cloudglass 0.2.0__py3-none-any.whl

cloudglass/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

cloudglass/cli.py

@@ -0,0 +1,358 @@
+"""CloudGlass CLI — entrypoint for the cloud security scanner."""
+from __future__ import annotations
+
+import json
+import sys
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from pathlib import Path
+from typing import Optional
+
+import boto3
+import click
+from botocore.config import Config
+from botocore.exceptions import ClientError, NoCredentialsError
+from rich.columns import Columns
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+from rich.text import Text
+
+from .collectors.cloudtrail import collect_cloudtrail
+from .collectors.ec2 import collect_security_groups
+from .collectors.iam import collect_iam_users, collect_root_account
+from .collectors.kms import collect_kms_keys
+from .collectors.lambda_ import collect_lambda_functions
+from .collectors.rds import collect_rds_instances
+from .collectors.s3 import collect_s3_buckets
+from .engine import Finding, load_yaml_rules, run_rules
+from .models import Resource
+from .rules.aws_rules import RULES
+
+console = Console(stderr=False)
+
+SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
+SEVERITY_COLOR = {
+    "CRITICAL": "bold red",
+    "HIGH": "red",
+    "MEDIUM": "yellow",
+    "LOW": "cyan",
+}
+FAIL_ON_CHOICES = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "NONE"]
+
+BANNER = r"""
+  ██████╗██╗      ██████╗ ██╗   ██╗██████╗  ██████╗ ██╗      █████╗ ███████╗███████╗
+ ██╔════╝██║     ██╔═══██╗██║   ██║██╔══██╗██╔════╝ ██║     ██╔══██╗██╔════╝██╔════╝
+ ██║     ██║     ██║   ██║██║   ██║██║  ██║██║  ███╗██║     ███████║███████╗███████╗
+ ██║     ██║     ██║   ██║██║   ██║██║  ██║██║   ██║██║     ██╔══██║╚════██║╚════██║
+ ╚██████╗███████╗╚██████╔╝╚██████╔╝██████╔╝╚██████╔╝███████╗██║  ██║███████║███████║
+  ╚═════╝╚══════╝ ╚═════╝  ╚═════╝ ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚══════╝╚══════╝"""
+
+
+def _boto_config() -> Config:
+    """Return a botocore Config with adaptive retries for throttle resilience."""
+    return Config(
+        retries={"mode": "adaptive", "max_attempts": 6},
+        connect_timeout=10,
+        read_timeout=30,
+    )
+
+
+def _print_banner() -> None:
+    """Print the CloudGlass ASCII banner with author credit."""
+    banner_text = Text(BANNER, style="bold cyan")
+    credit = Text("by shubham.cybersky", style="dim white")
+    console.print(banner_text)
+    # Right-align credit to match banner width (~88 chars)
+    console.print(credit, justify="right")
+    console.print()
+
+
+def _get_all_regions(session: boto3.Session) -> list[str]:
+    """Return all enabled AWS regions."""
+    ec2 = session.client("ec2", region_name="us-east-1", config=_boto_config())
+    try:
+        resp = ec2.describe_regions(Filters=[{"Name": "opt-in-status", "Values": ["opt-in-not-required", "opted-in"]}])
+        return [r["RegionName"] for r in resp["Regions"]]
+    except ClientError:
+        return ["us-east-1"]
+
+
+def _collect_all(
+    session: boto3.Session,
+    regions: list[str],
+) -> list[Resource]:
+    """
+    Concurrently collect resources from all collectors across all regions.
+    Global services (S3, IAM) are collected once; regional services are collected per-region.
+    """
+    resources: list[Resource] = []
+    futures = []
+
+    with ThreadPoolExecutor(max_workers=min(32, len(regions) * 4 + 2)) as pool:
+        # Global (region-independent)
+        futures.append(pool.submit(collect_s3_buckets, session))
+        futures.append(pool.submit(collect_iam_users, session))
+        futures.append(pool.submit(collect_root_account, session))
+
+        # Regional
+        for region in regions:
+            futures.append(pool.submit(collect_security_groups, session, region))
+            futures.append(pool.submit(collect_rds_instances, session, region))
+            futures.append(pool.submit(collect_cloudtrail, session, region))
+            futures.append(pool.submit(collect_kms_keys, session, region))
+            futures.append(pool.submit(collect_lambda_functions, session, region))
+
+        for future in as_completed(futures):
+            try:
+                result = future.result()
+                resources.extend(result)
+            except Exception as exc:
+                console.print(f"[red]Collector error: {exc}[/red]", stderr=True)
+
+    return resources
+
+
+def _build_table(findings: list[Finding], show_compliance: bool) -> Table:
+    """Build a Rich table of findings."""
+    table = Table(
+        title=f"CloudGlass Findings ({len(findings)})",
+        show_lines=False,
+        highlight=True,
+    )
+    table.add_column("Severity", no_wrap=True)
+    table.add_column("Rule", no_wrap=True)
+    table.add_column("Title")
+    table.add_column("Resource")
+    table.add_column("Region", no_wrap=True)
+    if show_compliance:
+        table.add_column("Compliance*")
+    table.add_column("Remediation")
+
+    for f in findings:
+        color = SEVERITY_COLOR.get(f.severity, "white")
+        row = [
+            f"[{color}]{f.severity}[/{color}]",
+            f.rule_id,
+            f.title,
+            f.resource_name,
+            f.region or "global",
+        ]
+        if show_compliance:
+            row.append(", ".join(f.compliance) if f.compliance else "")
+        row.append(f.remediation)
+        table.add_row(*row)
+    return table
+
+
+def _print_scorecard(findings: list[Finding]) -> None:
+    """Print a per-severity summary scorecard."""
+    counts = {sev: 0 for sev in SEVERITY_ORDER}
+    for f in findings:
+        if f.severity in counts:
+            counts[f.severity] += 1
+
+    cells = []
+    for sev in SEVERITY_ORDER:
+        color = SEVERITY_COLOR[sev]
+        count = counts[sev]
+        cells.append(Panel(f"[{color}][bold]{count}[/bold][/{color}]", title=f"[{color}]{sev}[/{color}]", width=16))
+    console.print()
+    console.print(Columns(cells))
+    console.print("  [dim]* Compliance tags are indicative starting points, not certified mappings.[/dim]\n")
+
+
+def _findings_to_json(findings: list[Finding]) -> str:
+    """Serialize findings to JSON."""
+    return json.dumps(
+        [
+            {
+                "rule_id": f.rule_id,
+                "title": f.title,
+                "severity": f.severity,
+                "resource_id": f.resource_id,
+                "resource_name": f.resource_name,
+                "region": f.region,
+                "remediation": f.remediation,
+                "compliance": f.compliance,
+            }
+            for f in findings
+        ],
+        indent=2,
+    )
+
+
+def _findings_to_sarif(findings: list[Finding]) -> str:
+    """Serialize findings to SARIF 2.1.0 format."""
+    rules = {}
+    for f in findings:
+        if f.rule_id not in rules:
+            rules[f.rule_id] = {
+                "id": f.rule_id,
+                "name": f.title,
+                "shortDescription": {"text": f.title},
+                "help": {"text": f.remediation},
+                "properties": {"tags": f.compliance},
+            }
+
+    severity_map = {"CRITICAL": "error", "HIGH": "error", "MEDIUM": "warning", "LOW": "note"}
+
+    results = [
+        {
+            "ruleId": f.rule_id,
+            "level": severity_map.get(f.severity, "warning"),
+            "message": {"text": f"{f.title} — {f.resource_name} ({f.region or 'global'})"},
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {"uri": f"aws://{f.resource_id}"},
+                    }
+                }
+            ],
+        }
+        for f in findings
+    ]
+
+    sarif = {
+        "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json",
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "CloudGlass",
+                        "version": "0.2.0",
+                        "rules": list(rules.values()),
+                    }
+                },
+                "results": results,
+            }
+        ],
+    }
+    return json.dumps(sarif, indent=2)
+
+
+def _exit_code(findings: list[Finding], fail_on: str) -> int:
+    """Compute exit code: 1 if any finding meets or exceeds the fail_on threshold, else 0."""
+    if fail_on == "NONE":
+        return 0
+    threshold_index = SEVERITY_ORDER.index(fail_on)
+    for f in findings:
+        try:
+            if SEVERITY_ORDER.index(f.severity) <= threshold_index:
+                return 1
+        except ValueError:
+            pass
+    return 0
+
+
+@click.group(epilog="""
+Examples:
+  # Scan default region using default credentials
+  cloudglass scan
+
+  # Scan a specific profile and region
+  cloudglass scan --profile prod --region us-west-2
+
+  # Scan all regions and output to JSON
+  cloudglass scan --all-regions --output json
+
+  # Fail pipeline on CRITICAL findings only
+  cloudglass scan --fail-on CRITICAL
+""")
+@click.version_option(version="0.2.0", message="%(prog)s %(version)s")
+def main():
+    """CloudGlass — see through your cloud's security posture."""
+
+
+@main.command()
+@click.option("--profile", default=None, help="AWS named profile to use.")
+@click.option("--region", default="us-east-1", show_default=True, help="Primary AWS region for regional services.")
+@click.option("--all-regions", is_flag=True, default=False, help="Scan all enabled AWS regions.")
+@click.option("--output", "output_fmt", default="table", show_default=True, type=click.Choice(["table", "json", "sarif"], case_sensitive=False), help="Output format.")
+@click.option("--fail-on", default="HIGH", show_default=True, type=click.Choice(FAIL_ON_CHOICES, case_sensitive=False), help="Exit 1 if any finding at this severity or above.")
+@click.option("--severity", default=None, help="Comma-separated severity filter, e.g. HIGH,CRITICAL.")
+@click.option("--service", default=None, help="Comma-separated service filter, e.g. s3,iam,rds.")
+@click.option("--rule-id", default=None, help="Comma-separated rule ID filter, e.g. CG-S3-001.")
+@click.option("--rules-file", default=None, type=click.Path(exists=True, path_type=Path), help="Path to a YAML file with custom rules.")
+@click.option("--compliance", is_flag=True, default=False, help="Show compliance framework tags in table output.")
+def scan(
+    profile: Optional[str],
+    region: str,
+    all_regions: bool,
+    output_fmt: str,
+    fail_on: str,
+    severity: Optional[str],
+    service: Optional[str],
+    rule_id: Optional[str],
+    rules_file: Optional[Path],
+    compliance: bool,
+) -> None:
+    """Scan an AWS account for security misconfigurations."""
+    _print_banner()
+
+    try:
+        session = boto3.Session(profile_name=profile, region_name=region)
+    except Exception as e:
+        console.print(f"[bold red]Failed to create AWS session:[/bold red] {e}")
+        sys.exit(2)
+
+    # Build rule list (built-ins + optional custom YAML rules)
+    rules = list(RULES)
+    if rules_file:
+        try:
+            custom = load_yaml_rules(rules_file)
+            rules.extend(custom)
+            console.print(f"Loaded [bold]{len(custom)}[/bold] custom rule(s) from [cyan]{rules_file}[/cyan].\n")
+        except Exception as e:
+            console.print(f"[bold red]Failed to load rules file:[/bold red] {e}")
+            sys.exit(2)
+
+    # Determine regions to scan
+    regions = _get_all_regions(session) if all_regions else [region]
+    region_label = "all regions" if all_regions else region
+    console.print(f"[bold]CloudGlass[/bold] — scanning AWS account across [cyan]{region_label}[/cyan]...\n")
+
+    # Parse filters
+    severity_filter = [s.strip().upper() for s in severity.split(",")] if severity else None
+    service_filter = [s.strip().lower() for s in service.split(",")] if service else None
+    rule_id_filter = [r.strip().upper() for r in rule_id.split(",")] if rule_id else None
+
+    # Collect (concurrent)
+    with console.status("Collecting resources (parallel)..."):
+        resources = _collect_all(session, regions)
+
+    console.print(f"Collected [bold]{len(resources)}[/bold] resources across [bold]{len(regions)}[/bold] region(s).\n")
+
+    # Run rules
+    findings = run_rules(
+        resources,
+        rules=rules,
+        severity_filter=severity_filter,
+        service_filter=service_filter,
+        rule_id_filter=rule_id_filter,
+    )
+
+    # Output
+    if output_fmt == "json":
+        print(_findings_to_json(findings))
+    elif output_fmt == "sarif":
+        print(_findings_to_sarif(findings))
+    else:
+        # Table
+        if not findings:
+            console.print("[bold green]✓ No findings. Nice.[/bold green]")
+            _print_scorecard(findings)
+            sys.exit(0)
+
+        findings_sorted = sorted(findings, key=lambda f: SEVERITY_ORDER.index(f.severity))
+        console.print(_build_table(findings_sorted, show_compliance=compliance))
+        _print_scorecard(findings_sorted)
+        if compliance:
+            console.print("  [dim italic]* Compliance tags are indicative starting points, not certified mappings.[/dim italic]\n")
+
+    code = _exit_code(findings, fail_on.upper())
+    sys.exit(code)
+
+
+if __name__ == "__main__":
+    main()

cloudglass/collectors/cloudtrail.py

@@ -0,0 +1,47 @@
+"""CloudTrail collector — checks trail status per region."""
+import boto3
+from botocore.exceptions import ClientError
+
+from ..models import Resource
+
+
+def collect_cloudtrail(session: boto3.Session, region: str) -> list[Resource]:
+    """
+    Returns a single synthetic 'cloudtrail_account' resource per region
+    capturing whether a trail is enabled and whether a multi-region trail exists.
+    """
+    client = session.client("cloudtrail", region_name=region)
+
+    trail_enabled = False
+    multi_region = False
+
+    try:
+        trails = client.describe_trails(includeShadowTrails=True).get("trailList", [])
+        for trail in trails:
+            status_resp = client.get_trail_status(Name=trail["TrailARN"])
+            if status_resp.get("IsLogging"):
+                trail_enabled = True
+                if trail.get("IsMultiRegionTrail"):
+                    multi_region = True
+    except ClientError as e:
+        code = e.response["Error"]["Code"]
+        if code in ("AccessDenied", "AccessDeniedException"):
+            print(f"[cloudglass] AccessDenied: cannot describe CloudTrail trails in {region}")
+            return []
+        else:
+            print(f"[cloudglass] Failed to describe CloudTrail in {region}: {e}")
+            return []
+
+    return [
+        Resource(
+            id=f"cloudtrail-{region}",
+            type="cloudtrail_account",
+            provider="aws",
+            name=f"cloudtrail-{region}",
+            region=region,
+            metadata={
+                "trail_enabled": trail_enabled,
+                "multi_region": multi_region,
+            },
+        )
+    ]

cloudglass/collectors/ec2.py

@@ -0,0 +1,51 @@
+"""EC2 collector — gathers security groups and normalizes them."""
+import boto3
+from botocore.exceptions import ClientError
+
+from ..models import Resource
+
+
+def collect_security_groups(session: boto3.Session, region: str) -> list[Resource]:
+    """Collect all EC2 security groups in the given region."""
+    ec2 = session.client("ec2", region_name=region)
+    resources: list[Resource] = []
+
+    try:
+        paginator = ec2.get_paginator("describe_security_groups")
+        for page in paginator.paginate():
+            for sg in page["SecurityGroups"]:
+                open_to_world = False
+                open_ports: set[str] = set()
+
+                for perm in sg.get("IpPermissions", []):
+                    from_port = perm.get("FromPort")
+                    to_port = perm.get("ToPort")
+                    for ip_range in perm.get("IpRanges", []):
+                        if ip_range.get("CidrIp") == "0.0.0.0/0":
+                            open_to_world = True
+                            open_ports.add("ALL" if from_port is None else f"{from_port}-{to_port}")
+                    for ip_range in perm.get("Ipv6Ranges", []):
+                        if ip_range.get("CidrIpv6") == "::/0":
+                            open_to_world = True
+                            open_ports.add("ALL" if from_port is None else f"{from_port}-{to_port}")
+
+                resources.append(
+                    Resource(
+                        id=sg["GroupId"],
+                        type="security_group",
+                        provider="aws",
+                        name=sg.get("GroupName", sg["GroupId"]),
+                        region=region,
+                        is_public=open_to_world,
+                        metadata={"open_ports": sorted(open_ports)},
+                        raw=sg,
+                    )
+                )
+    except ClientError as e:
+        code = e.response["Error"]["Code"]
+        if code in ("AccessDenied", "AccessDeniedException"):
+            print(f"[cloudglass] AccessDenied: cannot describe security groups in {region}")
+        else:
+            print(f"[cloudglass] Failed to describe security groups in {region}: {e}")
+
+    return resources

cloudglass/collectors/iam.py

@@ -0,0 +1,72 @@
+"""IAM collector — gathers IAM users and root account posture."""
+import boto3
+from botocore.exceptions import ClientError
+
+from ..models import Resource
+
+
+def collect_iam_users(session: boto3.Session) -> list[Resource]:
+    """Collect all IAM users and their MFA status."""
+    iam = session.client("iam")
+    resources: list[Resource] = []
+
+    try:
+        paginator = iam.get_paginator("list_users")
+        for page in paginator.paginate():
+            for user in page["Users"]:
+                username = user["UserName"]
+                try:
+                    mfa_devices = iam.list_mfa_devices(UserName=username).get("MFADevices", [])
+                    mfa_enabled = len(mfa_devices) > 0
+                except ClientError:
+                    mfa_enabled = None
+
+                resources.append(
+                    Resource(
+                        id=user["Arn"],
+                        type="iam_user",
+                        provider="aws",
+                        name=username,
+                        mfa_enabled=mfa_enabled,
+                        raw=user,
+                    )
+                )
+    except ClientError as e:
+        code = e.response["Error"]["Code"]
+        if code in ("AccessDenied", "AccessDeniedException"):
+            print("[cloudglass] AccessDenied: cannot list IAM users")
+        else:
+            print(f"[cloudglass] Failed to list IAM users: {e}")
+
+    return resources
+
+
+def collect_root_account(session: boto3.Session) -> list[Resource]:
+    """Collect root account security posture from IAM account summary."""
+    iam = session.client("iam")
+    resources: list[Resource] = []
+
+    try:
+        summary = iam.get_account_summary()["SummaryMap"]
+        root_access_keys = summary.get("AccountAccessKeysPresent", 0) > 0
+        root_mfa = summary.get("AccountMFAEnabled", 0) == 1
+
+        resources.append(
+            Resource(
+                id="root-account",
+                type="iam_account",
+                provider="aws",
+                name="root",
+                mfa_enabled=root_mfa,
+                metadata={"root_access_keys_present": root_access_keys},
+                raw=summary,
+            )
+        )
+    except ClientError as e:
+        code = e.response["Error"]["Code"]
+        if code in ("AccessDenied", "AccessDeniedException"):
+            print("[cloudglass] AccessDenied: cannot get account summary")
+        else:
+            print(f"[cloudglass] Failed to get account summary: {e}")
+
+    return resources

