Two guards that said yes to nothing

A security pass on the ops console found two guards that passed when they had nothing to check.

The first screened IAM policies an agent proposed. It asked whether every listed action was allowed. A statement written with NotAction lists no actions, and in Python every member of an empty list passes any test. The statement went through.

The second was the cost cap. A change estimated over 50 dollars needed more than a click. When the estimate failed, the failure counted as zero dollars, and zero is under the cap.

Both are fixed. Both had passing tests, because the tests checked that bad things were caught, not that missing things were.

Every assert in the project now carries a note on how it could pass wrongly.