cloudcompliance 1.0.0__py3-none-any.whl

cloudcompliance/__init__.py

@@ -0,0 +1,7 @@
+"""
+CloudCompliance — SOC2 Evidence Report Generator
+Reads Terraform state and maps resources to SOC2 Trust Service Criteria
+"""
+
+__version__ = "1.0.0"
+__author__ = "Kadhiravan E.G."

cloudcompliance/report.py

@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""
+CloudCompliance — SOC2 Evidence Report Generator
+"""
+
+import json
+import sys
+from datetime import datetime
+from pathlib import Path
+from rich.console import Console
+from rich.table import Table
+from rich.panel import Panel
+from rich import box
+
+console = Console()
+
+SOC2_CONTROLS = {
+    "CC6.1": {
+        "title": "Logical Access — Network Isolation",
+        "description": "Restrict logical access via private networking and ACLs",
+        "resources": ["aws_vpc", "aws_subnet", "aws_default_security_group"],
+    },
+    "CC6.2": {
+        "title": "Logical Access — Authentication Controls",
+        "description": "Enforce strong authentication, password policy, least privilege",
+        "resources": ["aws_iam_account_password_policy", "aws_iam_role", "aws_iam_policy", "aws_sns_topic"],
+    },
+    "CC6.7": {
+        "title": "Encryption — Data Protection",
+        "description": "Encrypt data at rest and in transit using KMS and HTTPS",
+        "resources": ["aws_kms_key", "aws_kms_alias", "aws_s3_bucket_server_side_encryption_configuration", "aws_s3_bucket_policy"],
+    },
+    "CC7.1": {
+        "title": "Threat Detection — Continuous Monitoring",
+        "description": "Monitor for anomalous activity and compliance drift",
+        "resources": ["aws_cloudwatch_metric_alarm", "aws_config_configuration_recorder", "aws_config_config_rule"],
+    },
+    "CC7.2": {
+        "title": "Audit Logging — Tamper-evident Records",
+        "description": "Log all activity with integrity validation and retention",
+        "resources": ["aws_s3_bucket_versioning", "aws_s3_bucket_public_access_block", "aws_config_delivery_channel", "aws_flow_log", "aws_cloudwatch_log_group"],
+    },
+    "CC6.6": {
+        "title": "Logical Access — Transmission Protection",
+        "description": "Protect data in transit — HTTPS only, deny plaintext",
+        "resources": ["aws_s3_bucket_policy"],
+    },
+    "CC8.1": {
+        "title": "Change Management — IaC Controlled",
+        "description": "All infrastructure changes via version-controlled IaC",
+        "resources": ["aws_iam_role", "aws_config_configuration_recorder_status"],
+    },
+}
+
+
+def load_tfstate(path: str) -> dict:
+    tfstate_path = Path(path)
+    if not tfstate_path.exists():
+        console.print(f"[red]Error: tfstate not found at {path}[/red]")
+        sys.exit(1)
+    with open(tfstate_path) as f:
+        return json.load(f)
+
+
+def extract_resources(tfstate: dict) -> list:
+    resources = []
+    for resource in tfstate.get("resources", []):
+        resources.append({
+            "type": resource.get("type"),
+            "name": resource.get("name"),
+            "module": resource.get("module", "root"),
+            "tags": resource.get("instances", [{}])[0]
+                          .get("attributes", {})
+                          .get("tags", {}),
+        })
+    return resources
+
+
+def evaluate_controls(resources: list) -> dict:
+    found_types = set(r["type"] for r in resources)
+    results = {}
+    for control_id, control in SOC2_CONTROLS.items():
+        matched = [t for t in control["resources"] if t in found_types]
+        missing = [t for t in control["resources"] if t not in found_types]
+        if len(matched) == len(control["resources"]):
+            status = "PASS"
+        elif len(matched) > 0:
+            status = "PARTIAL"
+        else:
+            status = "FAIL"
+        results[control_id] = {
+            "title": control["title"],
+            "description": control["description"],
+            "status": status,
+            "matched": matched,
+            "missing": missing,
+        }
+    return results
+
+
+def print_report(results: dict, resources: list, output_path: Path = None):
+    console.print()
+    console.print(Panel.fit(
+        "[bold cyan]CloudCompliance — SOC2 Evidence Report[/bold cyan]\n"
+        f"[dim]Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}[/dim]\n"
+        f"[dim]Total resources provisioned: {len(resources)}[/dim]",
+        border_style="cyan"
+    ))
+    console.print()
+
+    table = Table(box=box.ROUNDED, show_header=True, header_style="bold magenta")
+    table.add_column("Control", style="cyan", width=8)
+    table.add_column("Title", width=35)
+    table.add_column("Status", width=10)
+    table.add_column("Matched Resources", width=40)
+
+    pass_count = 0
+    for control_id, result in results.items():
+        status = result["status"]
+        if status == "PASS":
+            status_str = "[green]✅ PASS[/green]"
+            pass_count += 1
+        elif status == "PARTIAL":
+            status_str = "[yellow]⚠️  PARTIAL[/yellow]"
+        else:
+            status_str = "[red]❌ FAIL[/red]"
+        matched_str = ", ".join(result["matched"]) if result["matched"] else "[dim]none[/dim]"
+        table.add_row(control_id, result["title"], status_str, matched_str)
+
+    console.print(table)
+    console.print()
+
+    score = int((pass_count / len(results)) * 100)
+    color = "green" if score >= 80 else "yellow" if score >= 50 else "red"
+    console.print(Panel.fit(
+        f"[bold {color}]SOC2 Compliance Score: {score}% ({pass_count}/{len(results)} controls passing)[/bold {color}]",
+        border_style=color
+    ))
+
+    output = {
+        "generated_at": datetime.now().isoformat(),
+        "total_resources": len(resources),
+        "compliance_score": score,
+        "controls": results,
+    }
+
+    if output_path is None:
+        output_path = Path(__file__).parent.parent / "compliance" / "compliance_report.json"
+
+    with open(output_path, "w") as f:
+        json.dump(output, f, indent=2)
+    console.print()
+    console.print(f"[dim]Evidence saved → {output_path}[/dim]")
+
+
+def run(tfstate_path: str = None, output_path: str = None):
+    if tfstate_path is None:
+        tfstate_path = Path(__file__).parent.parent / "terraform" / "terraform.tfstate"
+    console.print(f"[dim]Reading state from: {tfstate_path}[/dim]")
+    tfstate = load_tfstate(str(tfstate_path))
+    resources = extract_resources(tfstate)
+    results = evaluate_controls(resources)
+    print_report(results, resources, Path(output_path) if output_path else None)
+
+
+def main():
+    run()
+
+
+if __name__ == "__main__":
+    main()

