riposte-marketplace/integrations/aws/manifest.yaml

id: aws
name: AWS
version: 1.1.0
description: "Amazon Web Services (EC2, IAM, STS) — cloud containment: describe instances and security groups, authorize/revoke security-group ingress rules, change an instance's security groups (isolate), stop instances, and deactivate a compromised IAM access key. AWS Signature V4 authentication; stdlib-only, no extra Python dependencies."
changelog: "1.1.0 — Declare the risk tier on the 5 commands that carried none, all of them destructive. An unset risk was already gated as destructive, so the approval prompt does not move; what changes is that the tier is a stated decision rather than a default, and a command added later cannot inherit it by omission. | 1.0.0 — Initial release: EC2 describe instances/security-groups, authorize/revoke ingress, modify instance security groups, stop instances; IAM list/update access keys; STS caller identity."
category: cloud

# Per-instance configuration. Requests are signed with AWS Signature V4.
# Use an IAM user/role access key with EC2 + IAM permissions. session_token is
# only needed for temporary (STS) credentials.
config_schema:
  properties:
    access_key_id:
      type: string
      description: "AWS access key ID"
    secret_access_key:
      type: string
      description: "AWS secret access key"
      x-soar-sensitive: true
    region:
      type: string
      description: "Default AWS region (e.g. eu-west-1)"
      default: "us-east-1"
    session_token:
      type: string
      description: "Optional STS session token (for temporary credentials)"
      x-soar-sensitive: true
  required:
    - access_key_id
    - secret_access_key

commands:
  - id: describe_instances
    name: aws-describe-instances
    description: "Describe EC2 instances (optionally a single instance by ID)."
    risk: read
    inputs_schema:
      properties:
        instance_id: { type: string, description: "Optional instance ID to fetch a single instance" }
        region: { type: string, description: "Region override" }
      required: []
    outputs_schema: { properties: {} }
  - id: describe_security_groups
    name: aws-describe-security-groups
    description: "Describe EC2 security groups (optionally a single group by ID)."
    risk: read
    inputs_schema:
      properties:
        group_id: { type: string, description: "Optional security group ID" }
        region: { type: string, description: "Region override" }
      required: []
    outputs_schema: { properties: {} }
  - id: authorize_security_group_ingress
    name: aws-authorize-security-group-ingress
    description: "Add an inbound rule to a security group."
    risk: destructive
    inputs_schema:
      properties:
        group_id: { type: string, description: "Security group ID" }
        protocol: { type: string, description: "IP protocol (tcp, udp, icmp, or -1 for all)" }
        from_port: { type: number, description: "Start port" }
        to_port: { type: number, description: "End port" }
        cidr: { type: string, description: "Source CIDR (e.g. 203.0.113.0/24)" }
        region: { type: string, description: "Region override" }
      required: [group_id, protocol, cidr]
    outputs_schema: { properties: {} }
  - id: revoke_security_group_ingress
    name: aws-revoke-security-group-ingress
    description: "Remove an inbound rule from a security group (containment)."
    risk: destructive
    inputs_schema:
      properties:
        group_id: { type: string, description: "Security group ID" }
        protocol: { type: string, description: "IP protocol (tcp, udp, icmp, or -1 for all)" }
        from_port: { type: number, description: "Start port" }
        to_port: { type: number, description: "End port" }
        cidr: { type: string, description: "Source CIDR to revoke" }
        region: { type: string, description: "Region override" }
      required: [group_id, protocol, cidr]
    outputs_schema: { properties: {} }
  - id: modify_instance_security_groups
    name: aws-modify-instance-security-groups
    description: "Replace the security groups attached to an instance (e.g. move it to an isolation group)."
    risk: destructive
    inputs_schema:
      properties:
        instance_id: { type: string, description: "Instance ID" }
        group_ids: { type: string, description: "Comma-separated security group IDs to set" }
        region: { type: string, description: "Region override" }
      required: [instance_id, group_ids]
    outputs_schema: { properties: {} }
  - id: stop_instances
    name: aws-stop-instances
    description: "Stop one or more EC2 instances."
    risk: destructive
    inputs_schema:
      properties:
        instance_ids: { type: string, description: "Comma-separated instance IDs" }
        force: { type: boolean, description: "Force stop (default false)" }
        region: { type: string, description: "Region override" }
      required: [instance_ids]
    outputs_schema: { properties: {} }
  - id: list_access_keys
    name: aws-list-access-keys
    description: "List a user's IAM access keys."
    risk: read
    inputs_schema:
      properties:
        user_name: { type: string, description: "IAM user name (omit to use the calling user)" }
      required: []
    outputs_schema: { properties: {} }
  - id: update_access_key
    name: aws-update-access-key
    description: "Activate or deactivate an IAM access key (deactivate to contain a compromised key)."
    risk: destructive
    inputs_schema:
      properties:
        access_key_id: { type: string, description: "The access key ID to update" }
        status: { type: string, description: "Active or Inactive" }
        user_name: { type: string, description: "IAM user name (omit to use the calling user)" }
      required: [access_key_id, status]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: aws-test-connection
    description: "Verify credentials via STS GetCallerIdentity (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }