devguard 0.2.0__py3-none-any.whl

devguard/checkers/aws_cost.py

@@ -0,0 +1,331 @@
+"""AWS Cost monitoring checker."""
+
+import asyncio
+import json
+import logging
+from datetime import UTC, datetime, timedelta
+
+from devguard.checkers.base import BaseChecker
+from devguard.models import CheckResult, CostMetric, Finding, Severity
+
+logger = logging.getLogger(__name__)
+
+# Load budget config using utility module
+from devguard.utils import load_budget_config
+
+
+class AWSCostChecker(BaseChecker):
+    """Check AWS costs against budget thresholds."""
+
+    check_type = "aws_cost"
+
+    # Cost thresholds - loaded from ops/config/budget.yaml if available, else use defaults
+    # Defaults match ops/scripts/infra/check-cost-spend-ceiling.sh
+    _budget_config = load_budget_config()
+    DAILY_THRESHOLD = _budget_config.get("daily_warn", 5.0)  # Alert if daily spend exceeds this
+
+    # Instance allowlist loaded from settings (AWS_ALLOWED_INSTANCES env var)
+
+    async def check(self) -> CheckResult:
+        """Check AWS costs and resource compliance."""
+        cost_metrics: list[CostMetric] = []
+        findings: list[Finding] = []
+        errors: list[str] = []
+        metadata: dict = {}
+
+        # Check MTD costs
+        mtd_result = await self._get_mtd_cost()
+        if mtd_result.get("error"):
+            errors.append(mtd_result["error"])
+        else:
+            mtd_cost = mtd_result.get("cost", 0.0)
+            metadata["mtd_cost"] = mtd_cost
+
+            cost_metrics.append(
+                CostMetric(
+                    service="aws",
+                    period="monthly",
+                    amount=mtd_cost,
+                )
+            )
+
+            # Check against ceiling (configurable via settings, with fallback to budget.yaml)
+            budget_config = load_budget_config()
+            monthly_ceiling = self.settings.aws_monthly_cost_ceiling
+            # Override with budget.yaml if it exists and setting is still default
+            if monthly_ceiling == 100.0 and budget_config.get("monthly_ceiling"):
+                monthly_ceiling = budget_config["monthly_ceiling"]
+            if mtd_cost > monthly_ceiling:
+                findings.append(
+                    Finding(
+                        severity=Severity.CRITICAL,
+                        title=f"AWS monthly ceiling exceeded: ${mtd_cost:.2f}",
+                        description=f"MTD spend ${mtd_cost:.2f} exceeds ceiling ${monthly_ceiling:.2f}",
+                        resource="aws-cost",
+                        remediation="Review and reduce AWS resource usage immediately, or update aws_monthly_cost_ceiling if this is expected",
+                    )
+                )
+            elif mtd_cost > monthly_ceiling * 0.8:
+                findings.append(
+                    Finding(
+                        severity=Severity.WARNING,
+                        title=f"AWS costs approaching ceiling: ${mtd_cost:.2f}",
+                        description=f"MTD spend ${mtd_cost:.2f} is at {(mtd_cost / monthly_ceiling) * 100:.0f}% of ceiling ${monthly_ceiling:.2f}",
+                        resource="aws-cost",
+                        remediation="Monitor spending closely",
+                    )
+                )
+
+        # Check yesterday's cost
+        yesterday_result = await self._get_yesterday_cost()
+        if yesterday_result.get("error"):
+            errors.append(yesterday_result["error"])
+        else:
+            yesterday_cost = yesterday_result.get("cost", 0.0)
+            metadata["yesterday_cost"] = yesterday_cost
+
+            cost_metrics.append(
+                CostMetric(
+                    service="aws",
+                    period="daily",
+                    amount=yesterday_cost,
+                )
+            )
+
+            if yesterday_cost > self.DAILY_THRESHOLD:
+                findings.append(
+                    Finding(
+                        severity=Severity.WARNING,
+                        title=f"High daily AWS spend: ${yesterday_cost:.2f}",
+                        description=f"Yesterday's spend ${yesterday_cost:.2f} exceeds threshold ${self.DAILY_THRESHOLD:.2f}",
+                        resource="aws-cost",
+                        remediation="Review Cost Explorer for unexpected charges",
+                    )
+                )
+
+        # Check S3-specific costs
+        s3_result = await self._get_s3_costs()
+        if s3_result.get("error"):
+            errors.append(s3_result["error"])
+        else:
+            s3_cost = s3_result.get("cost", 0.0)
+            metadata["s3_cost"] = s3_cost
+
+            cost_metrics.append(
+                CostMetric(
+                    service="s3",
+                    period="monthly",
+                    amount=s3_cost,
+                )
+            )
+
+            # Alert if S3 costs exceed $10/month (unusual for our usage)
+            if s3_cost > 10.0:
+                findings.append(
+                    Finding(
+                        severity=Severity.WARNING,
+                        title=f"High S3 costs: ${s3_cost:.2f}/month",
+                        description=f"S3 MTD cost ${s3_cost:.2f} exceeds expected threshold. Review storage usage, lifecycle policies, and request patterns.",
+                        resource="s3-cost",
+                        remediation="Review S3 storage classes, lifecycle policies, and list_objects_v2 call frequency",
+                    )
+                )
+
+        # Check running instances against allowlist
+        instances_result = await self._check_running_instances()
+        if instances_result.get("error"):
+            errors.append(instances_result["error"])
+        else:
+            running = instances_result.get("instances", [])
+            metadata["running_instances"] = running
+
+            allowed = set(self.settings.aws_allowed_instances)
+            unauthorized = [i for i in running if allowed and i not in allowed]
+            if unauthorized:
+                findings.append(
+                    Finding(
+                        severity=Severity.CRITICAL,
+                        title=f"Unauthorized EC2 instances running: {unauthorized}",
+                        description=f"Instances not in allowlist: {unauthorized}",
+                        resource="ec2-instances",
+                        remediation="Terminate unauthorized instances or add to allowlist",
+                    )
+                )
+
+        return CheckResult(
+            check_type=self.check_type,
+            success=len(errors) == 0 and not any(f.severity == Severity.CRITICAL for f in findings),
+            findings=findings,
+            cost_metrics=cost_metrics,
+            errors=errors,
+            metadata=metadata,
+        )
+
+    async def _get_mtd_cost(self) -> dict:
+        """Get month-to-date AWS cost."""
+        try:
+            now = datetime.now(UTC)
+            start_date = now.replace(day=1).strftime("%Y-%m-%d")
+            end_date = now.strftime("%Y-%m-%d")
+
+            proc = await asyncio.create_subprocess_exec(
+                "aws",
+                "ce",
+                "get-cost-and-usage",
+                "--time-period",
+                f"Start={start_date},End={end_date}",
+                "--granularity",
+                "MONTHLY",
+                "--metrics",
+                "UnblendedCost",
+                "--output",
+                "json",
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+            )
+            stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=30.0)
+
+            if proc.returncode != 0:
+                return {"error": f"aws ce command failed: {stderr.decode()}"}
+
+            data = json.loads(stdout.decode())
+            results = data.get("ResultsByTime", [])
+            if results:
+                amount = results[0].get("Total", {}).get("UnblendedCost", {}).get("Amount", "0")
+                return {"cost": float(amount)}
+            return {"cost": 0.0}
+
+        except TimeoutError:
+            return {"error": "AWS CLI timeout"}
+        except FileNotFoundError:
+            return {"error": "aws CLI not found"}
+        except Exception as e:
+            return {"error": str(e)}
+
+    async def _get_yesterday_cost(self) -> dict:
+        """Get yesterday's AWS cost."""
+        try:
+            now = datetime.now(UTC)
+            yesterday = now - timedelta(days=1)
+            start_date = yesterday.strftime("%Y-%m-%d")
+            end_date = now.strftime("%Y-%m-%d")
+
+            proc = await asyncio.create_subprocess_exec(
+                "aws",
+                "ce",
+                "get-cost-and-usage",
+                "--time-period",
+                f"Start={start_date},End={end_date}",
+                "--granularity",
+                "DAILY",
+                "--metrics",
+                "UnblendedCost",
+                "--output",
+                "json",
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+            )
+            stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=30.0)
+
+            if proc.returncode != 0:
+                return {"error": f"aws ce command failed: {stderr.decode()}"}
+
+            data = json.loads(stdout.decode())
+            results = data.get("ResultsByTime", [])
+            if results:
+                amount = results[0].get("Total", {}).get("UnblendedCost", {}).get("Amount", "0")
+                return {"cost": float(amount)}
+            return {"cost": 0.0}
+
+        except TimeoutError:
+            return {"error": "AWS CLI timeout"}
+        except FileNotFoundError:
+            return {"error": "aws CLI not found"}
+        except Exception as e:
+            return {"error": str(e)}
+
+    async def _get_s3_costs(self) -> dict:
+        """Get S3-specific costs for current month."""
+        try:
+            now = datetime.now(UTC)
+            start_date = now.replace(day=1).strftime("%Y-%m-%d")
+            end_date = now.strftime("%Y-%m-%d")
+
+            proc = await asyncio.create_subprocess_exec(
+                "aws",
+                "ce",
+                "get-cost-and-usage",
+                "--time-period",
+                f"Start={start_date},End={end_date}",
+                "--granularity",
+                "MONTHLY",
+                "--metrics",
+                "UnblendedCost",
+                "--group-by",
+                "Type=DIMENSION,Key=SERVICE",
+                "--filter",
+                '{"Dimensions":{"Key":"SERVICE","Values":["Amazon Simple Storage Service"]}}',
+                "--output",
+                "json",
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+            )
+            stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=30.0)
+
+            if proc.returncode != 0:
+                return {"error": f"aws ce command failed: {stderr.decode()}"}
+
+            data = json.loads(stdout.decode())
+            results = data.get("ResultsByTime", [])
+            if results:
+                # Extract S3 cost from grouped results
+                groups = results[0].get("Groups", [])
+                for group in groups:
+                    keys = group.get("Keys", [])
+                    if any("Simple Storage Service" in k for k in keys):
+                        amount = (
+                            group.get("Metrics", {}).get("UnblendedCost", {}).get("Amount", "0")
+                        )
+                        return {"cost": float(amount)}
+                # If no S3 group found, cost is 0
+                return {"cost": 0.0}
+            return {"cost": 0.0}
+
+        except TimeoutError:
+            return {"error": "AWS CLI timeout"}
+        except FileNotFoundError:
+            return {"error": "aws CLI not found"}
+        except Exception as e:
+            return {"error": str(e)}
+
+    async def _check_running_instances(self) -> dict:
+        """Check which EC2 instances are running."""
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                "aws",
+                "ec2",
+                "describe-instances",
+                "--filters",
+                "Name=instance-state-name,Values=running",
+                "--query",
+                "Reservations[].Instances[].Tags[?Key==`Name`].Value[]",
+                "--output",
+                "json",
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+            )
+            stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=30.0)
+
+            if proc.returncode != 0:
+                return {"error": f"aws ec2 command failed: {stderr.decode()}"}
+
+            instances = json.loads(stdout.decode())
+            # AWS CLI returns a flat list of instance names
+            return {"instances": instances if isinstance(instances, list) else []}
+
+        except TimeoutError:
+            return {"error": "AWS CLI timeout"}
+        except FileNotFoundError:
+            return {"error": "aws CLI not found"}
+        except Exception as e:
+            return {"error": str(e)}

devguard/checkers/aws_iam.py

@@ -0,0 +1,284 @@
+"""AWS IAM security checker for satellite nodes."""
+
+import asyncio
+import json
+import logging
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from devguard.checkers.base import BaseChecker
+from devguard.config import Settings
+from devguard.models import CheckResult, Finding, Severity
+
+logger = logging.getLogger(__name__)
+
+
+def load_iam_posture(path: Path | None = None) -> dict[str, Any]:
+    """Load IAM posture configuration from YAML file."""
+    if path is None:
+        from devguard.utils import get_iam_posture_path
+
+        path = get_iam_posture_path()
+        if path is None:
+            return {}
+
+    if path.exists():
+        try:
+            with open(path) as f:
+                return yaml.safe_load(f)
+        except Exception as e:
+            logger.warning(f"Failed to load IAM posture config: {e}")
+    return {}
+
+
+class AWSIAMChecker(BaseChecker):
+    """Check AWS IAM posture for satellite nodes.
