driftwatch-cli 0.1.0__py3-none-any.whl

driftwatch_cli-0.1.0.dist-info/METADATA

@@ -0,0 +1,165 @@
+Metadata-Version: 2.4
+Name: driftwatch-cli
+Version: 0.1.0
+Summary: CLI tool that detects Terraform infrastructure drift against live AWS, explains it with AI, and guides remediation.
+Author: Nitin Gupta
+License: MIT
+Project-URL: Homepage, https://github.com/hastagnitin/driftwatch
+Project-URL: Repository, https://github.com/hastagnitin/driftwatch
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: boto3>=1.34.0
+Requires-Dist: typer>=0.9.0
+Requires-Dist: groq>=0.4.0
+Requires-Dist: python-telegram-bot>=20.0
+Requires-Dist: psycopg2-binary>=2.9.0
+Requires-Dist: requests>=2.31.0
+Requires-Dist: python-dotenv>=1.0.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.0.0; extra == "dev"
+Requires-Dist: moto[all]>=5.0.0; extra == "dev"
+Requires-Dist: build; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Dynamic: license-file
+
+# DriftWatch 🛡️
+
+**DriftWatch** is a production-ready CLI tool and automation engine that detects Terraform infrastructure drift against live AWS environments, explains the security and reliability impact using AI, and safely guides remediation.
+
+---
+
+## 🚀 Key Features
+
+- **Multi-Resource Drift Detection**: Continuously monitors and compares EC2 instances, S3 buckets, Security Groups, RDS databases, Lambda functions, and IAM roles against your Terraform state.
+- **Data-Driven Severity Scoring**: Evaluates changes dynamically at the attribute level (e.g. security group open ports vs description updates) to classify drifts as `CRITICAL`, `HIGH`, `MEDIUM`, or `LOW`.
+- **AI-Powered Risk Summaries**: Integrates with LLMs to provide plain-English security analysis and compliance impact assessments.
+- **Deterministic IaC Remediation**: Recommends safe, template-generated `terraform import` and `terraform apply` commands rather than hallucinated AI outputs.
+- **Guarded Auto-Remediation**: Pre-flight validation checks for EC2 (EBS verification, Spot skip, running state), RDS maintenance-window defaults, and explicit interactive confirmations.
+- **Multi-Channel Alerting**: Instant notifications via Telegram, Slack, and Email.
+- **CI/CD Quality Gate**: Built-in GitHub Actions integration to enforce zero-tolerance drift policies in pull requests.
+
+---
+
+## 🏛️ Architecture Overview
+
+```
+driftwatch/
+├── drift_engine/              # Core drift detection & reconciliation engine
+│   ├── aws_client.py         # Live AWS resource discovery (boto3)
+│   ├── core.py               # Diff evaluation & data-driven severity engine
+│   ├── database.py           # PostgreSQL scan history recorder
+│   ├── explain.py            # AI risk summaries & deterministic IaC templates
+│   ├── models.py             # Data models & attribute severity tables
+│   ├── notifications.py      # Alert dispatcher (Telegram, Slack, Email)
+│   ├── remediation.py        # Guarded auto-remediation handlers
+│   └── tf_parser.py          # Terraform state JSON parser
+├── driftwatch/               # CLI Entrypoint (Typer)
+│   └── cli.py                # Command definitions: scan, explain, remediate
+├── terraform/                # Example infrastructure and state configuration
+├── kubernetes/               # Kubernetes CronJob deployment
+└── tests/                    # Comprehensive unit tests with moto AWS mocks
+```
+
+---
+
+## 📋 Prerequisites
+
+- **Python**: `>= 3.10`
+- **AWS Credentials**: Configured via environment variables, IAM roles, or AWS CLI credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_DEFAULT_REGION`).
+- **Terraform State File**: Local JSON state or remote state (`terraform.tfstate`).
+- **PostgreSQL** *(Optional)*: For persistent scan audit history.
+- **Groq API Key** *(Optional)*: `GROQ_API_KEY` for AI risk explanations.
+
+---
+
+## 📦 Installation
+
+### From Source (Local Development)
+```bash
+git clone https://github.com/hastagnitin/driftwatch.git
+cd driftwatch
+pip install -e .[dev]
+```
+
+---
+
+## ⚙️ Configuration
+
+Create a `.env` file in the root directory:
+
+```env
+AWS_DEFAULT_REGION=ap-south-1
+TF_STATE_PATH=terraform/terraform.tfstate
+
+# Optional: AI Risk Summaries
+GROQ_API_KEY=your_groq_api_key
+
+# Optional: Notifications
+SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
+TELEGRAM_BOT_TOKEN=your_telegram_bot_token
+TELEGRAM_CHAT_ID=your_telegram_chat_id
+
+# Optional: PostgreSQL Database
+DB_HOST=localhost
+DB_PORT=5432
+DB_NAME=driftwatch
+DB_USER=postgres
+DB_PASSWORD=your_db_password
+```
+
+---
+
+## 💻 Usage & CLI Commands
+
+### 1. Scan for Drift
+Scan live AWS infrastructure against your Terraform state:
+```bash
+# Basic scan
+driftwatch scan --region ap-south-1 --state terraform/terraform.tfstate
+
+# Enforce CI Gate (fails build if CRITICAL drift is found)
+driftwatch scan --region ap-south-1 --fail-on CRITICAL
+```
+
+### 2. Explain Drift
+Generate AI risk analysis and deterministic IaC fix recommendations:
+```bash
+driftwatch explain sg-0123456789abcdef0 --region ap-south-1
+```
+
+### 3. Remediate Drift
+Safely remediate drifted resources back to IaC specifications:
+```bash
+# Dry run mode (default)
+driftwatch remediate sg-0123456789abcdef0 --region ap-south-1 --dry-run
+
+# Apply mode with interactive confirmation
+driftwatch remediate sg-0123456789abcdef0 --region ap-south-1 --apply
+```
+
+---
+
+## ⚠️ Security & Safety Guidelines
+
+> [!WARNING]
+> **Auto-Remediation Safety**:
+> - Automated drift remediation is intended for **Development** and **Staging** environments.
+> - In **Production**, DriftWatch enforces manual confirmation prompts (`confirm_action()`) and recommends template-generated `terraform apply` / `terraform import` workflows.
+> - RDS modifications default to maintenance windows (`ApplyImmediately=False`) to avoid unplanned reboots.
+
+---
+
+## 🧪 Testing
+
+Run the test suite with test coverage:
+```bash
+pytest tests/ -v --cov=drift_engine --cov=driftwatch --cov-report=term-missing
+```
+
+---
+
+## 📄 License
+
+This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.