cloudglass/collectors/kms.py

@@ -0,0 +1,64 @@
+"""KMS collector — gathers customer-managed keys and checks rotation."""
+import boto3
+from botocore.exceptions import ClientError
+
+from ..models import Resource
+
+
+def collect_kms_keys(session: boto3.Session, region: str) -> list[Resource]:
+    """Collect all customer-managed KMS keys in the given region."""
+    client = session.client("kms", region_name=region)
+    resources: list[Resource] = []
+
+    try:
+        paginator = client.get_paginator("list_keys")
+        for page in paginator.paginate():
+            for key_meta in page["Keys"]:
+                key_id = key_meta["KeyId"]
+                key_arn = key_meta["KeyArn"]
+
+                # Skip AWS-managed keys — only audit customer-managed keys
+                try:
+                    key_desc = client.describe_key(KeyId=key_id)["KeyMetadata"]
+                except ClientError:
+                    continue
+
+                if key_desc.get("KeyManager") != "CUSTOMER":
+                    continue
+                if key_desc.get("KeyState") not in ("Enabled",):
+                    continue
+                if key_desc.get("KeySpec") == "SYMMETRIC_DEFAULT" and key_desc.get("MultiRegion") is False:
+                    # Only symmetric single-region keys support auto-rotation
+                    pass
+
+                rotation_enabled = False
+                try:
+                    rot = client.get_key_rotation_status(KeyId=key_id)
+                    rotation_enabled = rot.get("KeyRotationEnabled", False)
+                except ClientError:
+                    rotation_enabled = False
+
+                resources.append(
+                    Resource(
+                        id=key_arn,
+                        type="kms_key",
+                        provider="aws",
+                        name=key_desc.get("Description") or key_id,
+                        region=region,
+                        metadata={
+                            "rotation_enabled": rotation_enabled,
+                            "key_state": key_desc.get("KeyState"),
+                            "key_manager": key_desc.get("KeyManager"),
+                            "key_spec": key_desc.get("KeySpec"),
+                        },
+                        raw=key_desc,
+                    )
+                )
+    except ClientError as e:
+        code = e.response["Error"]["Code"]
+        if code in ("AccessDenied", "AccessDeniedException"):
+            print(f"[cloudglass] AccessDenied: cannot list KMS keys in {region}")
+        else:
+            print(f"[cloudglass] Failed to list KMS keys in {region}: {e}")
+
+    return resources

cloudglass/collectors/lambda_.py

@@ -0,0 +1,54 @@
+"""Lambda collector — gathers functions and checks function URL auth."""
+import boto3
+from botocore.exceptions import ClientError
+
+from ..models import Resource
+
+
+def collect_lambda_functions(session: boto3.Session, region: str) -> list[Resource]:
+    """Collect all Lambda functions in the given region."""
+    client = session.client("lambda", region_name=region)
+    resources: list[Resource] = []
+
+    try:
+        paginator = client.get_paginator("list_functions")
+        for page in paginator.paginate():
+            for fn in page["Functions"]:
+                fn_name = fn["FunctionName"]
+                fn_arn = fn["FunctionArn"]
+
+                # Check for function URLs with no auth
+                function_url_no_auth = False
+                try:
+                    url_configs = client.list_function_url_configs(FunctionName=fn_name)
+                    for cfg in url_configs.get("FunctionUrlConfigs", []):
+                        if cfg.get("AuthType") == "NONE":
+                            function_url_no_auth = True
+                            break
+                except ClientError as e:
+                    if e.response["Error"]["Code"] != "ResourceNotFoundException":
+                        pass  # no URL configured is fine
+
+                resources.append(
+                    Resource(
+                        id=fn_arn,
+                        type="lambda_function",
+                        provider="aws",
+                        name=fn_name,
+                        region=region,
+                        metadata={
+                            "runtime": fn.get("Runtime"),
+                            "function_url_no_auth": function_url_no_auth,
+                            "package_type": fn.get("PackageType"),
+                        },
+                        raw=fn,
+                    )
+                )
+    except ClientError as e:
+        code = e.response["Error"]["Code"]
+        if code in ("AccessDenied", "AccessDeniedException"):
+            print(f"[cloudglass] AccessDenied: cannot list Lambda functions in {region}")
+        else:
+            print(f"[cloudglass] Failed to list Lambda functions in {region}: {e}")
+
+    return resources

cloudglass/collectors/rds.py

@@ -0,0 +1,43 @@
+"""RDS collector — gathers DB instances and normalizes them."""
+import boto3
+from botocore.exceptions import ClientError
+
+from ..models import Resource
+
+
+def collect_rds_instances(session: boto3.Session, region: str) -> list[Resource]:
+    """Collect all RDS DB instances in the given region."""
+    client = session.client("rds", region_name=region)
+    resources: list[Resource] = []
+
+    try:
+        paginator = client.get_paginator("describe_db_instances")
+        for page in paginator.paginate():
+            for db in page["DBInstances"]:
+                resources.append(
+                    Resource(
+                        id=db["DBInstanceArn"],
+                        type="rds_instance",
+                        provider="aws",
+                        name=db["DBInstanceIdentifier"],
+                        region=region,
+                        is_public=db.get("PubliclyAccessible", False),
+                        encrypted=db.get("StorageEncrypted", False),
+                        metadata={
+                            "engine": db.get("Engine"),
+                            "engine_version": db.get("EngineVersion"),
+                            "instance_class": db.get("DBInstanceClass"),
+                            "status": db.get("DBInstanceStatus"),
+                            "multi_az": db.get("MultiAZ", False),
+                        },
+                        raw=db,
+                    )
+                )
+    except ClientError as e:
+        code = e.response["Error"]["Code"]
+        if code in ("AccessDenied", "AccessDeniedException"):
+            print(f"[cloudglass] AccessDenied: cannot describe RDS instances in {region}")
+        else:
+            print(f"[cloudglass] Failed to describe RDS instances in {region}: {e}")
+
+    return resources

