aquasec 0.1.1__tar.gz

aquasec-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Andrea Zorzetto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

aquasec-0.1.1/MANIFEST.in

@@ -0,0 +1,3 @@
+include README.md
+include LICENSE
+recursive-include aquasec *.py

aquasec-0.1.1/PKG-INFO

@@ -0,0 +1,174 @@
+Metadata-Version: 2.4
+Name: aquasec
+Version: 0.1.1
+Summary: API client library for Aqua Security platform
+Home-page: https://github.com/andreazorzetto/aquasec
+Author: Andrea Zorzetto
+Author-email: your-email@example.com
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.28.0
+Requires-Dist: prettytable>=3.5.0
+Requires-Dist: cryptography>=41.0.0
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+# Aqua Library
+
+A Python library providing a clean API interface for interacting with Aqua Security platform.
+
+## Overview
+
+The `aqua-lib` library is extracted from the andreactl tool to provide reusable components for building Aqua Security utilities. It includes modules for authentication, API calls, and configuration management.
+
+## Installation
+
+```bash
+pip install aqua-lib
+```
+
+## Features
+
+- **Authentication**: Support for API keys and username/password authentication
+- **Configuration Management**: Secure credential storage with profile support
+- **API Modules**: Organized by domain (licenses, enforcers, repositories, etc.)
+- **Utilities**: Common functions for data export and processing
+
+## Quick Start
+
+```python
+from aqua import authenticate, get_licences, interactive_setup
+
+# Setup credentials interactively
+interactive_setup()
+
+# Or use environment variables
+import os
+os.environ['AQUA_KEY'] = 'your-api-key'
+os.environ['AQUA_SECRET'] = 'your-api-secret'
+os.environ['CSP_ENDPOINT'] = 'https://xyz.cloud.aquasec.com'
+
+# Authenticate
+token = authenticate()
+
+# Get license information
+licenses = get_licences(os.environ['CSP_ENDPOINT'], token)
+print(licenses)
+```
+
+## Library Structure
+
+```
+aqua/
+├── __init__.py          # Main exports
+├── auth.py             # Authentication functions
+├── config.py           # Configuration management
+├── licenses.py         # License-related API calls
+├── scopes.py          # Application scope functions
+├── enforcers.py       # Enforcer-related functions
+├── repositories.py    # Repository API calls
+└── common.py          # Utility functions
+```
+
+## Configuration Management
+
+The library includes a configuration management system that stores credentials securely:
+
+```python
+from aqua import ConfigManager, load_profile_credentials
+
+# Create configuration manager
+config_mgr = ConfigManager()
+
+# Save a profile
+config = {
+    'auth_method': 'api_keys',
+    'api_endpoint': 'https://api.cloudsploit.com',
+    'csp_endpoint': 'https://xyz.cloud.aquasec.com',
+    'api_role': 'Administrator',
+    'api_methods': 'ANY'
+}
+creds = {
+    'api_key': 'your-key',
+    'api_secret': 'your-secret'
+}
+config_mgr.save_config('production', config)
+config_mgr.encrypt_credentials(creds)
+
+# Load profile
+load_profile_credentials('production')
+```
+
+## API Examples
+
+### License Management
+
+```python
+from aqua import get_licences, get_app_scopes, get_repo_count_by_scope
+
+# Get license info
+licenses = get_licences(server, token)
+
+# Get application scopes
+scopes = get_app_scopes(server, token)
+
+# Get repository count by scope
+repo_counts = get_repo_count_by_scope(server, token, [s['name'] for s in scopes])
+```
+
+### Enforcer Management
+
+```python
+from aqua import get_enforcer_count, get_enforcer_groups
+
+# Get enforcer count
+count = get_enforcer_count(server, token)
+
+# Get enforcer groups
+groups = get_enforcer_groups(server, token)
+```
+
+## Building Custom Utilities
+
+The library makes it easy to create focused utilities:
+
+```python
+#!/usr/bin/env python3
+import json
+from aqua import authenticate, load_profile_credentials, get_licences
+
+# Load saved credentials
+load_profile_credentials('default')
+
+# Authenticate
+token = authenticate()
+
+# Get data
+licenses = get_licences(os.environ['CSP_ENDPOINT'], token)
+
+# Output as JSON
+print(json.dumps(licenses, indent=2))
+```
+
+## Contributing
+
+Issues and pull requests are welcome at [github.com/andreazorzetto/aqua-lib](https://github.com/andreazorzetto/aqua-lib)
+
+## License
+
+MIT License

