# AWS-ADMIN Account & Superuser Audit Report

**Date**: December 20, 2025  
**Scope**: Complete audit of aws-admin account, superuser permissions, and special configurations  
**Environment**: Production IGNY8 Platform

---

## Executive Summary

The **aws-admin** account is a special system account with elevated privileges designed for platform administration, development, and system-level operations. This audit documents all special permissions, configurations, and security controls associated with this account.

### Current Status
- **Account Name**: AWS Admin
- **Account Slug**: `aws-admin`
- **Status**: Active
- **Plan**: Internal (System/Superuser) - unlimited resources
- **Credits**: 333
- **Users**: 1 user (developer role, superuser)
- **Created**: Via management command `create_aws_admin_tenant.py`

---

## 1. Backend Configuration

### 1.1 Account Model Special Permissions

**File**: `backend/igny8_core/auth/models.py`

**System Account Detection** (Line 155-158):
```python
def is_system_account(self):
    """Check if this account is a system account with highest access level."""
    return self.slug in ['aws-admin', 'default-account', 'default']
```

**Special Behaviors**:
- ✅ **Cannot be deleted** - Soft delete is blocked with `PermissionDenied`
- ✅ **Unlimited access** - Bypasses all filtering restrictions
- ✅ **Multi-tenant access** - Can view/edit data across all accounts

**Account Slug Variants Recognized**:
1. `aws-admin` (primary)
2. `default-account` (legacy)
3. `default` (legacy)

---

### 1.2 User Model Special Permissions

**File**: `backend/igny8_core/auth/models.py`

**System Account User Detection** (Line 738-743):
```python
def is_system_account_user(self):
    """Check if user belongs to a system account with highest access level."""
    try:
        return self.account and self.account.is_system_account()
    except (AttributeError, Exception):
        return False
```

**Developer Role Detection** (Line 730-732):
```python
def is_developer(self):
    """Check if user is a developer/super admin with full access."""
    return self.role == 'developer' or self.is_superuser
```

**Site Access Override** (Line 747-755):
```python
def get_accessible_sites(self):
    """Get all sites the user can access."""
    if self.role in ['owner', 'admin', 'developer'] or self.is_superuser or self.is_system_account_user():
        return base_sites  # ALL sites in account
    # Other users need explicit SiteUserAccess grants
```

---

### 1.3 Admin Panel Permissions

**File**: `backend/igny8_core/admin/base.py`

**QuerySet Filtering Bypass** (8 instances, Lines 18, 31, 43, 55, 72, 83, 93, 103):
```python
if request.user.is_superuser or (hasattr(request.user, 'is_developer') and request.user.is_developer()):
    return qs  # No filtering - see all data
```

**Special Privileges**:
- ✅ View all objects across all accounts
- ✅ Edit all objects across all accounts
- ✅ Delete all objects across all accounts
- ✅ Access all admin models without filtering

---

### 1.4 API Permissions

**File**: `backend/igny8_core/api/permissions.py`

#### HasTenantAccess Permission
**Bypass Conditions** (Lines 54-68):
1. `is_superuser == True` → ALLOWED
2. `role == 'developer'` → ALLOWED
3. `is_system_account_user() == True` → ALLOWED

#### IsSystemAccountOrDeveloper Permission
**File**: `backend/igny8_core/api/permissions.py` (Lines 190-208)
```python
class IsSystemAccountOrDeveloper(permissions.BasePermission):
    """
    Allow only system accounts (aws-admin/default-account/default) or developer role.
    Use for sensitive, globally-scoped settings like integration API keys.
    """
    def has_permission(self, request, view):
        account_slug = getattr(getattr(user, "account", None), "slug", None)
        if user.role == "developer":
            return True
        if account_slug in ["aws-admin", "default-account", "default"]:
            return True
        return False
```

**Usage**: Protects sensitive endpoints like:
- Global integration settings
- System-wide API keys
- Platform configuration

