SECURITY_NOTICE.md

SECURITY NOTICE: Credential Regeneration Required

⚠️ CRITICAL: Exposed Credentials

The following credentials have been exposed in the repository and MUST be regenerated immediately:

AWS Credentials (EXPOSED)

• Access Key ID: <AWS_ACCESS_KEY_ID>
• Secret Access Key: <AWS_SECRET_ACCESS_KEY>

Actions Required:

1. Go to AWS IAM Console: https://console.aws.amazon.com/iam/
2. Navigate to Users → Your User → Security Credentials
3. Delete the exposed access key
4. Create a new access key pair
5. Update the .env file with new credentials
6. NEVER commit the .env file to the repository

GitHub Token (EXPOSED)

• Token: <GITHUB_TOKEN>

Actions Required:

1. Go to GitHub Settings: https://github.com/settings/tokens
2. Find and revoke the exposed token
3. Generate a new Personal Access Token with required permissions:
   • repo (full control of private repositories)
   • workflow (update GitHub Action workflows)
4. Update the .env file with the new token

Best Practices for Secrets Management

DO NOT:

• ❌ Commit .env files to version control
• ❌ Hardcode credentials in source code
• ❌ Share credentials via insecure channels
• ❌ Use the same credentials across environments

DO:

• ✅ Add .env to .gitignore (already done)
• ✅ Use AWS Secrets Manager or Parameter Store for production
• ✅ Use environment variables in CI/CD pipelines
• ✅ Rotate credentials regularly (every 90 days)
• ✅ Use IAM roles with least-privilege permissions
• ✅ Enable MFA on AWS accounts

Environment File Template

After regenerating credentials, your .env should look like:

# AWS Configuration
AWS_REGION=ap-south-1
AWS_ACCESS_KEY_ID=<NEW_ACCESS_KEY>
AWS_SECRET_ACCESS_KEY=<NEW_SECRET_KEY>

# Amazon Bedrock
BEDROCK_MODEL_ID=meta.llama3-8b-instruct-v1:0
BEDROCK_MAX_TOKENS=4096

# Amazon S3
S3_BUCKET_NAME=regradar-documents
S3_BUCKET_REGION=ap-south-1

# Amazon OpenSearch
OPENSEARCH_ENDPOINT=https://search-regradar-search-luufdwy33xqoj7ogl52wxv2l6m.ap-south-1.es.amazonaws.com
OPENSEARCH_INDEX_REGULATIONS=regulations
OPENSEARCH_INDEX_VIOLATIONS=violations
OPENSEARCH_INDEX_INFRASTRUCTURE=infrastructure

# GitHub Integration
GITHUB_TOKEN=<NEW_GITHUB_TOKEN>
GITHUB_OWNER=shashankmp2004
GITHUB_REPO=regRadar-infra-test
GITHUB_DEFAULT_BRANCH=main

# API Configuration
API_HOST=0.0.0.0
API_PORT=8000
API_DEBUG=false
API_SECRET_KEY=<GENERATE_SECURE_KEY>

# Feature Flags
ENABLE_AUTO_REMEDIATION=false
ENABLE_GITHUB_PR_CREATION=true
REQUIRE_HUMAN_APPROVAL=true

# Logging
LOG_LEVEL=INFO
LOG_FORMAT=json

Generate Secure API Secret Key

import secrets
print(secrets.token_urlsafe(32))

AWS IAM Policy for RegRadar

Minimum required permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::regradar-documents",
                "arn:aws:s3:::regradar-documents/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:ListFoundationModels"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "es:ESHttpGet",
                "es:ESHttpPut",
                "es:ESHttpPost",
                "es:ESHttpDelete"
            ],
            "Resource": "arn:aws:es:ap-south-1:*:domain/regradar-search/*"
        }
    ]
}

Contact

If you believe these credentials have been misused, contact the security team immediately.

---

Document Generated: 2024 Status: ACTION REQUIRED