[ExcelDsigN-tech]

Overview

Clears the two report-only Security Gates findings left after #901: the cargo-audit advisory RUSTSEC-2026-0387 and Trivy AWS-0095 on the ALB alarms SNS topic.

Closes #902
Closes #903

Feature Summary

• contracts/.cargo/audit.toml baselines RUSTSEC-2026-0387 with reason and review date
• aws_sns_topic.alb_alarms encrypted with a customer-managed KMS key (rotation on)

Technical Implementation

• RUSTSEC-2026-0387 (crypto-bigint 0.5.5) has no upstream fix: the latest soroban-env-host (30.0.0) still depends on elliptic-curve ^0.13. It is host-side only; cargo tree -e normal --target wasm32-unknown-unknown -i crypto-bigint is empty, so it is not in the deployed wasm. Entry is ignored with a review-by date of 2027-02-01 and is removed once soroban-env-host moves to elliptic-curve 0.14. The 6 remaining warnings (unmaintained/unsound/yanked) do not fail cargo audit.
• infra/waf-and-alarms.tf: new aws_kms_key.alb_alarms with enable_key_rotation = true and a key policy granting the account admin plus cloudwatch.amazonaws.com kms:Decrypt and kms:GenerateDataKey*. The AWS-managed alias/aws/sns key is not used because CloudWatch alarms cannot publish to a topic encrypted with it. Topic sets kms_master_key_id.
• Deploy note: applying this creates one KMS key per environment and re-encrypts the topic in place; no topic replacement.

Test Coverage

• cargo audit in contracts/: exit 1 without the baseline, exit 0 with it
• Trivy 0.69.3 config --severity HIGH,CRITICAL on infra/: AWS-0095 reported before, no findings after
• terraform fmt -check passes. terraform validate not run: infra/ is a partial module (references aws_lb.main and var.environment defined elsewhere)

Checklists

Issue Definition of Done

• RUSTSEC-2026-0387 baselined in contracts/.cargo/audit.toml with a documented reason and review date
• Warnings from the soroban-sdk tree reviewed and either fixed or baselined (informational, no upstream fix)
• cargo audit passes in contracts/
• ./scripts/ci-local.sh contracts passes (left to CI; no Rust source or Cargo.lock change)
• aws_sns_topic.alb_alarms encrypted with a customer-managed KMS key with rotation enabled
• Key policy lets CloudWatch publish to the topic
• Trivy filesystem scan reports no AWS-0095 finding

General

• Ran ./scripts/ci-local.sh <area> and it passes (no area covers infra/; cargo audit and Trivy run directly instead)
• Tests added or updated for the change (config only)
• No skipped tests, removed assertions or raised limits
• Docs updated if behaviour changed (no behaviour change)
• Conventional Commits title and messages
• Security-sensitive change: .github/THREAT_MODEL.md attached and maintainer review requested

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 77df7e18-6265-4fcb-bc85-b29eea5ea6b4

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn