cloudg 0.3.0__py3-none-any.whl

cloudg/rules/nist_800_53.yaml

@@ -0,0 +1,134 @@
+# ─────────────────────────────────────────────────────────────────
+# NIST 800-53 Rev 5 — Control Family Mappings
+# Source: NIST SP 800-53 Rev 5 (public domain, U.S. government)
+#
+# FALLBACK rulesets — used only for findings that arrive
+# without scanner-native compliance control IDs.
+# ─────────────────────────────────────────────────────────────────
+
+framework: NIST-800-53
+version: "Rev5"
+source: "NIST SP 800-53 Revision 5"
+
+controls:
+  # AC — Access Control
+  - id: "AC-2"
+    title: "Account Management"
+    patterns:
+      - "iam.*user"
+      - "account.*manage"
+      - "access.*control"
+      - "unused.*account"
+    severity: MEDIUM
+
+  - id: "AC-3"
+    title: "Access Enforcement"
+    patterns:
+      - "permission"
+      - "authorization"
+      - "access.*denied"
+    severity: HIGH
+
+  - id: "AC-6"
+    title: "Least Privilege"
+    patterns:
+      - "wildcard"
+      - "admin.*access"
+      - "overly.*permissive"
+      - "Action.*\\*"
+      - "Resource.*\\*"
+    severity: HIGH
+
+  # AU — Audit and Accountability
+  - id: "AU-2"
+    title: "Event Logging"
+    patterns:
+      - "logging"
+      - "cloudtrail"
+      - "audit.*trail"
+      - "flow.*log"
+    severity: MEDIUM
+
+  - id: "AU-6"
+    title: "Audit Record Review, Analysis, and Reporting"
+    patterns:
+      - "log.*review"
+      - "monitor"
+      - "alarm"
+    severity: MEDIUM
+
+  # CM — Configuration Management
+  - id: "CM-6"
+    title: "Configuration Settings"
+    patterns:
+      - "default.*config"
+      - "misconfigur"
+      - "hardening"
+    severity: MEDIUM
+
+  # IA — Identification and Authentication
+  - id: "IA-2"
+    title: "Identification and Authentication"
+    patterns:
+      - "mfa"
+      - "multi.factor"
+      - "authentication"
+      - "password.*policy"
+    severity: HIGH
+
+  - id: "IA-5"
+    title: "Authenticator Management"
+    patterns:
+      - "key.*rotat"
+      - "credential.*rotat"
+      - "password.*expir"
+    severity: MEDIUM
+
+  # SC — System and Communications Protection
+  - id: "SC-7"
+    title: "Boundary Protection"
+    patterns:
+      - "security.*group"
+      - "firewall"
+      - "network.*acl"
+      - "nacl"
+      - "internet.*exposed"
+      - "0\\.0\\.0\\.0"
+    severity: HIGH
+
+  - id: "SC-8"
+    title: "Transmission Confidentiality and Integrity"
+    patterns:
+      - "ssl"
+      - "tls"
+      - "https"
+      - "transit.*encrypt"
+    severity: MEDIUM
+
+  - id: "SC-28"
+    title: "Protection of Information at Rest"
+    patterns:
+      - "encrypt.*rest"
+      - "encrypt.*enabl"
+      - "storage.*encrypt"
+      - "kms"
+    severity: HIGH
+
+  # SI — System and Information Integrity
+  - id: "SI-2"
+    title: "Flaw Remediation"
+    patterns:
+      - "vulnerability"
+      - "cve"
+      - "patch"
+      - "update.*required"
+    severity: HIGH
+
+  - id: "SI-4"
+    title: "System Monitoring"
+    patterns:
+      - "guardduty"
+      - "security.*hub"
+      - "intrusion"
+      - "detect"
+    severity: MEDIUM

cloudg/rules/pci_dss_v4.yaml

@@ -0,0 +1,108 @@
+# ─────────────────────────────────────────────────────────────────
+# PCI DSS v4.0 — Requirement Mappings
+# Source: PCI Security Standards Council, PCI DSS v4.0 (public summary
+# of requirements; the full standard is published by the PCI SSC)
+#
+# Fallback mappings for findings that arrive without scanner-native
+# compliance control IDs.
+# ─────────────────────────────────────────────────────────────────
+
+framework: PCI-DSS
+version: "4.0"
+source: "PCI DSS v4.0"
+
+controls:
+  - id: "PCI-1.2"
+    title: "Network security controls (NSCs) are configured and maintained"
+    patterns:
+      - "security.*group"
+      - "firewall"
+      - "network.*acl"
+      - "nsg"
+    severity: HIGH
+
+  - id: "PCI-1.3"
+    title: "Network access to and from the cardholder data environment is restricted"
+    patterns:
+      - "0\\.0\\.0\\.0"
+      - "internet.*exposed"
+      - "publicly.*accessible"
+      - "open.*to.*the.*world"
+    severity: CRITICAL
+
+  - id: "PCI-2.2"
+    title: "System components are configured and managed securely"
+    patterns:
+      - "default.*config"
+      - "default.*password"
+      - "hardening"
+      - "misconfigur"
+    severity: MEDIUM
+
+  - id: "PCI-3.5"
+    title: "Primary account number (PAN) is secured wherever it is stored"
+    patterns:
+      - "encrypt.*rest"
+      - "storage.*encrypt"
+      - "unencrypted"
+    severity: HIGH
+
+  - id: "PCI-4.2"
+    title: "PAN is protected with strong cryptography during transmission"
+    patterns:
+      - "tls"
+      - "ssl"
+      - "https"
+      - "transit.*encrypt"
+      - "secure.*transfer"
+    severity: HIGH
+
+  - id: "PCI-7.2"
+    title: "Access to system components and data is appropriately defined and assigned"
+    patterns:
+      - "least.*privilege"
+      - "overly.*permissive"
+      - "wildcard"
+      - "admin.*access"
+    severity: HIGH
+
+  - id: "PCI-8.3"
+    title: "Strong authentication for users and administrators is established and managed"
+    patterns:
+      - "mfa"
+      - "multi.factor"
+      - "password.*policy"
+    severity: HIGH
+
+  - id: "PCI-8.6"
+    title: "Use of application and system accounts and associated authentication factors is strictly managed"
+    patterns:
+      - "access.*key.*rotat"
+      - "credential.*rotat"
+      - "stale.*credential"
+    severity: MEDIUM
+
+  - id: "PCI-10.2"
+    title: "Audit logs are implemented to support the detection of anomalies"
+    patterns:
+      - "logging"
+      - "cloudtrail"
+      - "audit.*log"
+      - "flow.*log"
+    severity: MEDIUM
+
+  - id: "PCI-10.4"
+    title: "Audit logs are reviewed to identify anomalies or suspicious activity"
+    patterns:
+      - "monitor"
+      - "alarm"
+      - "alert"
+    severity: MEDIUM
+
+  - id: "PCI-11.3"
+    title: "External and internal vulnerabilities are regularly identified and addressed"
+    patterns:
+      - "vulnerability"
+      - "cve"
+      - "patch"
+    severity: HIGH