#### Permission Bypasses Summary
| Permission Class | Bypass for Superuser | Bypass for Developer | Bypass for aws-admin |
|-----------------|---------------------|---------------------|---------------------|
| HasTenantAccess | ✅ Yes | ✅ Yes | ✅ Yes |
| IsViewerOrAbove | ✅ Yes | ✅ Yes | ✅ Yes (via developer) |
| IsEditorOrAbove | ✅ Yes | ✅ Yes | ✅ Yes (via developer) |
| IsAdminOrOwner | ✅ Yes | ✅ Yes | ✅ Yes (via developer) |
| IsSystemAccountOrDeveloper | ✅ Yes | ✅ Yes | ✅ Yes (explicit) |

---

### 1.5 Rate Limiting & Throttling

**File**: `backend/igny8_core/api/throttles.py`

**Current Status**: **DISABLED - All rate limiting bypassed**

**Throttle Bypass Logic** (Lines 22-39):
```python
def allow_request(self, request, view):
    """
    Check if request should be throttled.
    DISABLED - Always allow all requests.
    """
    return True  # ALWAYS ALLOWED
    
    # OLD CODE (DISABLED):
    # if request.user.is_superuser: return True
    # if request.user.role == 'developer': return True
    # if request.user.is_system_account_user(): return True
```

**Security Note**: Rate limiting is currently disabled for ALL users, not just aws-admin.

---

### 1.6 AI Settings & API Keys

**File**: `backend/igny8_core/ai/settings.py`

**Fallback to System Account** (Lines 53-65):
```python
# Fallback to system account (aws-admin, default-account, or default)
if not settings_obj:
    from igny8_core.auth.models import Account
    IntegrationSettings = apps.get_model('system', 'IntegrationSettings')
    
    for slug in ['aws-admin', 'default-account', 'default']:
        system_account = Account.objects.filter(slug=slug).first()
        if system_account:
            settings_obj = IntegrationSettings.objects.filter(account=system_account).first()
            if settings_obj:
                break
```

**Special Behavior**:
- If an account doesn't have integration settings, **aws-admin's settings are used as fallback**
- This allows system-wide default API keys (OpenAI, DALL-E, etc.)

---

### 1.7 Middleware Bypass

**File**: `backend/igny8_core/auth/middleware.py`

**Account Injection Bypass** (Lines 146-157):
```python
if getattr(user, 'is_superuser', False):
    # Superuser - no filtering
    return None

# Developer or system account user - no filtering
if hasattr(user, 'is_system_account_user') and user.is_system_account_user():
    return None
```

**Effect**: Request-level account filtering disabled for aws-admin users.

---

### 1.8 Management Command

**File**: `backend/igny8_core/auth/management/commands/create_aws_admin_tenant.py`

**Purpose**: Creates or updates aws-admin account with unlimited resources

**What It Does**:
1. Creates/gets Enterprise plan with unlimited limits (999999 for all resources)
2. Creates/gets `aws-admin` account linked to Enterprise plan
3. Moves all superuser and developer role users to aws-admin account
4. Sets 999999 credits for the account

**Usage**:
```bash
python manage.py create_aws_admin_tenant
```

**Plan Limits** (Lines 26-40):
- max_users: 999,999
- max_sites: 999,999
- max_keywords: 999,999
- max_clusters: 999,999
- monthly_word_count_limit: 999,999,999
- daily_content_tasks: 999,999
- daily_ai_requests: 999,999
- monthly_ai_credit_limit: 999,999
- included_credits: 999,999
- All features enabled: `['ai_writer', 'image_gen', 'auto_publish', 'custom_prompts', 'unlimited']`

---

## 2. Frontend Configuration

### 2.1 Admin Menu Access

**File**: `frontend/src/layout/AppSidebar.tsx`

**Access Control** (Lines 46-52):
```tsx
const isAwsAdminAccount = Boolean(
  user?.account?.slug === 'aws-admin' ||
  user?.account?.slug === 'default-account' ||
  user?.account?.slug === 'default' ||
  user?.role === 'developer'
);
```

