Please report a vulnerability privately through GitHub's security advisories, not in a public issue. You'll get a reply within a week.

What the module can do in your account, by design:

• The functions can start and stop EC2 instances, and move Auto Scaling groups' instances in and out of Standby and change the groups' capacity, only where the resource carries <tag_prefix>:managed = true (aws:ResourceTag conditions).
• The evaluator can run only the module's probe document, and only on instances with that tag. The probe reads connection counts, who, nvidia-smi and process names; it changes nothing on the box.
• The functions describe instances, groups and SSM agents account-wide in their region, read CloudWatch metrics, write only their own DynamoDB table, and publish only to the module's topic.
• The Slack channel's role and guardrail allow invoking the control function and reading CloudWatch, nothing else. The control function accepts five commands with strictly validated arguments.
• Notices contain box names, instance IDs, Slack member IDs and times; never data from the box.

What to know and protect:

• Tags opt a box in. Anyone who can call ec2:CreateTags or autoscaling:CreateOrUpdateTags can put a resource under the module, and so let any member of the Slack channel stop it, and the module stop it when idle. Either set allowed_ids to the instance IDs and group names the module may manage, or deny the tag keys outside a trusted role with an SCP:

  {
    "Effect": "Deny",
    "Action": ["ec2:CreateTags", "ec2:DeleteTags", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteTags"],
    "Resource": "*",
    "Condition": {
      "ForAnyValue:StringLike": { "aws:TagKeys": ["devbox:*"] },
      "ArnNotLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/platform-admin" }
    }
  }

  Also deny tagging at launch (ec2:RunInstances with the same condition) if your users can launch instances.

• Every channel member can act on every managed box. Amazon Q doesn't pass the Slack user to the function, and members can choose their own IAM role, so per-person rules can't be enforced. Keep the channel to people who may stop each other's boxes.

• The audit trail is Amazon Q's. The module sets the channel's logging level to INFO, so Amazon Q logs each command with the Slack user who ran it to CloudWatch Logs, and CloudTrail records the Lambda invocation by the channel role. The module's own logs record each command and its result.

• The DynamoDB table holds the configuration the functions act on (including allowed_ids). Write access to it can opt boxes in or out; keep it to the module and your administrators.