cloudg/rules/soc2_tsc.yaml

@@ -0,0 +1,93 @@
+# ─────────────────────────────────────────────────────────────────
+# SOC 2 — Trust Services Criteria (2017, revised 2022) Mappings
+# Source: AICPA Trust Services Criteria (Common Criteria series)
+#
+# Fallback mappings for findings that arrive without scanner-native
+# compliance control IDs.
+# ─────────────────────────────────────────────────────────────────
+
+framework: SOC2
+version: "2017 (2022 revision)"
+source: "AICPA Trust Services Criteria"
+
+controls:
+  - id: "SOC2-CC6.1"
+    title: "Logical access security software, infrastructure, and architectures are implemented"
+    patterns:
+      - "access.*control"
+      - "authorization"
+      - "iam.*polic"
+      - "least.*privilege"
+    severity: HIGH
+
+  - id: "SOC2-CC6.2"
+    title: "New internal and external users are registered and authorized before access is granted"
+    patterns:
+      - "unused.*account"
+      - "stale.*user"
+      - "account.*manage"
+    severity: MEDIUM
+
+  - id: "SOC2-CC6.3"
+    title: "Access to data and software is removed or modified when no longer required"
+    patterns:
+      - "access.*key.*rotat"
+      - "credential.*rotat"
+      - "inactive.*credential"
+    severity: MEDIUM
+
+  - id: "SOC2-CC6.6"
+    title: "Logical access security measures protect against threats from outside system boundaries"
+    patterns:
+      - "internet.*exposed"
+      - "publicly.*accessible"
+      - "0\\.0\\.0\\.0"
+      - "firewall"
+      - "security.*group"
+    severity: CRITICAL
+
+  - id: "SOC2-CC6.7"
+    title: "Transmission, movement, and removal of information is restricted and protected"
+    patterns:
+      - "encrypt"
+      - "tls"
+      - "ssl"
+      - "https"
+    severity: HIGH
+
+  - id: "SOC2-CC6.8"
+    title: "Controls prevent or detect the introduction of unauthorized or malicious software"
+    patterns:
+      - "vulnerability"
+      - "cve"
+      - "malware"
+      - "patch"
+    severity: HIGH
+
+  - id: "SOC2-CC7.1"
+    title: "Vulnerabilities are identified and monitored through detection and monitoring procedures"
+    patterns:
+      - "scan"
+      - "detect"
+      - "guardduty"
+      - "security.*hub"
+    severity: MEDIUM
+
+  - id: "SOC2-CC7.2"
+    title: "System components are monitored for anomalies indicative of malicious acts or errors"
+    patterns:
+      - "monitor"
+      - "logging"
+      - "audit"
+      - "alarm"
+      - "cloudtrail"
+    severity: MEDIUM
+
+  - id: "SOC2-A1.2"
+    title: "Environmental protections, backup, and recovery infrastructure are maintained"
+    patterns:
+      - "backup"
+      - "snapshot"
+      - "multi.?az"
+      - "replication"
+    severity: MEDIUM

cloudg/scanners/__init__.py

@@ -0,0 +1 @@
+"""Security scanners package."""