cloudglass/collectors/s3.py

@@ -0,0 +1,78 @@
+"""S3 collector — gathers buckets and normalizes public access + encryption."""
+import boto3
+from botocore.exceptions import ClientError
+
+from ..models import Resource
+
+
+def collect_s3_buckets(session: boto3.Session) -> list[Resource]:
+    """Collect all S3 buckets in the account with public-access and encryption status."""
+    s3 = session.client("s3")
+    resources: list[Resource] = []
+
+    try:
+        buckets = s3.list_buckets().get("Buckets", [])
+    except ClientError as e:
+        code = e.response["Error"]["Code"]
+        if code in ("AccessDenied", "AccessDeniedException"):
+            print("[cloudglass] AccessDenied: cannot list S3 buckets")
+        else:
+            print(f"[cloudglass] Failed to list S3 buckets: {e}")
+        return resources
+
+    for b in buckets:
+        name = b["Name"]
+        is_public = False
+        encrypted = False
+
+        # Block Public Access config
+        fully_blocked = False
+        try:
+            pab = s3.get_public_access_block(Bucket=name)["PublicAccessBlockConfiguration"]
+            fully_blocked = all(
+                pab.get(k, False)
+                for k in ["BlockPublicAcls", "IgnorePublicAcls", "BlockPublicPolicy", "RestrictPublicBuckets"]
+            )
+        except ClientError:
+            pass
+
+        # ACL grants to AllUsers / AuthenticatedUsers
+        try:
+            acl = s3.get_bucket_acl(Bucket=name)
+            for grant in acl.get("Grants", []):
+                uri = grant.get("Grantee", {}).get("URI", "")
+                if "AllUsers" in uri or "AuthenticatedUsers" in uri:
+                    is_public = True
+        except ClientError:
+            pass
+
+        # Bucket policy public status
+        try:
+            status = s3.get_bucket_policy_status(Bucket=name)
+            if status.get("PolicyStatus", {}).get("IsPublic"):
+                is_public = True
+        except ClientError:
+            pass
+
+        if fully_blocked:
+            is_public = False
+
+        try:
+            s3.get_bucket_encryption(Bucket=name)
+            encrypted = True
+        except ClientError:
+            encrypted = False
+
+        resources.append(
+            Resource(
+                id=name,
+                type="storage_bucket",
+                provider="aws",
+                name=name,
+                is_public=is_public,
+                encrypted=encrypted,
+                raw=b,
+            )
+        )
+
+    return resources

cloudglass/engine.py

@@ -0,0 +1,153 @@
+"""
+Rule engine: matches collected resources against rules and produces findings.
+Supports built-in Python rules and custom YAML rules.
+"""
+from __future__ import annotations
+
+import importlib
+import importlib.util
+import sys
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Optional
+
+import yaml
+
+from .models import Resource
+from .rules.aws_rules import RULES, Rule
+
+
+@dataclass
+class Finding:
+    rule_id: str
+    title: str
+    severity: str
+    resource_id: str
+    resource_name: str
+    region: Optional[str]
+    remediation: str
+    compliance: list[str] = field(default_factory=list)  # e.g. ["CIS 2.1", "SOC2 CC6"]
+
+
+# ---------------------------------------------------------------------------
+# YAML custom rule loader
+# ---------------------------------------------------------------------------
+
+_CONDITION_OPS = {
+    "equals": lambda val, expected: val == expected,
+    "not_equals": lambda val, expected: val != expected,
+    "contains": lambda val, expected: expected in (val or ""),
+    "is_true": lambda val, _: val is True,
+    "is_false": lambda val, _: val is False,
+    "exists": lambda val, _: val is not None,
+}
+
+
+def _field_value(resource: Resource, field_path: str) -> Any:
+    """Retrieve a value from a Resource, supporting metadata.<key> dotted paths."""
+    if field_path.startswith("metadata."):
+        key = field_path[len("metadata."):]
+        return resource.metadata.get(key)
+    return getattr(resource, field_path, None)
+
+
+def _yaml_rule_to_rule(data: dict) -> Rule:
+    """Convert a parsed YAML rule dict into a Rule dataclass."""
+    conditions = data.get("conditions", [])
+    compliance = data.get("compliance", [])
+
+    def check(resource: Resource) -> bool:
+        for cond in conditions:
+            field_path = cond["field"]
+            op = cond["op"]
+            expected = cond.get("value")
+            val = _field_value(resource, field_path)
+            op_fn = _CONDITION_OPS.get(op)
+            if op_fn is None:
+                raise ValueError(f"Unknown condition op: {op!r}")
+            if not op_fn(val, expected):
+                return False  # all conditions must pass (AND logic)
+        return True
+
+    rule = Rule(
+        id=data["id"],
+        title=data["title"],
+        severity=data["severity"].upper(),
+        resource_type=data["resource_type"],
+        check=check,
+        remediation=data.get("remediation", ""),
+        compliance=compliance,
+    )
+    return rule
+
+
+def load_yaml_rules(path: str | Path) -> list[Rule]:
+    """Load custom rules from a YAML file. Returns a list of Rule objects."""
+    path = Path(path)
+    with path.open() as fh:
+        docs = yaml.safe_load(fh)
+    if not isinstance(docs, list):
+        docs = [docs]
+    return [_yaml_rule_to_rule(d) for d in docs]
+
+
+# ---------------------------------------------------------------------------
+# Core engine
+# ---------------------------------------------------------------------------
+
+
+def run_rules(
+    resources: list[Resource],
+    rules: list[Rule] | None = None,
+    severity_filter: Optional[list[str]] = None,
+    service_filter: Optional[list[str]] = None,
+    rule_id_filter: Optional[list[str]] = None,
+) -> list[Finding]:
+    """
+    Run all applicable rules against resources and return findings.
+
+    Filters (all optional, comma-separated strings that callers already split):
+    - severity_filter: only keep findings with matching severity
+    - service_filter:  only run rules whose id prefix matches (e.g. 's3' → CG-S3-*)
+    - rule_id_filter:  only run specific rule IDs
+    """
+    if rules is None:
+        rules = RULES
+
+    active_rules = rules
+    if service_filter:
+        svc_upper = [s.upper() for s in service_filter]
+        active_rules = [r for r in active_rules if any(f"CG-{s}-" in r.id for s in svc_upper)]
+    if rule_id_filter:
+        rid_upper = [r.upper() for r in rule_id_filter]
+        active_rules = [r for r in active_rules if r.id.upper() in rid_upper]
+
+    findings: list[Finding] = []
+
+    for resource in resources:
+        for rule in active_rules:
+            if rule.resource_type != resource.type:
+                continue
+            try:
+                failed = rule.check(resource)
+            except Exception:
+                continue
+            if failed:
+                findings.append(
+                    Finding(
+                        rule_id=rule.id,
+                        title=rule.title,
+                        severity=rule.severity,
+                        resource_id=resource.id,
+                        resource_name=resource.name,
+                        region=resource.region,
+                        remediation=rule.remediation,
+                        compliance=getattr(rule, "compliance", []),
+                    )
+                )
+
+    if severity_filter:
+        sev_upper = [s.upper() for s in severity_filter]
+        findings = [f for f in findings if f.severity in sev_upper]
+
+    return findings

