Boston fork: security hardening, upstream-portal protection, AWS hosting docs

[brendanbabb]

Summary

Three logical changes, committed separately so they can be reviewed
independently:

1. Infra — move to us-west-2, add reserved Lambda concurrency as a hard
   cap on fan-out into the upstream CKAN portal, pin Lambda packaging to
   cp311/manylinux wheels so the ZIP imports correctly regardless of the
   build host's Python version, and extract the S3 backend config so the
   deployer's AWS account ID does not live in the public repo.
2. Security — rewrite the SQL validator and the aggregate_data SQL
   builder to be allowlist-only and AST-aware, so that caller-supplied
   strings cannot escape into the generated query; cap HTTP request bodies
   at 64 KB with a 413 response before JSON parsing.
3. Docs — docs/AWS_DEPLOYMENT.md and docs/SECURITY.md describe
   the above for future operators and for anyone forking this to run
   against another open-data portal. A Python stdio_bridge.py and a
   CLAUDE.md for repo guidance come along for the ride.

Why

The top design constraint is not overwhelming the upstream open-data
portal. data.boston.gov is a shared civic resource, and an MCP server
in front of it can easily become its noisiest client — one Claude
conversation can translate into dozens of SQL queries, each hitting CKAN's
DataStore. Four overlapping layers protect the portal:

• Reserved Lambda concurrency (default 10) — even if a client bypasses
  the API Gateway rate limit via the Lambda Function URL, they cannot drive
  more than 10 parallel upstream queries.
• API Gateway rate limit (5 rps sustained / 10 burst) and daily
  quota (3000 requests/day per API key).
• Enforced LIMIT on execute_sql — SQLValidator.enforce_row_limit
  appends LIMIT 10000 to any validated SQL lacking a top-level LIMIT.
• Clamped LIMIT on aggregate_data — SafeSQLBuilder.clamp_limit
  enforces MAX_LIMIT = 10000.

The SQL surface was also tightened against injection and DoS-via-expensive-
query regardless of portal load:

• Comments are stripped before scanning (defeats /* */ obfuscation).
• Forbidden keyword list expanded (PREPARE, COPY, LISTEN,
  NOTIFY, VACUUM, ANALYZE, CLUSTER, REINDEX, LOAD,
  DO).
• New forbidden-function list (xp_cmdshell, pg_sleep, pg_read_file,
  pg_ls_dir, pg_stat_file, lo_import, lo_export,
  current_setting, set_config, dblink).
• FROM/JOIN targets are AST-validated — must be a UUID-quoted
  resource or a CTE alias; schema-qualified targets like
  pg_catalog.pg_class are rejected.
• aggregate_data path no longer builds SQL by string concatenation —
  every identifier, metric expression, filter value, and LIMIT goes through
  SafeSQLBuilder allowlist validation.

Privacy posture

Stateless: no database, no accounts, no sessions. CloudWatch logs retain
request_id, method/path, duration, status, and truncated SQL (500 chars)
for 14 days. All data returned is public open data from data.boston.gov.
See docs/SECURITY.md §4 for the full rationale.

Test plan

• CI green on the PR (ruff, pip-audit, pytest, Go tests)
• ./scripts/deploy.sh --environment staging produces a cp311 ZIP
  that cold-starts without 502
• terraform plan in terraform/aws/ shows
  reserved_concurrent_executions = 10 as the only Lambda diff
  for an already-deployed stack
• Manual smoke: oversized body returns 413; DROP TABLE rejected;
  comment-obfuscated DROP rejected; schema-qualified FROM rejected
• SELECT * FROM "<uuid>" without an explicit LIMIT is automatically
  clamped to 10000 rows

🤖 Generated with Claude Code