aquasec-0.1.1/README.md

@@ -0,0 +1,144 @@
+# Aqua Library
+
+A Python library providing a clean API interface for interacting with Aqua Security platform.
+
+## Overview
+
+The `aqua-lib` library is extracted from the andreactl tool to provide reusable components for building Aqua Security utilities. It includes modules for authentication, API calls, and configuration management.
+
+## Installation
+
+```bash
+pip install aqua-lib
+```
+
+## Features
+
+- **Authentication**: Support for API keys and username/password authentication
+- **Configuration Management**: Secure credential storage with profile support
+- **API Modules**: Organized by domain (licenses, enforcers, repositories, etc.)
+- **Utilities**: Common functions for data export and processing
+
+## Quick Start
+
+```python
+from aqua import authenticate, get_licences, interactive_setup
+
+# Setup credentials interactively
+interactive_setup()
+
+# Or use environment variables
+import os
+os.environ['AQUA_KEY'] = 'your-api-key'
+os.environ['AQUA_SECRET'] = 'your-api-secret'
+os.environ['CSP_ENDPOINT'] = 'https://xyz.cloud.aquasec.com'
+
+# Authenticate
+token = authenticate()
+
+# Get license information
+licenses = get_licences(os.environ['CSP_ENDPOINT'], token)
+print(licenses)
+```
+
+## Library Structure
+
+```
+aqua/
+├── __init__.py          # Main exports
+├── auth.py             # Authentication functions
+├── config.py           # Configuration management
+├── licenses.py         # License-related API calls
+├── scopes.py          # Application scope functions
+├── enforcers.py       # Enforcer-related functions
+├── repositories.py    # Repository API calls
+└── common.py          # Utility functions
+```
+
+## Configuration Management
+
+The library includes a configuration management system that stores credentials securely:
+
+```python
+from aqua import ConfigManager, load_profile_credentials
+
+# Create configuration manager
+config_mgr = ConfigManager()
+
+# Save a profile
+config = {
+    'auth_method': 'api_keys',
+    'api_endpoint': 'https://api.cloudsploit.com',
+    'csp_endpoint': 'https://xyz.cloud.aquasec.com',
+    'api_role': 'Administrator',
+    'api_methods': 'ANY'
+}
+creds = {
+    'api_key': 'your-key',
+    'api_secret': 'your-secret'
+}
+config_mgr.save_config('production', config)
+config_mgr.encrypt_credentials(creds)
+
+# Load profile
+load_profile_credentials('production')
+```
+
+## API Examples
+
+### License Management
+
+```python
+from aqua import get_licences, get_app_scopes, get_repo_count_by_scope
+
+# Get license info
+licenses = get_licences(server, token)
+
+# Get application scopes
+scopes = get_app_scopes(server, token)
+
+# Get repository count by scope
+repo_counts = get_repo_count_by_scope(server, token, [s['name'] for s in scopes])
+```
+
+### Enforcer Management
+
+```python
+from aqua import get_enforcer_count, get_enforcer_groups
+
+# Get enforcer count
+count = get_enforcer_count(server, token)
+
+# Get enforcer groups
+groups = get_enforcer_groups(server, token)
+```
+
+## Building Custom Utilities
+
+The library makes it easy to create focused utilities:
+
+```python
+#!/usr/bin/env python3
+import json
+from aqua import authenticate, load_profile_credentials, get_licences
+
+# Load saved credentials
+load_profile_credentials('default')
+
+# Authenticate
+token = authenticate()
+
+# Get data
+licenses = get_licences(os.environ['CSP_ENDPOINT'], token)
+
+# Output as JSON
+print(json.dumps(licenses, indent=2))
+```
+
+## Contributing
+
+Issues and pull requests are welcome at [github.com/andreazorzetto/aqua-lib](https://github.com/andreazorzetto/aqua-lib)
+
+## License
+
+MIT License