cloudg/scanners/checkov.py

@@ -0,0 +1,174 @@
+"""Checkov IaC static analysis scanner wrapper."""
+
+from __future__ import annotations
+
+import json
+import logging
+import shutil
+import subprocess
+from typing import Any
+
+from cloudg.schema.models import Finding, Severity
+
+logger = logging.getLogger(__name__)
+
+_SEVERITY_MAP = {
+    "CRITICAL": Severity.CRITICAL,
+    "HIGH": Severity.HIGH,
+    "MEDIUM": Severity.MEDIUM,
+    "LOW": Severity.LOW,
+    "INFO": Severity.INFO,
+    "UNKNOWN": Severity.MEDIUM,
+}
+
+
+class CheckovScanner:
+    """Wraps Checkov CLI to scan IaC directories for misconfigurations.
+
+    Supports Terraform, CloudFormation, ARM templates, Kubernetes manifests.
+    """
+
+    def __init__(
+        self,
+        target_dir: str = ".",
+        frameworks: list[str] | None = None,
+        extra_args: list[str] | None = None,
+    ) -> None:
+        self._target_dir = target_dir
+        self._frameworks = frameworks or []
+        self._extra_args = extra_args or []
+
+    @staticmethod
+    def is_available() -> bool:
+        """Check if Checkov is installed."""
+        return shutil.which("checkov") is not None
+
+    def run(self) -> list[Finding]:
+        """Execute Checkov scan and return normalised findings.
+
+        If no frameworks are configured, Checkov auto-detects all applicable
+        frameworks (terraform, cloudformation, arm, kubernetes, etc.) in the
+        target directory — which is the correct behaviour for cloud
+        infrastructure scanning.
+        """
+        if not self.is_available():
+            logger.warning(
+                "Checkov is not installed. Install with: pip install checkov. "
+                "Skipping Checkov scan."
+            )
+            return []
+
+        cmd = [
+            "checkov",
+            "-d",
+            self._target_dir,
+            "--output",
+            "json",
+            "--quiet",
+        ]
+
+        # Pass all frameworks in one shot; omit flag entirely for auto-detect
+        if self._frameworks:
+            cmd.extend(["--framework", *self._frameworks])
+
+        cmd.extend(self._extra_args)
+
+        logger.info("Running Checkov: %s", " ".join(cmd))
+
+        try:
+            result = subprocess.run(
+                cmd,
+                capture_output=True,
+                text=True,
+                timeout=1800,
+                check=False,  # Checkov returns non-zero on failures found
+            )
+        except subprocess.TimeoutExpired:
+            logger.error("Checkov scan timed out")
+            return []
+        except Exception as exc:
+            logger.error("Failed to run Checkov: %s", exc)
+            return []
+
+        return self._parse_output(result.stdout)
+
+    def _parse_output(self, stdout: str) -> list[Finding]:
+        """Parse Checkov JSON output from stdout."""
+        findings: list[Finding] = []
+
+        if not stdout.strip():
+            logger.warning("Checkov produced no output")
+            return []
+
+        try:
+            data = json.loads(stdout)
+        except json.JSONDecodeError as exc:
+            logger.warning("Failed to parse Checkov JSON output: %s", exc)
+            return []
+
+        # Checkov output can be a list (multiple frameworks) or single dict
+        if isinstance(data, list):
+            for framework_result in data:
+                findings.extend(self._parse_framework_result(framework_result))
+        elif isinstance(data, dict):
+            findings.extend(self._parse_framework_result(data))
+
+        logger.info("Parsed %d findings from Checkov", len(findings))
+        return findings
+
+    def _parse_framework_result(self, data: dict[str, Any]) -> list[Finding]:
+        """Parse a single framework result block."""
+        findings: list[Finding] = []
+
+        check_type = data.get("check_type", "unknown")
+        failed_checks = data.get("results", {}).get("failed_checks", [])
+
+        for check in failed_checks:
+            severity_str = check.get("severity", "MEDIUM")
+            if isinstance(severity_str, str):
+                severity = _SEVERITY_MAP.get(severity_str.upper(), Severity.MEDIUM)
+            else:
+                severity = Severity.MEDIUM
+
+            resource = check.get("resource", "")
+            file_path = check.get("file_path", "")
+            file_line_range = check.get("file_line_range", [])
+
+            evidence = f"File: {file_path}"
+            if file_line_range:
+                evidence += f", Lines: {file_line_range}"
+
+            guideline = check.get("guideline", "")
+            check_id = check.get("check_id", "")
+
+            findings.append(
+                Finding(
+                    resource_id=resource,
+                    resource_arn=resource,
+                    severity=severity,
+                    title=f"[Checkov/{check_type}] {check.get('check_name', check_id)}",
+                    description=check.get("check_name", ""),
+                    evidence=evidence,
+                    remediation=guideline if guideline else f"See Checkov check {check_id}",
+                    source_tool="checkov",
+                    source_finding_id=check_id,
+                    compliance_frameworks=self._map_compliance(check_id),
+                )
+            )
+
+        return findings
+
+    def _map_compliance(self, check_id: str) -> list[str]:
+        """Map Checkov check ID to compliance frameworks."""
+        # Checkov checks often map to CIS/NIST
+        frameworks = []
+        check_lower = check_id.lower()
+        if "cis" in check_lower:
+            frameworks.append("CIS")
+        if "nist" in check_lower:
+            frameworks.append("NIST-800-53")
+        if "pci" in check_lower:
+            frameworks.append("PCI-DSS")
+        if not frameworks:
+            frameworks.append("CIS")  # Default for IaC misconfigs
+        return frameworks