**Admin Section Display** (Lines 258-355):
- **System Dashboard** - `/admin/dashboard`
- **Account Management** - All accounts, subscriptions, limits
- **Billing Administration** - Invoices, payments, credit configs
- **User Administration** - All users, roles, activity logs
- **System Configuration** - System settings, AI settings, module settings
- **Monitoring** - System health, API monitor, debug status
- **Developer Tools** - Function testing, system testing
- **UI Elements** - Complete UI component library (22 pages)

**Total Admin Menu Items**: 50+ pages accessible only to aws-admin users

---

### 2.2 Route Protection

**File**: `frontend/src/components/auth/AdminGuard.tsx`

**Guard Logic** (Lines 12-18):
```tsx
export default function AdminGuard({ children }: AdminGuardProps) {
  const { user } = useAuthStore();
  const role = user?.role;
  const accountSlug = user?.account?.slug;
  const isSystemAccount = accountSlug === 'aws-admin' || accountSlug === 'default-account' || accountSlug === 'default';
  const allowed = role === 'developer' || isSystemAccount;

  if (!allowed) {
    return <Navigate to="/" replace />;  // Redirect to home
  }
  return <>{children}</>;
}
```

**Protected Routes**: All `/admin/*` routes wrapped with AdminGuard

---

### 2.3 API Status Indicator

**File**: `frontend/src/components/sidebar/ApiStatusIndicator.tsx`

**Visibility Control** (Lines 130-131):
```tsx
// Only show and run for aws-admin accounts
const isAwsAdmin = user?.account?.slug === 'aws-admin';
```

**Special Feature**: 
- Real-time API health monitoring component
- Checks 100+ API endpoints across all modules
- Only visible/functional for aws-admin users
- Displays endpoint status (healthy/warning/error)

---

### 2.4 Debug Tools Access

**File**: `frontend/src/components/debug/ResourceDebugOverlay.tsx`

**Access Control** (Line 46):
```tsx
const isAdminOrDeveloper = user?.role === 'admin' || user?.role === 'developer';
```

**Debug Features Available**:
- Resource debugging overlay
- Network request inspection
- State inspection
- Performance monitoring

---

### 2.5 Protected Route Privileges

**File**: `frontend/src/components/auth/ProtectedRoute.tsx`

**Privileged Access** (Line 127):
```tsx
const isPrivileged = user?.role === 'developer' || user?.is_superuser;
```

**Special Behaviors**:
- Access to all routes regardless of module enable settings
- Bypass certain validation checks
- Access to system-level features

---

### 2.6 API Request Handling

**File**: `frontend/src/services/api.ts`

**Comment Blocks** (Lines 640-641, 788-789, 1011-1012, 1169-1170):
```typescript
// Always add site_id if there's an active site (even for admin/developer)
// The backend will respect it appropriately - admin/developer can still see all sites
```

**Behavior**:
- Frontend still sends `site_id` parameter
- Backend ignores it for aws-admin users (shows all data)
- This maintains consistent API interface while allowing privileged access

---

## 3. Security Analysis

### 3.1 Current User Details

**Retrieved from Database**:
```
Username: developer
Email: [from database]
Role: developer
Superuser: True
Account: AWS Admin (aws-admin)
Account Status: active
Account Credits: 333
```

---

### 3.2 Permission Matrix

| Operation | Regular User | Admin Role | Developer Role | Superuser | aws-admin User |
|-----------|-------------|------------|----------------|-----------|----------------|
| **View own account data** | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes |
| **View other accounts** | ❌ No | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes |
| **Edit other accounts** | ❌ No | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes |
| **Delete accounts** | ❌ No | ❌ No | ⚠️ Limited | ✅ Yes | ✅ Yes (except self) |
| **Access Django admin** | ❌ No | ⚠️ Limited | ✅ Full | ✅ Full | ✅ Full |
| **Access admin dashboard** | ❌ No | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes |
| **View all users** | ❌ No | ⚠️ Own account | ✅ All | ✅ All | ✅ All |
| **Manage billing (all accounts)** | ❌ No | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes |
| **System settings** | ❌ No | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes |
| **API monitoring** | ❌ No | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes |
| **Debug tools** | ❌ No | ⚠️ Limited | ✅ Full | ✅ Full | ✅ Full |
| **Rate limiting** | ✅ Applied* | ✅ Applied* | ✅ Bypassed* | ✅ Bypassed* | ✅ Bypassed* |
| **Credit deduction** | ✅ Yes | ✅ Yes | ⚠️ Check needed | ⚠️ Check needed | ⚠️ Check needed |
| **AI API fallback** | ❌ No | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes (system default) |