aquasec-0.1.1/aquasec/__init__.py

@@ -0,0 +1,97 @@
+"""
+Andrea Library - API client library for Aqua Security platform
+
+This library provides a clean API interface for interacting with Aqua Security's
+platform, extracted from the andreactl tool.
+"""
+
+__version__ = "0.1.0"
+
+from .auth import (
+    authenticate,
+    api_auth,
+    user_pass_saas_auth,
+    user_pass_onprem_auth,
+    extract_token_from_auth
+)
+
+from .licenses import (
+    api_get_licenses,
+    api_get_dta_license,
+    api_post_dta_license_utilization,
+    get_licences,
+    get_repo_count_by_scope,
+    get_enforcer_count_by_scope
+)
+
+from .scopes import (
+    api_get_scopes,
+    get_app_scopes
+)
+
+from .enforcers import (
+    api_get_enforcer_groups,
+    get_enforcers_from_group,
+    get_enforcer_groups,
+    get_enforcer_count
+)
+
+from .repositories import (
+    api_get_repositories
+)
+
+from .common import (
+    write_content_to_file,
+    write_json_to_file,
+    generate_csv_for_license_breakdown
+)
+
+from .config import (
+    ConfigManager,
+    load_profile_credentials,
+    test_connection,
+    interactive_setup,
+    list_profiles
+)
+
+__all__ = [
+    # Auth
+    'authenticate',
+    'api_auth',
+    'user_pass_saas_auth',
+    'user_pass_onprem_auth',
+    'extract_token_from_auth',
+    
+    # Licenses
+    'api_get_licenses',
+    'api_get_dta_license',
+    'api_post_dta_license_utilization',
+    'get_licences',
+    'get_repo_count_by_scope',
+    'get_enforcer_count_by_scope',
+    
+    # Scopes
+    'api_get_scopes',
+    'get_app_scopes',
+    
+    # Enforcers
+    'api_get_enforcer_groups',
+    'get_enforcers_from_group',
+    'get_enforcer_groups',
+    'get_enforcer_count',
+    
+    # Repositories
+    'api_get_repositories',
+    
+    # Common utilities
+    'write_content_to_file',
+    'write_json_to_file',
+    'generate_csv_for_license_breakdown',
+    
+    # Configuration management
+    'ConfigManager',
+    'load_profile_credentials',
+    'test_connection',
+    'interactive_setup',
+    'list_profiles'
+]

