Brief, mostly signal

AWS SafeBox 0.1.0 blocks destructive infrastructure commands before they run

A local policy proxy that stops terraform destroy, kubectl delete and similar commands. Needs Python 3.11 or later on macOS or Linux.

Read the source at github.com Discussion

What the research found

AWS SafeBox 0.1.0 Community Edition is a local deterministic policy proxy that blocks destructive infrastructure commands (terraform destroy, kubectl delete, EC2/RDS terminate, recursive S3 rm, CloudFormation delete-stack) before they reach real executables. Requires Python 3.11+, macOS or Linux (POSIX proxy), and needs no AWS credentials to evaluate policy.

Claims and how well the evidence supports them

SafeBox 0.1.0 is the current Community Edition release 99%
The default policy blocks terraform destroy, kubectl delete, aws ec2 terminate-instances, aws rds delete-db-instance, recursive aws s3 rm, and aws cloudformation delete-stack 99%
SafeBox requires Python 3.11+ and runs on macOS or Linux 99%
SafeBox evaluates commands without requiring AWS credentials 98%

Evidence

github.com https://github.com/aws-safebox/aws-safebox
news.ycombinator.com https://news.ycombinator.com/item?id=50117268

Actionability rated medium.