*Currently all rate limiting is disabled globally

---

### 3.3 Security Strengths

#### ✅ Good Practices
1. **Multiple authentication layers** - Role, superuser, and account slug checks
2. **Explicit permission classes** - `IsSystemAccountOrDeveloper` for sensitive endpoints
3. **Frontend route guards** - AdminGuard prevents unauthorized access
4. **Account isolation** - Regular users strictly isolated to their account
5. **Cannot delete system account** - Protected from accidental deletion
6. **Audit trail** - Django admin logs all actions
7. **Middleware protection** - Request-level filtering for non-privileged users

---

### 3.4 Security Concerns & Recommendations

#### ⚠️ Areas for Improvement

**1. Rate Limiting Disabled** (HIGH PRIORITY)
- **Issue**: All rate limiting bypassed globally, not just for aws-admin
- **Risk**: API abuse, DoS attacks, resource exhaustion
- **Recommendation**: Re-enable rate limiting with proper exemptions for aws-admin
```python
# Recommended fix in throttles.py
def allow_request(self, request, view):
    # Bypass for system accounts only
    if request.user and request.user.is_authenticated:
        if getattr(request.user, 'is_superuser', False):
            return True
        if hasattr(request.user, 'role') and request.user.role == 'developer':
            return True
        if hasattr(request.user, 'is_system_account_user') and request.user.is_system_account_user():
            return True
    
    # Apply normal throttling for all other users
    return super().allow_request(request, view)
```

**2. AI API Key Fallback** (MEDIUM PRIORITY)
- **Issue**: All accounts fall back to aws-admin's API keys if not configured
- **Risk**: Unexpected costs, quota exhaustion, key exposure
- **Recommendation**: 
  - Add explicit opt-in for fallback behavior
  - Alert when fallback keys are used
  - Track usage per account even with fallback keys

**3. Credit Deduction Unclear** (MEDIUM PRIORITY)
- **Issue**: Not clear if aws-admin users are charged credits for operations
- **Risk**: Potential cost tracking issues
- **Recommendation**: 
  - Audit credit deduction logic for system accounts
  - Document whether aws-admin is exempt from credit charges
  - If exempt, ensure credit balance never depletes

**4. Multiple System Account Slugs** (LOW PRIORITY)
- **Issue**: Three different slugs recognized (`aws-admin`, `default-account`, `default`)
- **Risk**: Confusion, inconsistent behavior
- **Recommendation**: Standardize on `aws-admin` only, deprecate others

**5. is_superuser Flag** (LOW PRIORITY)
- **Issue**: Both `is_superuser` flag and `developer` role grant same privileges
- **Risk**: Redundant permission checks, potential bypass
- **Recommendation**: Use one permission model (recommend role-based)

**6. UI Elements in Production** (INFORMATIONAL)
- **Issue**: 22 UI element demo pages accessible in admin menu
- **Risk**: Potential information disclosure
- **Recommendation**: Move to separate route or remove from production

---

### 3.5 Access Log Review Recommendations

**Recommended Monitoring**:
1. **Admin Actions** - Review `django_admin_log` table regularly
2. **API Access** - Log all requests from aws-admin users
3. **Failed Permissions** - Alert on permission denied for system account
4. **Multi-Account Data Access** - Log when aws-admin views other accounts' data
5. **System Settings Changes** - Require approval/notification for critical changes

**Suggested Audit Queries**:
```sql
-- All actions by aws-admin users (last 30 days)
SELECT * FROM django_admin_log 
WHERE user_id IN (SELECT id FROM igny8_core_auth_user WHERE account_id = (SELECT id FROM igny8_core_auth_account WHERE slug='aws-admin'))
AND action_time > NOW() - INTERVAL '30 days'
ORDER BY action_time DESC;

-- All accounts accessed by developers
SELECT DISTINCT object_repr, content_type_id, action_flag
FROM django_admin_log 
WHERE user_id IN (SELECT id FROM igny8_core_auth_user WHERE role='developer' OR is_superuser=true)
AND content_type_id = (SELECT id FROM django_content_type WHERE app_label='igny8_core_auth' AND model='account');
```