cloudcompliance-1.0.0.dist-info/METADATA

@@ -0,0 +1,229 @@
+Metadata-Version: 2.4
+Name: cloudcompliance
+Version: 1.0.0
+Summary: SOC2 compliance evidence generator for Terraform AWS infrastructure
+Author-email: "Kadhiravan E.G." <kadhiravaneg@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/KADHIRAVANEG/terraform-aws-cloudcompliance
+Project-URL: Repository, https://github.com/KADHIRAVANEG/terraform-aws-cloudcompliance
+Keywords: soc2,compliance,terraform,aws,security,iac
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: rich>=12.0.0
+Dynamic: license-file
+
+[![Terraform Registry](https://img.shields.io/badge/Terraform%20Registry-cloudcompliance-7B42BC?logo=terraform)](https://registry.terraform.io/modules/KADHIRAVANEG/cloudcompliance/aws/latest)
+![SOC2 Compliance](https://github.com/KADHIRAVANEG/Cloud-Compliance/actions/workflows/compliance.yml/badge.svg)
+![Terraform](https://img.shields.io/badge/Terraform-1.15.6-7B42BC?logo=terraform)
+![LocalStack](https://img.shields.io/badge/LocalStack-3.4.0-000000?logo=amazon-aws)
+![Python](https://img.shields.io/badge/Python-3.11-3776AB?logo=python)
+![License](https://img.shields.io/badge/License-MIT-green)
+
+# CloudCompliance — SOC2-Ready AWS IaC
+
+> Infrastructure as Code that provisions a SOC2 Type II-aligned AWS environment
+> in one command. Zero manual security configuration required.
+
+## The Problem
+
+Startups spend 6–12 months retrofitting SOC2 controls onto infrastructure that
+was never designed to be compliant. Security is an afterthought — CloudTrail
+gets enabled after an incident, encryption gets added before an audit, RBAC
+gets tightened only when required.
+
+**This IaC eliminates that retrofit entirely.**
+Every SOC2 control is provisioned automatically at infrastructure creation time.
+
+---
+
+## SOC2 Control Coverage
+
+| Control | Title                             | Resources Enforced                                              |
+|---------|-----------------------------------|-----------------------------------------------------------------|
+| CC6.1   | Network Isolation                 | VPC, private subnets, deny-all security group                   |
+| CC6.2   | Authentication Controls           | IAM password policy, MFA alert, least-privilege role            |
+| CC6.6   | Transmission Protection           | HTTPS-only S3 bucket policy, TLS enforcement                    |
+| CC6.7   | Encryption at Rest                | KMS CMK, S3 server-side encryption, encrypted data bucket       |
+| CC7.1   | Threat Detection                  | CloudWatch alarms, AWS Config recorder, Config rules            |
+| CC7.2   | Audit Logging                     | Versioned audit bucket, delete protection, Config delivery      |
+| CC8.1   | Change Management                 | IaC-controlled infra, Config recorder status tracking           |
+
+
+> **Scope note:** This IaC implements the *technical infrastructure controls* 
+> mapped to SOC2 Common Criteria CC6-CC8. Full SOC2 Type II certification 
+> additionally requires organizational policies, vendor management, employee 
+> training, and 6-12 months of evidence collection — which are outside the 
+> scope of infrastructure code.
+
+---
+
+## What Gets Provisioned (29 resources)
+
+### Networking — CC6.1
+- Private VPC (`10.0.0.0/16`) with 2 private subnets
+- No public subnets — zero internet exposure by default
+- Default-deny security group — all inbound/outbound blocked
+
+### Logging — CC7.2
+- Dedicated audit S3 bucket with versioning enabled
+- Delete protection policy — no object or bucket deletion allowed
+- HTTPS-only access policy on audit bucket
+
+### Encryption — CC6.7
+- KMS Customer Managed Key (CMK) with automatic key rotation
+- S3 encrypted data bucket with KMS SSE
+- HTTPS-only bucket policy — plaintext requests denied
+
+### IAM — CC6.2
+- Account password policy: 14 chars, complexity, 90-day rotation, 24 history
+- Least-privilege IAM role — S3 read + KMS decrypt only
+- SNS topic for root account usage alerts
+
