: true
+    options:
+      tool_version: '>=7.16.0,<8.0.0'
+      install_timeout: 300
+scanners:
+  bandit:
+    enabled: true
+    options:
+      severity_threshold: null
+      config_file: null
+      confidence_level: all
+      ignore_nosec: false
+      excluded_paths: []
+      additional_formats: []
+      tool_version: '>=1.7.0,<2.0.0'
+      install_timeout: 300
+  cdk-nag:
+    enabled: true
+    options:
+      severity_threshold: null
+      nag_packs:
+        AwsSolutionsChecks: true
+        HIPAASecurityChecks: false
+        NIST80053R4Checks: false
+        NIST80053R5Checks: false
+        PCIDSS321Checks: false
+  cfn-nag:
+    enabled: true
+    options:
+      severity_threshold: null
+  checkov:
+    enabled: true
+    options:
+      severity_threshold: null
+      config_file: null
+      skip_path: []
+      additional_formats:
+      - cyclonedx_json
+      offline: false
+      frameworks:
+      - all
+      skip_frameworks: []
+      tool_version: null
+      install_timeout: 300
+  detect-secrets:
+    enabled: true
+    options:
+      severity_threshold: null
+      baseline_file: null
+      scan_settings:
+        version: null
+        generated_at: null
+        plugins_used: []
+        filters_used: []
+        results: {}
+  grype:
+    enabled: true
+    options:
+      severity_threshold: null
+      config_file: null
+      offline: false
+  npm-audit:
+    enabled: true
+    options:
+      severity_threshold: null
+      offline: false
+  opengrep:
+    enabled: true
+    options:
+      severity_threshold: null
+      config: auto
+      exclude:
+      - '*-converted.py'
+      - '*_report_result.txt'
+      exclude_rule: []
+      severity: []
+      metrics: auto
+      offline: false
+      patterns: []
+      version: v1.15.1
+  semgrep:
+    enabled: true
+    options:
+      severity_threshold: null
+      config: auto
+      exclude:
+      - '*-converted.py'
+      - '*_report_result.txt'
+      exclude_rule: []
+      severity: []
+      metrics: auto
+      offline: false
+      tool_version: null
+      install_timeout: 300
+  syft:
+    enabled: true
+    options:
+      severity_threshold: null
+      config_file: null
+      exclude: []
+      additional_outputs:
+      - syft-table
+reporters:
+  csv:
+    enabled: true
+    options: {}
+  cyclonedx:
+    enabled: true
+    options: {}
+  html:
+    enabled: true
+    options: {}
+  flat-json:
+    enabled: true
+    options:
+      include_scanner_metrics: true
+      include_summary_metrics: true
+      include_metadata: true
+  gitlab-sast:
+    enabled: true
+    options: {}
+  junitxml:
+    enabled: true
+    options:
+      respect_severity_threshold: true
+  markdown:
+    enabled: true
+    options:
+      include_summary: true
+      include_findings_table: false
+      include_detailed_findings: true
+      max_detailed_findings: 20
+      top_hotspots_limit: 10
+      use_collapsible_details: true
+  ocsf:
+    enabled: true
+    options: {}
+  sarif:
+    enabled: true
+    options: {}
+  spdx:
+    enabled: false
+    options: {}
+  text:
+    enabled: true
+    options:
+      include_summary: true
+      include_findings_table: false
+      include_detailed_findings: false
+      max_detailed_findings: 20
+      top_hotspots_limit: 20
+  yaml:
+    enabled: false
+    options: {}

.ash/.gitignore

@@ -0,0 +1,2 @@
+# ASH default output directory (and variants)
+ash_output*

.cfnlintrc

@@ -1,12 +1,19 @@
 configure_rules:
   W3037:
-    # cfn-lint's IAM action database doesn't include newer services yet.
-    # These are valid IAM actions used by the assessment framework.
+    # cfn-lint's IAM action database lags behind newer AWS services, so it
+    # cannot recognize a small set of *valid* actions used by the assessment.
     strict: false
 
