cloudg 0.3.0__tar.gz → 0.3.2__tar.gz

{cloudg-0.3.0 → cloudg-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudg
-Version: 0.3.0
+Version: 0.3.2
 Summary: cloudg (cloud graphing) — multi-cloud infrastructure mapping, knowledge graphs and security intelligence for AWS, Azure and GCP
 Project-URL: Homepage, https://github.com/morpheuslord/cloudg
 Project-URL: Repository, https://github.com/morpheuslord/cloudg
@@ -75,7 +75,7 @@ Description-Content-Type: text/markdown
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.11%2B-blue.svg" alt="Python 3.11+">
-  <img src="https://img.shields.io/badge/version-0.3.0-4c1.svg" alt="Version 0.3.0">
+  <img src="https://img.shields.io/badge/version-0.3.1-4c1.svg" alt="Version 0.3.1">
   <a href="https://github.com/astral-sh/uv"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json" alt="uv"></a>
 </p>
 
@@ -194,7 +194,7 @@ Collection runs all providers concurrently with asyncio, iterating accounts and
 
 The same inventory feeds three other exports. The ontology module infers about 62 typed relations (`exposed_to_internet`, `assumes_role`, `encrypted_by`, `hosted_in_vpc` and so on) and writes RDF you can query with SPARQL. The RAG exporter chunks the graph three ways (per asset, per Louvain community, per relation domain) into JSONL for retrieval pipelines. The Terraform exporter maps 25+ asset types to `.tf.json` resources with an `import.sh` to adopt them into state.
 
-Scanner findings are deduplicated by resource and title, rescored against CVSS, and mapped to compliance controls.
+Scanner findings are deduplicated in two passes — within a scanner by (scanner, check ID, resource), and across scanners only when both the normalised title and the underlying check semantics (`rules/check_equivalence.yaml`) match — then rescored against CVSS and mapped to compliance controls.
 
 ---
 
@@ -325,6 +325,3 @@ Python 3.11 or newer. The moto/aiobotocore incompatibility around async response
 
 ---
 
-## License
-
-MIT

{cloudg-0.3.0 → cloudg-0.3.2}/README.md

@@ -5,7 +5,7 @@
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.11%2B-blue.svg" alt="Python 3.11+">
-  <img src="https://img.shields.io/badge/version-0.3.0-4c1.svg" alt="Version 0.3.0">
+  <img src="https://img.shields.io/badge/version-0.3.1-4c1.svg" alt="Version 0.3.1">
   <a href="https://github.com/astral-sh/uv"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json" alt="uv"></a>
 </p>
 
@@ -124,7 +124,7 @@ Collection runs all providers concurrently with asyncio, iterating accounts and
 
 The same inventory feeds three other exports. The ontology module infers about 62 typed relations (`exposed_to_internet`, `assumes_role`, `encrypted_by`, `hosted_in_vpc` and so on) and writes RDF you can query with SPARQL. The RAG exporter chunks the graph three ways (per asset, per Louvain community, per relation domain) into JSONL for retrieval pipelines. The Terraform exporter maps 25+ asset types to `.tf.json` resources with an `import.sh` to adopt them into state.
 
-Scanner findings are deduplicated by resource and title, rescored against CVSS, and mapped to compliance controls.
+Scanner findings are deduplicated in two passes — within a scanner by (scanner, check ID, resource), and across scanners only when both the normalised title and the underlying check semantics (`rules/check_equivalence.yaml`) match — then rescored against CVSS and mapped to compliance controls.
 
 ---
 
@@ -255,6 +255,3 @@ Python 3.11 or newer. The moto/aiobotocore incompatibility around async response
 
 ---
 
-## License
-
-MIT

{cloudg-0.3.0 → cloudg-0.3.2}/cloudg/__init__.py

@@ -1,6 +1,6 @@
 """cloudg — cloud graphing: multi-cloud mapping and security intelligence."""
 
-__version__ = "0.3.0"
+__version__ = "0.3.2"
 
 from cloudg.api import (
     AnalysisResult,

{cloudg-0.3.0 → cloudg-0.3.2}/cloudg/api.py

@@ -43,6 +43,34 @@ from cloudg.schema.models import (
 logger = logging.getLogger(__name__)
 
 
+def resolve_iac_dirs(
+    iac_dir: str | None,
+    config_dirs: list[str] | None,
+    terraform_dir: str | Path | None = None,
+) -> tuple[list[str], str | None]:
+    """Resolve which directories the IaC scanners (Checkov, Trivy fs) target.
+
+    Priority: explicit dir -> configured dirs -> the generated Terraform
+    recreation of the live infrastructure. There is deliberately no fallback
+    to "." any more: scanning whatever directory cloudg happens to run from
+    is not a scan of the cloud, and its zero findings read like a clean bill
+    of health.
+
+    Returns:
+        (dirs, source) where source is "cli", "config", "terraform", or
+        None when there is nothing for the IaC scanners to target.
+    """
+    if iac_dir:
+        return [iac_dir], "cli"
+    if config_dirs:
+        return list(config_dirs), "config"
+    if terraform_dir:
+        tf_path = Path(terraform_dir)
+        if tf_path.is_dir() and any(tf_path.glob("*.tf.json")):
+            return [str(tf_path)], "terraform"
+    return [], None
+
+
 # ---------------------------------------------------------------------------
 # Result dataclasses
 # ---------------------------------------------------------------------------
@@ -285,14 +313,37 @@ class CloudGEngine:
             logger.error("Graph analysis failed: %s", exc)
             self._emit_error("graph_analysis", exc)
 
-        # Resolve IaC directories
-        resolved_iac_dirs: list[str] = []
-        if iac_dir:
-            resolved_iac_dirs = [iac_dir]
-        elif self.config.scanners.iac_directories:
-            resolved_iac_dirs = list(self.config.scanners.iac_directories)
-        else:
-            resolved_iac_dirs = ["."]
+        # Resolve IaC directories. When nothing is configured but Terraform
+        # recreation is enabled, generate it now and scan that: the IaC
+        # scanners then audit the live infrastructure via its Terraform
+        # representation instead of an unrelated local directory.
+        tf_dir: str | None = None
+        if (
+            not iac_dir
+            and not self.config.scanners.iac_directories
+            and self.config.terraform.enabled
+        ):
+            tf_dir = self.config.terraform.output_dir or str(out / "terraform")
+            try:
+                from cloudg.renderers.terraform_export import TerraformExporter
+
+                TerraformExporter(output_dir=tf_dir).export(assets, edges)
+            except Exception as exc:
+                logger.error("Terraform export for IaC scanning failed: %s", exc)
+                self._emit_error("terraform", exc)
+                tf_dir = None
+
+        resolved_iac_dirs, iac_source = resolve_iac_dirs(
+            iac_dir, self.config.scanners.iac_directories, tf_dir
+        )
+        if iac_source == "terraform":
+            logger.info("IaC scanners target the Terraform recreation at %s", resolved_iac_dirs[0])
+        elif not resolved_iac_dirs and "checkov" in scanner_list:
+            logger.warning(
+                "Skipping Checkov: no IaC directory configured. "
+                "Pass iac_dir, set scanners.iac_directories, or enable terraform "
+                "so the recreated infrastructure can be scanned."
+            )
 
         # Resolve images
         resolved_images: list[str] = images or list(self.config.scanners.trivy_images)