cloudglass/models.py

@@ -0,0 +1,25 @@
+"""
+Normalized resource model.
+
+Every collector (AWS, and later Azure/GCP) converts provider-specific
+API responses into this common shape. Rules are then written against
+this shape instead of against raw provider data, so most rules work
+across clouds without modification.
+"""
+from dataclasses import dataclass, field
+from typing import Any, Optional
+
+
+@dataclass
+class Resource:
+    id: str                          # unique identifier (ARN, resource ID, etc.)
+    type: str                        # e.g. "storage_bucket", "iam_user", "security_group"
+    provider: str                    # "aws", "azure", "gcp"
+    name: str
+    region: Optional[str] = None
+    is_public: Optional[bool] = None
+    encrypted: Optional[bool] = None
+    mfa_enabled: Optional[bool] = None
+    metadata: dict[str, Any] = field(default_factory=dict)
+    raw: dict[str, Any] = field(default_factory=dict)   # original provider response, for debugging
+    tags: dict[str, str] = field(default_factory=dict)  # AWS resource tags

cloudglass/rules/aws_rules.py

@@ -0,0 +1,222 @@
+"""
+Built-in AWS rules.
+
+Each Rule's `check` function returns True when the resource FAILS the
+check (i.e. a finding should be raised), False when it passes.
+
+Compliance tags are indicative starting points, NOT certified mappings.
+"""
+from dataclasses import dataclass, field
+from typing import Callable
+
+from ..models import Resource
+
+
+@dataclass
+class Rule:
+    id: str
+    title: str
+    severity: str  # LOW, MEDIUM, HIGH, CRITICAL
+    resource_type: str
+    check: Callable[[Resource], bool]
+    remediation: str
+    compliance: list[str] = field(default_factory=list)
+
+
+# ---------------------------------------------------------------------------
+# S3
+# ---------------------------------------------------------------------------
+
+def _s3_public(r: Resource) -> bool:
+    return r.is_public is True
+
+
+def _s3_unencrypted(r: Resource) -> bool:
+    return r.encrypted is False
+
+
+# ---------------------------------------------------------------------------
+# IAM
+# ---------------------------------------------------------------------------
+
+def _iam_user_no_mfa(r: Resource) -> bool:
+    return r.mfa_enabled is False
+
+
+def _root_no_mfa(r: Resource) -> bool:
+    return r.mfa_enabled is False
+
+
+def _root_access_keys(r: Resource) -> bool:
+    return r.metadata.get("root_access_keys_present") is True
+
+
+# ---------------------------------------------------------------------------
+# EC2 / Security Groups
+# ---------------------------------------------------------------------------
+
+def _sg_open_to_world(r: Resource) -> bool:
+    return r.is_public is True
+
+
+# ---------------------------------------------------------------------------
+# RDS
+# ---------------------------------------------------------------------------
+
+def _rds_publicly_accessible(r: Resource) -> bool:
+    return r.is_public is True
+
+
+def _rds_unencrypted(r: Resource) -> bool:
+    return r.encrypted is False
+
+
+# ---------------------------------------------------------------------------
+# CloudTrail
+# ---------------------------------------------------------------------------
+
+def _cloudtrail_not_enabled(r: Resource) -> bool:
+    return r.metadata.get("trail_enabled") is False
+
+
+def _cloudtrail_not_multi_region(r: Resource) -> bool:
+    return r.metadata.get("multi_region") is False
+
+
+# ---------------------------------------------------------------------------
+# KMS
+# ---------------------------------------------------------------------------
+
+def _kms_rotation_disabled(r: Resource) -> bool:
+    return r.metadata.get("rotation_enabled") is False
+
+
+# ---------------------------------------------------------------------------
+# Lambda
+# ---------------------------------------------------------------------------
+
+def _lambda_url_no_auth(r: Resource) -> bool:
+    return r.metadata.get("function_url_no_auth") is True
+
+
+# ---------------------------------------------------------------------------
+# Rule registry
+# ---------------------------------------------------------------------------
+
+RULES: list[Rule] = [
+    # S3
+    Rule(
+        id="CG-S3-001",
+        title="S3 bucket is publicly accessible",
+        severity="CRITICAL",