---

## 4. Compliance & Best Practices

### 4.1 Principle of Least Privilege
- ⚠️ **Current**: aws-admin has unlimited access to everything
- ✅ **Recommendation**: Consider creating sub-roles:
  - **system-admin**: Account/user management only
  - **billing-admin**: Billing and payments only
  - **platform-admin**: System settings only
  - **developer**: Full access (current state)

### 4.2 Separation of Duties
- ⚠️ **Current**: Single developer user has all permissions
- ✅ **Recommendation**: 
  - Create separate accounts for different admin tasks
  - Require MFA for aws-admin users
  - Log all sensitive operations with approval workflow

### 4.3 Data Protection
- ✅ **Good**: Account deletion protection for system account
- ✅ **Good**: Soft delete implementation preserves audit trail
- ⚠️ **Improvement**: Add data export restrictions for sensitive PII

---

## 5. Recommendations Summary

### Immediate Actions (Within 1 Week)
1. ✅ **Re-enable rate limiting** with proper system account exemptions
2. ✅ **Audit credit deduction** logic for aws-admin account
3. ✅ **Document** which operations are logged and where

### Short-term Actions (Within 1 Month)
1. ⚠️ **Review AI API key fallback** behavior and add tracking
2. ⚠️ **Standardize** system account slug to aws-admin only
3. ⚠️ **Implement** MFA requirement for aws-admin users
4. ⚠️ **Add alerts** for sensitive operations (account deletion, plan changes, etc.)

### Long-term Actions (Within 3 Months)
1. 📋 **Create sub-admin roles** with limited scope
2. 📋 **Implement approval workflow** for critical system changes
3. 📋 **Add audit dashboard** showing aws-admin activity
4. 📋 **Security review** of all permission bypass points
5. 📋 **Penetration testing** focused on privilege escalation

---

## 6. Conclusion

The **aws-admin** account is properly configured with extensive privileges necessary for platform administration. The implementation follows a clear pattern of permission checks across backend and frontend.

**Key Strengths**:
- Multi-layered permission checks
- System account protection from deletion
- Clear separation between system and tenant data
- Comprehensive admin interface

**Key Risks**:
- Global rate limiting disabled
- AI API key fallback may cause unexpected costs
- Multiple system account slugs create confusion
- No sub-admin roles for separation of duties

**Overall Security Posture**: **MODERATE**
- System account is properly protected and identified
- Permissions are consistently enforced
- Some security controls (rate limiting) need re-enabling
- Monitoring and audit trails need enhancement

---

## Appendix A: Code Locations Reference

### Backend Permission Checks
- `auth/models.py` - Lines 155-158, 738-743, 730-732, 747-755
- `admin/base.py` - Lines 18, 31, 43, 55, 72, 83, 93, 103
- `api/permissions.py` - Lines 54-68, 190-208
- `api/throttles.py` - Lines 22-39
- `api/base.py` - Lines 25, 34, 259
- `auth/middleware.py` - Lines 146, 155
- `ai/settings.py` - Lines 53-65

### Frontend Access Controls
- `layout/AppSidebar.tsx` - Lines 46-52, 258-355
- `components/auth/AdminGuard.tsx` - Lines 12-18
- `components/auth/ProtectedRoute.tsx` - Line 127
- `components/sidebar/ApiStatusIndicator.tsx` - Lines 130-131
- `components/debug/*` - Line 46
- `services/api.ts` - Multiple locations (640, 788, 1011, 1169)

### Management Commands
- `auth/management/commands/create_aws_admin_tenant.py` - Full file

---

**Report Generated**: December 20, 2025  
**Generated By**: Security Audit Process  
**Classification**: Internal Use Only  
**Next Review Date**: March 20, 2026

---

*End of Audit Report*