+### Monitoring — CC7.1
+- CloudWatch alarm: root account login detection
+- CloudWatch alarm: public S3 bucket detection
+- Both wired to SNS alert topic
+
+### Config — CC7.1 + CC7.2
+- AWS Config recorder — all resource types, all regions
+- Config delivery channel → audit S3 bucket
+- Config rules: S3 public read prohibited, S3 encryption required, root MFA
+
+---
+
+## Quick Start
+
+**Requirements:** Terraform ≥ 1.15, Docker
+
+```bash
+# 1. Start LocalStack (free local AWS)
+docker run --rm -d -p 4566:4566 localstack/localstack:3.4.0
+
+# 2. Deploy all SOC2 controls
+make deploy
+
+# 3. Generate compliance evidence report
+make report
+```
+## Use as a Terraform Module
+
+```hcl
+module "soc2_baseline" {
+  source  = "KADHIRAVANEG/cloudcompliance/aws"
+  version = "1.0.0"
+
+  project_name = "my-startup"
+  environment  = "prod"
+  aws_region   = "us-east-1"
+}
+```
+
+```bash
+terraform init
+terraform apply
+```
+
+
+**Expected output:**
+
+```
+╭────────────────────────────────────────╮
+│ CloudCompliance — SOC2 Evidence Report │
+│ Total resources provisioned: 29        │
+╰────────────────────────────────────────╯
+SOC2 Compliance Score: 100% (7/7 controls passing)
+```
+
+---
+
+## Project Structure
+
+```
+cloudcompliance/
+├── terraform/
+│   ├── main.tf                  # Root — calls all modules
+│   ├── variables.tf             # Environment, region, endpoint
+│   ├── backend.tf               # Local (dev) / S3 (prod) backend
+│   ├── local.tfvars             # LocalStack config
+│   ├── prod.tfvars              # Real AWS config
+│   └── modules/
+│       ├── networking/          # CC6.1 — VPC, subnets, SGs
+│       ├── logging/             # CC7.2 — Audit bucket
+│       ├── encryption/          # CC6.7 — KMS, encrypted S3
+│       ├── iam/                 # CC6.2 — Password policy, roles
+│       ├── monitoring/          # CC7.1 — CloudWatch alarms
+│       └── config/              # CC7.1/7.2 — Config rules
+├── compliance/
+│   └── report.py                # SOC2 evidence generator
+├── .github/workflows/
+│   └── compliance.yml           # CI gate — blocks non-compliant PRs
+└── Makefile                     # make deploy / report / destroy
+```
+
+---
+
+## CI/CD Compliance Gate
+
+Every pull request automatically:
+1. Validates Terraform formatting and syntax
+2. Deploys to LocalStack
+3. Runs the compliance report
+4. **Blocks merge if any SOC2 control is missing**
+
+---
+
+## Deploying to Real AWS
+
+```bash
+# 1. Configure AWS credentials
+aws configure
+
+# 2. Deploy to real AWS
+make deploy-prod
+```
+
+For production, uncomment the S3 backend in `terraform/backend.tf`
+to enable remote state with DynamoDB locking.
+
+---
+
+## LocalStack vs Real AWS
+
+| Feature              | LocalStack (free) | Real AWS |
+|----------------------|-------------------|----------|
+| VPC / Subnets        | ✅                | ✅       |
+| S3 + Encryption      | ✅                | ✅       |
+| KMS                  | ✅                | ✅       |
+| IAM                  | ✅                | ✅       |
+| CloudWatch           | ✅                | ✅       |
+| AWS Config           | ✅                | ✅       |
+| SNS                  | ✅                | ✅       |
+| CloudTrail           | ⚠️ Pro only       | ✅       |
+| GuardDuty            | ⚠️ Pro only       | ✅       |
+
+---
+
+## Standards Referenced
+
+- [AICPA SOC2 Trust Services Criteria 2017](https://www.aicpa.org/resources/landing/system-and-organization-controls-soc-suite-of-services)
+- [CIS AWS Foundations Benchmark v2.0](https://www.cisecurity.org/benchmark/amazon_web_services)
+- [NIST SP 800-53 Rev 5](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)
+- [AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html)
+
+---
+
+## Tech Stack
+
+`Terraform` · `Python` · `AWS` · `LocalStack` · `GitHub Actions` · `KMS` · `IAM` · `CloudWatch` · `SNS` · `AWS Config`
+
+---
+
+## Author
+
+**Kadhiravan E.G.** — 3rd year Cybersecurity student  
+GitHub: [@KADHIRAVANEG](https://github.com/KADHIRAVANEG)