+        resource_type="storage_bucket",
+        check=_s3_public,
+        remediation="Enable S3 Block Public Access and remove public ACL/bucket policy grants.",
+        compliance=["CIS AWS 2.1.5", "SOC2 CC6.1", "PCI-DSS 1.3"],
+    ),
+    Rule(
+        id="CG-S3-002",
+        title="S3 bucket does not have default encryption enabled",
+        severity="MEDIUM",
+        resource_type="storage_bucket",
+        check=_s3_unencrypted,
+        remediation="Enable default SSE-S3 or SSE-KMS encryption on the bucket.",
+        compliance=["CIS AWS 2.1.1", "SOC2 CC6.7", "PCI-DSS 3.4"],
+    ),
+    # IAM
+    Rule(
+        id="CG-IAM-001",
+        title="IAM user does not have MFA enabled",
+        severity="HIGH",
+        resource_type="iam_user",
+        check=_iam_user_no_mfa,
+        remediation="Require and enable MFA for all IAM users with console access.",
+        compliance=["CIS AWS 1.10", "SOC2 CC6.1", "PCI-DSS 8.3"],
+    ),
+    Rule(
+        id="CG-IAM-002",
+        title="Root account does not have MFA enabled",
+        severity="CRITICAL",
+        resource_type="iam_account",
+        check=_root_no_mfa,
+        remediation="Enable MFA on the root account immediately.",
+        compliance=["CIS AWS 1.5", "SOC2 CC6.1", "PCI-DSS 8.3"],
+    ),
+    Rule(
+        id="CG-IAM-003",
+        title="Root account has active access keys",
+        severity="CRITICAL",
+        resource_type="iam_account",
+        check=_root_access_keys,
+        remediation="Delete root account access keys; use IAM roles/users for programmatic access instead.",
+        compliance=["CIS AWS 1.4", "SOC2 CC6.3", "PCI-DSS 7.1"],
+    ),
+    # EC2
+    Rule(
+        id="CG-EC2-001",
+        title="Security group allows ingress from 0.0.0.0/0",
+        severity="HIGH",
+        resource_type="security_group",
+        check=_sg_open_to_world,
+        remediation="Restrict security group ingress rules to specific known IP ranges.",
+        compliance=["CIS AWS 5.2", "SOC2 CC6.6", "PCI-DSS 1.2"],
+    ),
+    # RDS
+    Rule(
+        id="CG-RDS-001",
+        title="RDS instance is publicly accessible",
+        severity="CRITICAL",
+        resource_type="rds_instance",
+        check=_rds_publicly_accessible,
+        remediation="Set PubliclyAccessible=false and place the instance in a private subnet.",
+        compliance=["CIS AWS 2.3.2", "SOC2 CC6.1", "PCI-DSS 1.3"],
+    ),
+    Rule(
+        id="CG-RDS-002",
+        title="RDS instance storage is not encrypted",
+        severity="HIGH",
+        resource_type="rds_instance",
+        check=_rds_unencrypted,
+        remediation="Enable storage encryption on the RDS instance (requires snapshot restore for existing instances).",
+        compliance=["CIS AWS 2.3.1", "SOC2 CC6.7", "PCI-DSS 3.4"],
+    ),
+    # CloudTrail
+    Rule(
+        id="CG-CT-001",
+        title="CloudTrail is not enabled in this region",
+        severity="HIGH",
+        resource_type="cloudtrail_account",
+        check=_cloudtrail_not_enabled,
+        remediation="Enable CloudTrail with a trail logging to an S3 bucket and optionally CloudWatch Logs.",
+        compliance=["CIS AWS 3.1", "SOC2 CC7.2", "PCI-DSS 10.1"],
+    ),
+    Rule(
+        id="CG-CT-002",
+        title="No multi-region CloudTrail trail exists",
+        severity="MEDIUM",
+        resource_type="cloudtrail_account",
+        check=_cloudtrail_not_multi_region,
+        remediation="Configure at least one CloudTrail trail to cover all regions.",
+        compliance=["CIS AWS 3.1", "SOC2 CC7.2"],
+    ),
+    # KMS
+    Rule(
+        id="CG-KMS-001",
+        title="KMS customer-managed key does not have automatic rotation enabled",
+        severity="MEDIUM",
+        resource_type="kms_key",
+        check=_kms_rotation_disabled,
+        remediation="Enable automatic annual key rotation for all CMKs.",
+        compliance=["CIS AWS 3.7", "SOC2 CC6.7", "PCI-DSS 3.6"],
+    ),
+    # Lambda
+    Rule(
+        id="CG-LAMBDA-001",
+        title="Lambda function URL has no authentication (NONE auth type)",
+        severity="HIGH",
+        resource_type="lambda_function",
+        check=_lambda_url_no_auth,
+        remediation="Set function URL AuthType to AWS_IAM or remove the function URL if not needed.",
+        compliance=["SOC2 CC6.1", "PCI-DSS 8.3"],
+    ),
+]

