{"uid":"cap_YCspea2FWaWIWp3Y7OIo_","slug":"lineagelint-cloudformation-template-risk-analyzer-ca54e8f4","name":"LineageLint CloudFormation Template Risk Analyzer","description":"An autonomous paid API accepting USDC on Base mainnet.","url":"https://47-85-47-24.sslip.io/v1/cloudformation-template-risk","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"scenario":{"enum":["risky-public-database-stack"],"type":"string","description":"Built-in paid CloudFormation security-review scenario"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["analysis_id","analyzer_version","label","profile","verdict","risk_score","summary","stats","resources","findings","approval_gates","coverage"],"properties":{"label":{"type":"string"},"stats":{"type":"object"},"profile":{"enum":["production","development"],"type":"string"},"summary":{"type":"string"},"verdict":{"enum":["BLOCK","WARN","PASS"],"type":"string"},"coverage":{"type":"object"},"findings":{"type":"array","items":{"type":"object"}},"resources":{"type":"array","items":{"type":"object"}},"risk_score":{"type":"integer","maximum":100,"minimum":0},"analysis_id":{"type":"string"},"approval_gates":{"type":"array","items":{"type":"string"}},"analyzer_version":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"label":"paid-demo:risky-public-database-stack","stats":{"output_count":1,"resource_count":3,"template_bytes":892,"parameter_count":1,"tree_node_count":45,"findings_by_severity":{"low":0,"high":5,"medium":8,"critical":6},"custom_resource_count":0,"dynamic_iam_policy_count":0,"embedded_iam_policy_count":2,"stateful_without_retention_count":1},"profile":"production","summary":"BLOCK: 19 finding(s) across 3 resource(s); 11 require resolution or explicit approval.","verdict":"BLOCK","coverage":{"mode":"static-parsed-cloudformation-template","checks":["sensitive parameters, dynamic references, and outputs","embedded IAM identity, resource, trust, and key policies","public network and unauthenticated function exposure","storage encryption, recovery, deletion, and replacement controls","database backup and deletion protection","custom resources and macro execution boundaries","immutable Lambda artifacts and IMDSv2"],"limitations":["Does not execute transforms, macros, custom resources, hooks, or CloudFormation Rules.","Does not validate every resource property against current provider schemas; use cfn-lint for schema validation.","Cannot inspect referenced artifacts, nested templates, existing account defaults, stack policies, service roles, or runtime resource state.","Static review does not replace change sets, CloudFormation Guard, Hooks, IAM Access Analyzer, drift detection, or a live security assessment."],"aws_api_contacted":false,"template_deployed":false,"credentials_loaded":false,"transforms_executed":false,"secret_values_returned":false},"findings":[{"code":"secret_parameter_literal_default","path":"Parameters.<redacted>.Default","message":"A secret-like parameter has a literal default; the value is omitted.","severity":"critical","standard":"aws-cloudformation-sensitive-parameters","remediation":"Remove the default and use a dynamic Secrets Manager or SSM SecureString reference."},{"code":"embedded_iam_wildcard_allow_principal","path":"Resources.AdminRole.Properties.AssumeRolePolicyDocument.Statement[0].Principal","message":"The allow statement trusts a wildcard principal selector.","severity":"critical","standard":"aws-iam-principal-guidance","remediation":"Name exact principals or constrain them with immutable organization, account, ARN, source, audience, and subject conditions."},{"code":"embedded_iam_allow_all_actions","path":"Resources.AdminRole.Properties.Policies[0].PolicyDocument.Statement[0].Action","message":"The statement grants every AWS action.","severity":"critical","standard":"aws-iam-least-privilege","remediation":"Replace * with the smallest task-specific action allowlist."},{"code":"embedded_iam_passrole_deployment_escalation_chain","path":"Resources.AdminRole.Properties.Policies[0].PolicyDocument.Statement[0].Action","message":"The statement combines PassRole with a workload-creation action that can execute as another role.","severity":"critical","standard":"aws-iam-privilege-escalation","remediation":"Separate deployment and role-delegation permissions, constrain both resources, and enforce service and tag conditions."