+
+    Loads configuration from ops/security/iam-posture.yaml which defines:
+    - Satellite nodes and their IAM roles
+    - Forbidden policy patterns
+    - Security rules to enforce
+    """
+
+    check_type = "aws_iam"
+
+    # Policies that should NEVER be attached to satellite nodes
+    FORBIDDEN_POLICIES = [
+        "AdministratorAccess",
+        "AmazonS3FullAccess",
+        "AmazonS3ReadOnlyAccess",
+        "PowerUserAccess",
+        "IAMFullAccess",
+    ]
+
+    def __init__(self, settings: Settings):
+        super().__init__(settings)
+        self.posture = load_iam_posture()
+        self._init_from_posture()
+
+    def _init_from_posture(self) -> None:
+        """Initialize checker configuration from posture YAML."""
+        self.satellite_nodes: dict[str, dict[str, str]] = {}
+
+        satellites = self.posture.get("satellite_nodes", {})
+        for node_name, node_config in satellites.items():
+            self.satellite_nodes[node_name] = {
+                "role": node_config.get("role", ""),
+                "instance_id": node_config.get("instance_id", ""),
+                "purpose": node_config.get("purpose", ""),
+            }
+
+        if not self.satellite_nodes:
+            logger.info("No satellite nodes in posture config -- IAM check will be a no-op")
+
+    async def check(self) -> CheckResult:
+        """Check IAM roles for security issues."""
+        findings: list[Finding] = []
+        errors: list[str] = []
+        metadata: dict[str, Any] = {
+            "nodes_checked": [],
+            "posture_config": bool(self.posture),
+        }
+
+        for node_name, node_config in self.satellite_nodes.items():
+            role_name = node_config["role"]
+            instance_id = node_config["instance_id"]
+
+            try:
+                # Get attached policies using async subprocess
+                policies, error = await self._run_aws_command(
+                    [
+                        "aws",
+                        "iam",
+                        "list-attached-role-policies",
+                        "--role-name",
+                        role_name,
+                        "--query",
+                        "AttachedPolicies[].PolicyName",
+                        "--output",
+                        "json",
+                    ]
+                )
+
+                if error:
+                    findings.append(
+                        Finding(
+                            severity=Severity.LOW,
+                            title=f"Cannot check role: {role_name}",
+                            description=f"Failed to query IAM for {node_name}: {error}",
+                            resource=role_name,
+                            remediation="Verify AWS CLI is configured and has iam:ListAttachedRolePolicies permission",
+                            metadata={"node": node_name, "instance_id": instance_id},
+                        )
+                    )
+                    continue
+
+                node_info = {
+                    "node": node_name,
+                    "role": role_name,
+                    "instance_id": instance_id,
+                    "policies": policies,
+                }
+
+                # Check for forbidden policies
+                for policy in policies:
+                    if policy in self.FORBIDDEN_POLICIES:
+                        findings.append(
+                            Finding(
+                                severity=Severity.CRITICAL,
+                                title=f"Overly broad policy on {node_name}",
+                                description=(
+                                    f"Role '{role_name}' has '{policy}' attached. "
+                                    f"This violates least-privilege principle for satellite nodes."
