carlos / platform Public

Reviewed d1b85d63; no files changed.

1. P1 — §3.1: The scanner role can read SSM parameters, violating D4. AmazonSSMManagedInstanceCore includes ssm:GetParameter and ssm:GetParameters on *. Attaching it alone does not deliver “no parameter grants.” The existing module documents this exact problem and supplies an explicit deny: infra/modules/region-host/main.tf:418. The AWS policy document confirms the permissions. Fix: Explicitly deny all parameter-read actions on the scanner role while retaining Session Manager’s channel permissions.

1. P1 — §3.2, steps 6–7: Masking the socket leaves clamd requiring a masked unit. Debian trixie’s clamd/clamav-daemon.service.in:4 contains Requires=clamav-daemon.socket; its install section also names that socket. The proposed memory/restart drop-in does not remove this dependency. Starting the service after masking the socket therefore fails. Debian’s packaging bug discussion explicitly identifies removing the dependency as part of this workaround. Fix: Specify a complete service override without the socket dependency and Also= entry. Stop the service and socket, mask the socket, reload systemd, then start clamd and verify both listeners.

1. P1 — §3.2, steps 1–2: The foreground FreshClam invocation conflicts with the package-started daemon. Debian’s debian/clamav-freshclam.postinst.in:333 starts clamav-freshclam during installation. The next prescribed step launches another instance using the same configuration and locked update log. That invocation can fail before initialization reaches the clamd configuration. Fix: Suppress package service starts during installation, or explicitly stop FreshClam before its foreground run. Keep clamd and its socket stopped during configuration; restart the updater after database initialization succeeds.

1. P2 — §3.2: Matching the size limits does not prevent incomplete scans being recorded as clean. MaxScanSize counts expanded archive content, and MaxFileSize also applies to contained files. A compressed object below 25 MiB can exceed either limit after extraction. With AlertExceedsMax defaulting to no, the proposed settings do not guarantee that this becomes a size-refusal response. See the trixie configuration manual. The client maps an OK response to clean at internal/clamd/clamd.go:273, which is then signed and tagged at internal/objstore/clamav.go:364. Fix: Define explicit handling for extraction-limit results and add an archive exceeding those limits to §7. AlertExceedsMax yes prevents silent success, but the current client classifies its FOUND response as infected; either document that policy or add a distinct skipped mapping.

1. P2 — §§3.1–3.2: The only administration path lacks an installed SSM agent. module.<host>.ami_id returns the base Debian image, not the configured console host: infra/modules/region-host/outputs.tf:26. Debian images do not include SSM Agent by default, according to AWS’s installation instructions. The proposed script installs only ClamAV packages. With SSH closed, the promised SSM checks and recovery path will be unavailable. Fix: Install and enable the arm64 SSM agent during bootstrap, and require successful Systems Manager registration before wiring the console.

Verdict: reject.