fix(cloud-tests): harden aws validation paths

[tofikwest]

Summary

• keep IAM MFA scans running when GetLoginProfile fails with an unexpected/non-NoSuchEntity error
• validate RevokeSecurityGroupIngressCommand differently for rule-ID-only revokes vs property-based revokes
• add regression coverage for both Cubic findings

Verification

• bunx jest src/cloud-security/aws-command-executor.spec.ts src/cloud-security/providers/aws/iam.adapter.spec.ts --passWithNoTests
• bunx prettier --check apps/api/src/cloud-security/aws-command-executor.ts apps/api/src/cloud-security/aws-command-executor.spec.ts apps/api/src/cloud-security/providers/aws/iam.adapter.ts apps/api/src/cloud-security/providers/aws/iam.adapter.spec.ts
• git diff --check

Notes

• bunx turbo run typecheck --filter=@trycompai/api currently fails on existing baseline errors outside this patch, including AI SDK LanguageModelV3 vs LanguageModelV2 assignments and unrelated spec signature drift.

---

Summary by cubic

Hardened AWS validation and IAM MFA scanning to prevent false negatives and keep scans running. Correctly validates RevokeSecurityGroupIngressCommand inputs and continues MFA checks when console-access probes fail unexpectedly.

• Bug Fixes
  • RevokeSecurityGroupIngressCommand: Require GroupId or GroupName only for property-based revokes; allow rule-ID-only revokes without a group. SecurityGroupRuleIds no longer satisfy the group requirement when rule properties are present. Updated error messages.
  • IAM: When GetLoginProfile throws non-NoSuchEntity errors (e.g., AccessDeniedException), continue MFA checks and treat console access as present to avoid suppressing findings.
  • S3 CreateBucket: Safer bucket name normalization (coerce string/number, lower-case, replace underscores).
  • Tests: Added coverage for both SG revoke validation paths and the console-probe error flow.

^{Written for commit 5a79bcb. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	May 22, 2026 12:33am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		May 22, 2026 12:33am
portal	Skipped		May 22, 2026 12:33am

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[claudfuen]

🎉 This PR is included in version 3.62.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