Jigar Bhatt 1c0dfd4f67 fix(aws-agents-for-devsecops): missing S3 bucket ownership verification (#305) ...

* Merge commit from fork

The Security Agent skills derive a deterministic scan bucket name
(security-agent-scans-<account>-<region>) from the non-secret caller
account ID. Because S3's namespace is global, a third party can
pre-register the predictable name; the skills validated the bucket by
existence only, so source archives (containing .env, *.pem,
terraform.tfstate) could be uploaded into an attacker-owned bucket.

- setup-security-agent: head-bucket now asserts --expected-bucket-owner
  and a 403 on a foreign-owned bucket is fatal; create-bucket treats
  BucketAlreadyExists as fatal (distinct from BucketAlreadyOwnedByYou)
  and re-asserts ownership after creation before any use.
- scanning / diff-scanning / threat-modeling: every 'aws s3 cp' upload
  now passes --expected-bucket-owner <account> so writes fail closed if
  the bucket is not owned by the caller.
- Added ownership Rules and troubleshooting notes.

Mirrors awslabs/mcp#4490 (MCP server path) for the Claude plugin skills.

* Bump plugin version

---------

Co-authored-by: Arne Wouters <25950814+arnewouters@users.noreply.github.com>
Co-authored-by: Arne Wouters <awouters@amazon.com>

2026-09-10 09:09:29 +00:00

..

aws-agents

docs(payments): make skill-onboarding tag mandatory (#297)

2026-09-04 23:10:28 +00:00

aws-agents-for-devsecops

fix(aws-agents-for-devsecops): missing S3 bucket ownership verification (#305)

2026-09-10 09:09:29 +00:00

aws-core

feat(aws-containers): add ECS Action Logs guidance (#304)

2026-09-09 17:11:19 +00:00

aws-data-analytics

feat: update amazon-opensearch-service skill (#289)

2026-09-03 13:53:29 +00:00