},{"code":"public_database","path":"Resources.Database.Properties.PubliclyAccessible","message":"The database is explicitly internet-accessible.","severity":"critical","standard":"aws-database-security","remediation":"Set PubliclyAccessible to false and place the database in private subnets with narrow security groups."},{"code":"public_security_group_ingress","path":"Resources.DatabaseIngress.Properties.SecurityGroupIngress[0]","message":"A security-group ingress rule exposes a port range to the public internet.","severity":"critical","standard":"aws-network-exposure","remediation":"Restrict source CIDRs or security groups and expose only the exact application port through a managed edge."},{"code":"sensitive_stack_output","path":"Outputs.<redacted>","message":"A stack output appears to expose a secret-like or secure parameter value; the value is omitted.","severity":"high","standard":"aws-cloudformation-sensitive-parameters","remediation":"Remove sensitive outputs and let workloads retrieve secrets directly with least-privilege runtime access."},{"code":"secret_parameter_without_noecho","path":"Parameters.<redacted>.NoEcho","message":"A secret-like parameter is not protected with NoEcho.","severity":"high","standard":"aws-cloudformation-sensitive-parameters","remediation":"Set NoEcho: true and source the value from Secrets Manager or SSM SecureString."},{"code":"embedded_iam_passrole_all_resources","path":"Resources.AdminRole.Properties.Policies[0].PolicyDocument.Statement[0].Resource","message":"iam:PassRole can target every role.","severity":"high","standard":"aws-iam-passrole","remediation":"Restrict Resource to approved execution roles and add iam:PassedToService."},{"code":"embedded_iam_wildcard_resource","path":"Resources.AdminRole.Properties.Policies[0].PolicyDocument.Statement[0].Resource","message":"The allow statement applies to every resource.","severity":"high","standard":"aws-iam-least-privilege","remediation":"Scope Resource to exact ARNs and use conditions only as a secondary boundary."},{"code":"database_encryption_not_enabled","path":"Resources.Database.Properties.StorageEncrypted","message":"Storage encryption is not explicitly enabled.","severity":"high","standard":"aws-data-encryption","remediation":"Set StorageEncrypted to true and use an appropriately scoped KMS key."},{"code":"embedded_iam_privileged_action_without_mfa_condition","path":"Resources.AdminRole.Properties.AssumeRolePolicyDocument.Statement[0].Condition","message":"Production privilege-management actions have no policy-level MFA condition.","severity":"medium","standard":"aws-iam-mfa-best-practice","remediation":"Require MFA for human-admin paths or ensure the policy is attached only to tightly controlled workload roles."},{"code":"embedded_iam_partial_action_wildcard","path":"Resources.AdminRole.Properties.Policies[0].PolicyDocument.Statement[0].Action","message":"The statement uses wildcard action patterns whose future match set can expand.","severity":"medium","standard":"aws-iam-least-privilege","remediation":"Prefer explicit action names or tightly review the wildcard pattern and service evolution."},{"code":"embedded_iam_passrole_missing_service_boundary","path":"Resources.AdminRole.Properties.Policies[0].PolicyDocument.Statement[0].Condition","message":"iam:PassRole is not constrained to an intended destination service.","severity":"medium","standard":"aws-iam-passrole","remediation":"Add an iam:PassedToService condition and an exact role ARN allowlist."},{"code":"embedded_iam_privileged_action_without_mfa_condition","path":"Resources.AdminRole.Properties.Policies[0].PolicyDocument.Statement[0].Condition","message":"Production privilege-management actions have no policy-level MFA condition.","severity":"medium","standard":"aws-iam-mfa-best-practice","remediation":"Require MFA for human-admin paths or ensure the policy is attached only to tightly controlled workload roles."