 ignore_checks:
-  # W3037: IAM action not recognized - cfn-lint's action database lags behind
-  # newer AWS services (bedrock-agent, bedrock-agentcore, s3:GetBucketEncryption, s3:HeadBucket)
+  # W3037: IAM action not recognized. As of the last review the ONLY actions
+  # this suppresses are valid-but-newer ones cfn-lint's DB does not yet list:
+  #   - bedrock-agentcore:*  (Amazon Bedrock AgentCore control plane)
+  #   - s3:GetBucketEncryption, s3:HeadBucket
+  # All Amazon Bedrock Knowledge Base / Data Source / Flow actions use the
+  # `bedrock:` IAM prefix (there is no `bedrock-agent:` IAM namespace — that is
+  # only the boto3 client name); the previously-present invalid `bedrock-agent:*`
+  # grants were removed. IAM-action correctness is now guarded positively by
+  # tests/test_iam_coverage.py rather than by this lint rule.
   - W3037
   # W1030: Parameter default/constraint mismatch - CodeBuildTimeout has MinValue/MaxValue
   # constraints that cfn-lint incorrectly flags when Ref is used

.github/workflows/python-tests.yml

@@ -6,12 +6,16 @@ on:
     paths:
       - "aiml-security-assessment/functions/security/**"
       - "tests/**"
+      - "consolidate_html_reports.py"
+      - "test_consolidate_finserv.py"
       - ".github/workflows/python-tests.yml"
   pull_request:
     branches: [main]
     paths:
       - "aiml-security-assessment/functions/security/**"
       - "tests/**"
+      - "consolidate_html_reports.py"
+      - "test_consolidate_finserv.py"
       - ".github/workflows/python-tests.yml"
 
 jobs:
@@ -36,20 +40,50 @@ jobs:
           # Install pydantic for schema validation used by Lambda functions
           pip install pydantic>=2.0.0
 
-      - name: Run tests with coverage
+      - name: Run upstream tests with coverage
         env:
           AIML_ASSESSMENT_BUCKET_NAME: test-assessment-bucket
           AWS_DEFAULT_REGION: us-east-1
           AWS_ACCESS_KEY_ID: testing
-          AWS_SECRET_ACCESS_KEY: testing
+          AWS_SECRET_ACCESS_KEY: testing  # pragma: allowlist secret
         run: |
           python -m pytest tests/ \
             -v \
             --tb=short \
             --cov=aiml-security-assessment/functions/security \
+            --cov-report=term-missing
+
+      - name: Run FinServ assessment tests with coverage
+        # Run separately from tests/: the FinServ suite has its own conftest and
+        # imports the FinServ app as top-level `app`, which would collide in a
+        # single pytest session with the other assessment modules' app.py files.
+        env:
+          AIML_ASSESSMENT_BUCKET_NAME: test-assessment-bucket
+          AWS_DEFAULT_REGION: us-east-1
+          AWS_ACCESS_KEY_ID: testing
+          AWS_SECRET_ACCESS_KEY: testing  # pragma: allowlist secret
+        run: |
+          python -m pytest aiml-security-assessment/functions/security/finserv_tests/ \
+            -v \
+            --tb=short \
+            --cov=aiml-security-assessment/functions/security \
+            --cov-append \
             --cov-report=term-missing \
-            --cov-report=xml:coverage.xml \
-            -x
+            --cov-report=xml:coverage.xml
+
+      - name: Run report-pipeline tests
+        # The single- and multi-account HTML report generators (REQ-1) and the
+        # FinServ categorization test. The report generator package ships an
+        # __init__.py, so its tests run with that directory as CWD.
+        env:
+          AIML_ASSESSMENT_BUCKET_NAME: test-assessment-bucket
+          AWS_DEFAULT_REGION: us-east-1
+          AWS_ACCESS_KEY_ID: testing
+          AWS_SECRET_ACCESS_KEY: testing  # pragma: allowlist secret
+        run: |
+          python -m pytest test_consolidate_finserv.py -v --tb=short
+          cd aiml-security-assessment/functions/security/generate_consolidated_report
+          python -m pytest test_generate_report.py -v --tb=short
 
       - name: Upload coverage report
         if: always()

.gitignore

@@ -2,6 +2,7 @@
 .kiro/
 .vscode/
 .claude/
+.codex/
 .mcp.json
 
 # AWS SAM build artifacts
@@ -12,6 +13,7 @@ __pycache__/
 *.py[cod]
 *$py.class
 *.pyc
+.pytest_cache/
 
 # OS files
 .DS_Store
@@ -39,4 +41,5 @@ samples/
 # Test output
 **/test_reports/
 
-.ruff_cache/
+.ruff_cache/
+.ash/