cloudglass-0.2.0.dist-info/METADATA

@@ -0,0 +1,123 @@
+Metadata-Version: 2.4
+Name: cloudglass
+Version: 0.2.0
+Summary: See through your cloud's security posture — open-source cloud misconfiguration scanner.
+License: MIT
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: boto3>=1.34
+Requires-Dist: click>=8.1
+Requires-Dist: rich>=13.7
+Requires-Dist: PyYAML>=6.0
+
+# CloudGlass
+
+See through your cloud's security posture. An open-source CLI scanner that
+checks your AWS account for common misconfigurations — public S3 buckets,
+missing MFA, permissive security groups, unencrypted RDS, disabled CloudTrail,
+KMS rotation, and Lambda function URL exposure.
+
+## Install
+
+```bash
+pip install -e .
+```
+
+## Usage
+
+```bash
+cloudglass scan --profile your-aws-profile --region us-east-1
+```
+
+### Common flags
+
+| Flag | Default | Description |
+|---|---|---|
+| `--profile` | (default chain) | AWS named profile |
+| `--region` | `us-east-1` | Primary region |
+| `--all-regions` | off | Scan every enabled region |
+| `--output` | `table` | `table`, `json`, or `sarif` |
+| `--fail-on` | `HIGH` | Exit 1 when severity ≥ this (`CRITICAL`/`HIGH`/`MEDIUM`/`LOW`/`NONE`) |
+| `--severity` | all | Comma-separated filter e.g. `HIGH,CRITICAL` |
+| `--service` | all | Comma-separated service filter e.g. `s3,rds` |
+| `--rule-id` | all | Specific rule IDs e.g. `CG-S3-001` |
+| `--rules-file` | none | Path to YAML custom rules file |
+| `--compliance` | off | Show CIS/SOC2/PCI-DSS tags in table output |
+
+## What it checks (v0.2)
+
+| Rule ID | Check | Severity | CIS | SOC2 | PCI-DSS |
+|---|---|---|---|---|---|
+| CG-S3-001 | S3 bucket is publicly accessible | CRITICAL | 2.1.5 | CC6.1 | 1.3 |
+| CG-S3-002 | S3 bucket missing default encryption | MEDIUM | 2.1.1 | CC6.7 | 3.4 |
+| CG-IAM-001 | IAM user has no MFA device | HIGH | 1.10 | CC6.1 | 8.3 |
+| CG-IAM-002 | Root account has no MFA | CRITICAL | 1.5 | CC6.1 | 8.3 |
+| CG-IAM-003 | Root account has active access keys | CRITICAL | 1.4 | CC6.3 | 7.1 |
+| CG-EC2-001 | Security group open to 0.0.0.0/0 or ::/0 | HIGH | 5.2 | CC6.6 | 1.2 |
+| CG-RDS-001 | RDS instance is publicly accessible | CRITICAL | 2.3.2 | CC6.1 | 1.3 |
+| CG-RDS-002 | RDS instance storage not encrypted | HIGH | 2.3.1 | CC6.7 | 3.4 |
+| CG-CT-001 | CloudTrail not enabled in region | HIGH | 3.1 | CC7.2 | 10.1 |
+| CG-CT-002 | No multi-region CloudTrail trail | MEDIUM | 3.1 | CC7.2 | — |
+| CG-KMS-001 | KMS CMK rotation disabled | MEDIUM | 3.7 | CC6.7 | 3.6 |
+| CG-LAMBDA-001 | Lambda function URL with no auth | HIGH | — | CC6.1 | 8.3 |
+
+> **Note:** Compliance tags are indicative starting points, not certified mappings.
+
+## Custom rules (YAML)
+
+Create a YAML file and pass it with `--rules-file`:
+
+```yaml
+- id: MY-S3-001
+  title: S3 bucket is not encrypted
+  severity: HIGH
+  resource_type: storage_bucket
+  conditions:
+    - field: encrypted
+      op: is_false
+  remediation: Enable SSE-KMS encryption on all buckets.
+  compliance:
+    - "CIS 2.1.1"
+```
+
+Supported `op` values: `equals`, `not_equals`, `contains`, `is_true`, `is_false`, `exists`.
+Use `field: metadata.<key>` to access nested metadata fields.
+
+## CI/CD integration
+
+```bash
+# Fail the pipeline if CRITICAL findings exist
+cloudglass scan --output json --fail-on CRITICAL | jq .
+
+# SARIF output for GitHub Code Scanning
+cloudglass scan --output sarif > results.sarif
+```
+
+## Required IAM permissions
+
+CloudGlass is **read-only**. Minimum managed policies:
+
+- `arn:aws:iam::aws:policy/SecurityAudit`
+- `arn:aws:iam::aws:policy/job-function/ViewOnlyAccess`
+
+Never grant this tool write permissions.
+
+## Architecture
+
+```
+collectors/   → pull raw resources from AWS APIs, normalize into Resource objects
+models.py     → the shared Resource schema (provider-agnostic)
+rules/        → checks that run against normalized resources
+engine.py     → matches resources to applicable rules, produces findings
+cli.py        → entrypoint: scan, collect, run rules, print results
+```
+
+## Roadmap
+
+- [ ] Azure collector (App Registration / Reader role)
+- [ ] GCP collector (Workload Identity Federation)
+- [ ] Additional services: EKS, ECS, SNS, SQS, Secrets Manager
+
+## License
+
+MIT

cloudglass-0.2.0.dist-info/RECORD

@@ -0,0 +1,19 @@
+cloudglass/__init__.py,sha256=kUR5RAFc7HCeiqdlX36dZOHkUI5wI6V_43RpEcD8b-0,22
+cloudglass/cli.py,sha256=dlAr__8bMTETW_0prPjy56vD3XEfOAc9OmvvxGnyQCg,13790
+cloudglass/engine.py,sha256=oJi3sBMMiMARZ0IfV4XjZfYVgZkiWYOen1JJW56QnCw,4995
+cloudglass/models.py,sha256=yWyG_fME6g2XUy5RW5N_zHg0HI64oTNwMkvYS392VUA,1011
+cloudglass/collectors/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+cloudglass/collectors/cloudtrail.py,sha256=TizBhNlGPLov_ohTJi6S-VXVL5d41wMi8Vuvktwz-yU,1613
+cloudglass/collectors/ec2.py,sha256=V93FoEi5cBpUnFmj7gryz-aKN1xXV8kdA1bUmnd5gMo,2193
+cloudglass/collectors/iam.py,sha256=eBykrXkHQlJxJgQsz8i_H2KSzfFdIkBPwloIOwcBDuQ,2504
+cloudglass/collectors/kms.py,sha256=g2R6IOfKmZMaNob-TsSEmTQx85xygxn5Dy4BV833xgw,2593
+cloudglass/collectors/lambda_.py,sha256=LXxymeWxYpaUwZuWJWwIoGXXpt-AHVUERf0rdE9EAxQ,2200
+cloudglass/collectors/rds.py,sha256=JvuiiLT-NwJ2aBi2MpWXSg6LTxQ2dHcZ-ZMUDrj6KJI,1794
+cloudglass/collectors/s3.py,sha256=cQYQhQrNldKpTrAsa74uT9M0hjv6IDKvrK_cN8YE1EM,2434
+cloudglass/rules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+cloudglass/rules/aws_rules.py,sha256=6lStsYt6WVY8jQg8LPyazmBTmMmYVtA4ymyNSIkBlg4,7393
+cloudglass-0.2.0.dist-info/METADATA,sha256=31Sojzp26sq9GVofdazMmMFuKjuHxSXsgxts0y1Z5DY,4125
+cloudglass-0.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+cloudglass-0.2.0.dist-info/entry_points.txt,sha256=1GcgGOlh6Vk8nkoK0hzZlwf4QRPMJtlQNm2Ctd5TdAE,51
+cloudglass-0.2.0.dist-info/top_level.txt,sha256=xwjKQUuVYcUUKGkhqSzbeWwrQ4QvJAUuyb9pekg0rR0,11
+cloudglass-0.2.0.dist-info/RECORD,,

cloudglass-0.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

cloudglass-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+cloudglass = cloudglass.cli:main

cloudglass-0.2.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+cloudglass