},{"code":"stateful_resource_without_deletion_protection","path":"Resources.Database.DeletionPolicy","message":"A stateful resource can be deleted with the stack without retention or snapshot protection.","severity":"medium","standard":"aws-cloudformation-deletion-policy","remediation":"Set an appropriate Retain, RetainExceptOnCreate, or Snapshot DeletionPolicy and document cleanup ownership."},{"code":"database_backup_retention_missing","path":"Resources.Database.Properties.BackupRetentionPeriod","message":"Automated backup retention is absent, dynamic, or disabled.","severity":"medium","standard":"aws-cloudformation-recovery","remediation":"Set a non-zero retention period aligned with recovery objectives."},{"code":"database_deletion_protection_not_enabled","path":"Resources.Database.Properties.DeletionProtection","message":"Database deletion protection is not explicitly enabled.","severity":"medium","standard":"aws-cloudformation-recovery","remediation":"Enable deletion protection and pair it with retention and tested backups."},{"code":"stateful_resource_without_replacement_protection","path":"Resources.Database.UpdateReplacePolicy","message":"A replacement update can delete the old stateful resource by default.","severity":"medium","standard":"aws-cloudformation-update-replace-policy","remediation":"Set UpdateReplacePolicy to Retain or Snapshot where supported and plan lifecycle cleanup."}],"resources":[{"type":"AWS::IAM::Role","index":0,"logical_id":"AdminRole","conditioned":false,"deletion_policy":"default-delete","depends_on_count":0,"update_replace_policy":"default-delete"},{"type":"AWS::EC2::SecurityGroupIngress","index":1,"logical_id":"DatabaseIngress","conditioned":false,"deletion_policy":"default-delete","depends_on_count":0,"update_replace_policy":"default-delete"},{"type":"AWS::RDS::DBInstance","index":2,"logical_id":"Database","conditioned":false,"deletion_policy":"default-delete","depends_on_count":0,"update_replace_policy":"default-delete"}],"risk_score":100,"analysis_id":"stack-77885253f12fbb0fd46a","approval_gates":["Resolve or explicitly approve 11 critical/high template finding(s) before creating a change set.","Validate 2 embedded or dynamic IAM policy document(s) in the processed template with IAM Access Analyzer.","Confirm backup, retention, replacement, and cleanup ownership for 1 stateful resource(s)."],"analyzer_version":"stackguard-cloudformation/1.0"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_WWr0gvbpEyETpLJWOUV7Q","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Statically analyzes AWS CloudFormation templates for security risks, returning a structured verdict (BLOCK/WARN/PASS), risk score, and detailed findings by severity.","exampleAgentPrompt":"Can you run a security review on the risky-public-database-stack CloudFormation scenario and tell me whether it should be blocked, warned, or passed — including any critical findings I need to fix before deploying?","exampleUseCases":null,"resultDescription":"A JSON object containing: a BLOCK/WARN/PASS verdict, integer risk score (0-100), human-readable summary, array of findings with severity codes (critical/high/medium/low) and remediation advice, list of resources analyzed, approval gates required for deployment, and a coverage object describing what was and wasn't checked (e.g. no credentials loaded, no transforms executed).","failureModes":["Invalid or missing 'input' object returns a 400-level error","Unsupported HTTP method (e.g. POST) returns an error since only GET/HEAD/DELETE are allowed","Invalid 'scenario' enum value returns a validation error","Payment not completed via x402 protocol returns a 402 Payment Required response","Network or server errors may return 5xx responses"],"whenToPreferThis":"Choose this endpoint when you need automated, structured CloudFormation security analysis with machine-readable verdicts and severity-bucketed findings suitable for CI/CD gates. It is especially useful when you want BLOCK/WARN/PASS decisions with approval gate lists for production deployments. Prefer it over manual cfn-lint when you need IAM policy analysis, public exposure checks, and database protection audits combined in a single call. Note it performs static analysis only and does not execute transforms or access live AWS APIs.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:50:29.121Z","isFirstParty":false}