aquasec-0.1.1/aquasec/auth.py

@@ -0,0 +1,175 @@
+"""
+Authentication module for Andrea library
+Handles authentication with Aqua Security platform
+"""
+
+import hashlib
+import hmac
+import json
+import requests
+import sys
+import time
+from os import environ
+
+
+def authenticate(verbose=False):
+    """
+    Main authentication function that detects auth method and returns token
+    """
+    api_key = environ.get('AQUA_KEY')
+    api_secret = environ.get('AQUA_SECRET')
+    api_role = environ.get('AQUA_ROLE')
+    user = environ.get('AQUA_USER')
+    password = environ.get('AQUA_PASSWORD')
+    api_endpoint = environ.get('AQUA_ENDPOINT')
+    csp_endpoint = environ.get('CSP_ENDPOINT')
+    api_methods = environ.get('AQUA_METHODS')
+
+    # API Keys SaaS auth
+    if api_key and api_secret and api_endpoint and csp_endpoint and api_role and api_methods:
+        # get methods list
+        methods_list = api_methods.split(',')
+        methods_json = json.dumps(methods_list)
+
+        if verbose:
+            print("Auth method: API Keys SaaS")
+
+        token = api_auth(api_key, api_secret, api_endpoint, api_role, methods_json, verbose)
+
+    # user/pass SaaS auth
+    elif user and password and api_endpoint:
+        if verbose:
+            print("Auth method: User/Pass SaaS")
+        token = user_pass_saas_auth(user, password, api_endpoint)
+
+    # user/pass on-prem auth
+    elif user and password and csp_endpoint and not api_endpoint:
+        if verbose:
+            print("Auth method: User/Pass on-prem")
+        token = user_pass_onprem_auth(user, password, csp_endpoint)
+
+    # trying to authenticate with user and password
+    else:
+        print("""\nMissing credentials, cannot proceed. 
+
+Refer to the docs for info about SaaS API keys auth:
+https://docs.aquasec.com/saas/api-reference/getting-started-with-aqua-platform-apis/api-authentication
+
+Example run command:
+> docker run --env-file aqua-saas-prod.env -ti andreazorzetto/andreactl command
+
+Example creds file:
+----------------------------------------
+# Required for SaaS API Keys Auth
+AQUA_KEY=xxxxxxxxxxxxxxxxxx
+AQUA_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxx
+AQUA_ROLE=api_admin_role
+AQUA_METHODS=ANY
+AQUA_ENDPOINT='https://eu-1.api.cloudsploit.com'
+
+# Required for User/Pass Auth
+#AQUA_USER=email@address.com
+#AQUA_PASSWORD='password'
+
+# Required for both Auth methods
+CSP_ENDPOINT='https://xxxxxxxxxx.cloud.aquasec.com'
+----------------------------------------
+
+AUTHENTICATION CANCELLED
+""")
+        sys.exit(1)
+
+    return token
+
+
+def api_auth(api_key, api_secret, api_endpoint, api_role, api_methods, verbose=False):
+    """
+    Authenticate using API keys (SaaS)
+    """
+    timestamp = str(int(time.time()))
+    api_url = api_endpoint + "/v2/tokens"
+
+    # Define the body of the POST request
+    post_body_str = str(
+        '{"validity":240,"allowed_endpoints":' + api_methods + ',"csp_roles":["' + api_role + '"]}').replace(" ", "")
+    if verbose:
+        print("post_body_string: %s" % post_body_str)
+
+    # Create the string to sign
+    string_to_sign = timestamp + "POST" + "/v2/tokens" + post_body_str
+
+    # Create HMAC signature
+    signature = hmac.new(api_secret.encode(), string_to_sign.encode(), hashlib.sha256).hexdigest()
+
+    # Issue the signed request to get authentication token
+    headers = {
+        "Content-Type": "application/json",
+        "X-API-Key": api_key,
+        "X-Timestamp": timestamp,
+        "X-Signature": signature
+    }
+
+    response = requests.post(api_url, headers=headers, data=post_body_str)
+
+    # Extract status and token from the response
+    if response.status_code == 200:
+        token = response.json()['data']
+    else:
+        print("Authentication failed.", response.text)
+        sys.exit(1)
+
+    return token
+
+
+def user_pass_saas_auth(user, passwd, api_endpoint):
+    """
+    Authenticate using username/password (SaaS)
+    """
+    # Set schema for saas auth
+    auth_info = {"email": user, "password": passwd}
+
+    # Do authentication
+    api_url = api_endpoint + "/v2/signin"
+    res = requests.post(url=api_url, json=auth_info, verify=False)
+
+    # One of the authentications above succeeded
+    if res.status_code == 200:
+        token = res.json()["data"]["token"]
+    else:
+        print("Authentication failed", res.status_code)
+        sys.exit(1)
+
+    return token
+
+
+def user_pass_onprem_auth(user, passwd, csp_endpoint):
+    """
+    Authenticate using username/password (on-prem)
+    """
+    # Set schema for on-prem auth
+    auth_info = {"id": user, "password": passwd}
+
+    # Do authentication
+    api_url = csp_endpoint + "/api/v1/login"
+    res = requests.post(url=api_url, json=auth_info, verify=False)
+
+    # One of the authentications above succeeded
+    if res.status_code == 200:
+        token = res.json()["token"]
+
+    # Nothing worked. Exit.
+    else:
+        print("Authentication failed", res.status_code)
+        sys.exit(1)
+
+    return token
+
+
+def extract_token_from_auth(res, is_account_saas):
+    """
+    Extract token from authentication response
+    """
+    if is_account_saas:
+        return res.json()["data"]["token"]
+    else:
+        return res.json()["token"]

aquasec-0.1.1/aquasec/common.py

@@ -0,0 +1,47 @@
+"""
+Common utility functions for Andrea library
+"""
+
+import csv
+import json
+from os.path import exists
+
+
+def write_content_to_file(file, content):
+    """Write content to file"""
+    with open(file, 'w') as f:
+        f.write(content)
+
+
+def write_json_to_file(file, content):
+    """Write JSON content to file, appending if exists"""
+    if exists(file):
+        with open(file, "a") as file:
+            json.dump(content, file)
+            file.write('\n')
+    else:
+        with open(file, "w") as file:
+            json.dump(content, file)
+            file.write('\n')
+
+
+def generate_csv_for_license_breakdown(license_breakdown, filename):
+    """Generate CSV file for license breakdown data"""
+    columns = ['scope', 'repos', 'aqua_enforcer', 'kube_enforcer', 'vm_enforcer', 'micro_enforcer', 'nano_enforcer', 'pod_enforcer']
+
+    with open(filename, mode='w', newline='') as file:
+        writer = csv.DictWriter(file, fieldnames=columns)
+        writer.writeheader()
+
+        for key, value in license_breakdown.items():
+            row = {
+                'scope': value['scope name'],
+                'repos': value['repos'],
+                'aqua_enforcer': value['agent']['connected'],
+                'kube_enforcer': value['kube_enforcer']['connected'],
+                'vm_enforcer': value['host_enforcer']['connected'],
+                'micro_enforcer': value['micro_enforcer']['connected'],
+                'nano_enforcer': value['nano_enforcer']['connected'],
+                'pod_enforcer': value['pod_enforcer']['connected']
+            }
+            writer.writerow(row)