+                                ),
+                                resource=role_name,
+                                remediation=f"Replace {policy} with a scoped custom policy (see ops/security/iam-posture.yaml)",
+                                metadata={
+                                    "policy": policy,
+                                    "node": node_name,
+                                    "instance_id": instance_id,
+                                },
+                            )
+                        )
+
+                # Check inline policies
+                inline_policies, _ = await self._run_aws_command(
+                    [
+                        "aws",
+                        "iam",
+                        "list-role-policies",
+                        "--role-name",
+                        role_name,
+                        "--query",
+                        "PolicyNames",
+                        "--output",
+                        "json",
+                    ]
+                )
+
+                if inline_policies:
+                    node_info["inline_policies"] = inline_policies
+
+                metadata["nodes_checked"].append(node_info)
+
+            except TimeoutError:
+                findings.append(
+                    Finding(
+                        severity=Severity.LOW,
+                        title=f"Timeout checking role: {role_name}",
+                        description=f"AWS IAM query timed out for {node_name}",
+                        resource=role_name,
+                        remediation="Check network connectivity and AWS CLI configuration",
+                        metadata={"node": node_name},
+                    )
+                )
+            except json.JSONDecodeError as e:
+                findings.append(
+                    Finding(
+                        severity=Severity.LOW,
+                        title=f"Parse error for role: {role_name}",
+                        description=f"Could not parse IAM response: {e}",
+                        resource=role_name,
+                        remediation="Verify AWS CLI output format",
+                        metadata={"node": node_name},
+                    )
+                )
+
+        # Check for credentials on nodes via SSM (if enabled)
+        if self.posture:
+            await self._check_node_credentials(findings, metadata)
+
+        # success = no critical findings
+        critical_count = sum(1 for f in findings if f.severity == Severity.CRITICAL)
+
+        return CheckResult(
+            check_type=self.check_type,
+            success=critical_count == 0,
+            findings=findings,
+            errors=errors,
+            metadata=metadata,
+        )
+
+    async def _run_aws_command(
+        self, cmd: list[str], timeout: float = 30.0
+    ) -> tuple[list[str], str | None]:
+        """Run an AWS CLI command asynchronously and return parsed JSON or error."""
+        proc = None
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                *cmd,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+            )
+            stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=timeout)
+
+            if proc.returncode != 0:
+                return [], stderr.decode().strip()
+
+            return json.loads(stdout.decode().strip()), None
+
+        except TimeoutError:
+            if proc:
+                try:
+                    proc.kill()
+                    await proc.wait()
+                except ProcessLookupError:
+                    pass
+            raise
+        except json.JSONDecodeError:
+            raise
+        except Exception as e:
+            return [], str(e)
+
+    async def _check_node_credentials(
+        self, findings: list[Finding], metadata: dict[str, Any]
+    ) -> None:
+        """Check satellite nodes for credential files via SSM."""
+        metadata["ssm_checks"] = {}
+
+        for node_name, node_config in self.satellite_nodes.items():
+            instance_id = node_config.get("instance_id")
+            if not instance_id:
+                continue
+
+            try:
+                # Send SSM command to check for credentials
+                cmd = [
+                    "aws",
+                    "ssm",
+                    "send-command",
+                    "--instance-ids",
+                    instance_id,
+                    "--document-name",
+                    "AWS-RunShellScript",
+                    "--parameters",
+                    'commands=["ls /root/.aws/credentials /home/*/.aws/credentials 2>/dev/null && echo FOUND || echo CLEAN"]',
+                    "--query",
+                    "Command.CommandId",
+                    "--output",
+                    "text",
+                ]
+
+                proc = await asyncio.create_subprocess_exec(
+                    *cmd,
+                    stdout=asyncio.subprocess.PIPE,
+                    stderr=asyncio.subprocess.PIPE,
+                )
+                stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=30.0)
+
+                if proc.returncode != 0:
+                    # SSM not available, skip but note it
+                    metadata["ssm_checks"][node_name] = "unavailable"
+                    continue
+
+                # Note: Full implementation would wait and get results
+                # For now, we record that check was attempted
+                metadata["ssm_checks"][node_name] = "initiated"
+
+            except TimeoutError:
+                metadata["ssm_checks"][node_name] = "timeout"
+            except Exception as e:
+                logger.debug(f"SSM check failed for {node_name}: {e}")
+                metadata["ssm_checks"][node_name] = "error"

devguard/checkers/base.py

@@ -0,0 +1,25 @@
+"""Base checker interface."""
+
+from abc import ABC, abstractmethod
+
+from devguard.config import Settings
+from devguard.models import CheckResult
+
+
+class BaseChecker(ABC):
+    """Base class for all checkers."""
+
+    def __init__(self, settings: Settings):
+        """Initialize checker with settings."""
+        self.settings = settings
+
+    @abstractmethod
+    async def check(self) -> CheckResult:
+        """Perform the check and return results."""
+        pass
+
+    @property
+    @abstractmethod
+    def check_type(self) -> str:
+        """Return the type of check this checker performs."""
+        pass