cloudcompliance-1.0.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+cloudcompliance/__init__.py,sha256=y5jsn9qPJjblxDPIwEmRrR57G3fkdPts3nuABKKBjc8,185
+cloudcompliance/report.py,sha256=yGmKWiezkUAXoYUXFE3OLhLWpGzWCWiZJYCxQ7yW1jQ,6223
+cloudcompliance-1.0.0.dist-info/licenses/LICENSE,sha256=9BKBy3zyYEzXHSRmGV9dyi04D6iQtPmvVIcPJuBeXy0,1072
+cloudcompliance-1.0.0.dist-info/METADATA,sha256=kWAMXCgAGpetxPSIyIqrLCxGOZfL3x-Pvt5E3bc7DRY,8557
+cloudcompliance-1.0.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+cloudcompliance-1.0.0.dist-info/entry_points.txt,sha256=cVo9ou3kxyG2Wrq2AO6bt-ldlIjAXMygS6Y6UpBLuF0,64
+cloudcompliance-1.0.0.dist-info/top_level.txt,sha256=9n0nRDoST8ywe2OfHWO-pdrs_XC4xkyKJJa43LYLuOg,16
+cloudcompliance-1.0.0.dist-info/RECORD,,

cloudcompliance-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

cloudcompliance-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+cloudcompliance = cloudcompliance.report:main

cloudcompliance-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kadhiravan E.G.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

cloudcompliance-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+cloudcompliance