driftwatch_cli-0.1.0.dist-info/RECORD

@@ -0,0 +1,17 @@
+drift_engine/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+drift_engine/aws_client.py,sha256=-HlFZBskOkKk9Itug6Z8WIO4-Um_0efXACdZZdQ45gw,9743
+drift_engine/core.py,sha256=QyQnaNAbjou_EhIK_iwZ2gAEYFJXYZjYW9xrpwamXIY,6483
+drift_engine/database.py,sha256=6pSgmSnDx42dcnzCU7PgE3Dea1YzLAqe05gOA9i6eKI,1813
+drift_engine/explain.py,sha256=MwdlWHHMRC9jqZPsagxa4OXSpN_Ag2nZSRMgfgSsjRA,3011
+drift_engine/models.py,sha256=A5oSeXiG4SY8j322FNGZPFe4IOfKniNcCozEltQubqM,1818
+drift_engine/notifications.py,sha256=_DHdXKYYVsaSPTAKtpSmnrEQWGmvzmJycZ8afWdW5HU,4170
+drift_engine/remediation.py,sha256=WQs4QRrvaQzTGRs0LJ2yxDRyILJPgJ69igcdC0yQIy0,14307
+drift_engine/tf_parser.py,sha256=rNJh599REEmvM9eHHoQFJ4hqOZ4U0ZoQ4TKIkk6fdIU,2891
+driftwatch/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+driftwatch/cli.py,sha256=sCJCj5UTpezP2v4WZnIY-fGmdWo79dCd7nh2sH3HMrE,8110
+driftwatch_cli-0.1.0.dist-info/licenses/LICENSE,sha256=ItNresBCeEWpUoZYaunXiqE6MQvpXlobydKTroNviLQ,1068
+driftwatch_cli-0.1.0.dist-info/METADATA,sha256=3Xd0UQfnuNsSEmF_iacfFzFZNXe4a-D_pi0sLle9mfw,6107
+driftwatch_cli-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+driftwatch_cli-0.1.0.dist-info/entry_points.txt,sha256=lr6se5fEsOxPcWRmBIapnQMptHzZEryk6VdCy_oAq-Q,50
+driftwatch_cli-0.1.0.dist-info/top_level.txt,sha256=xp0kkk7SQJ2Q9fa3BR-MWAgp3kheLeb_xqE1INy6O10,24
+driftwatch_cli-0.1.0.dist-info/RECORD,,

driftwatch_cli-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

driftwatch_cli-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+driftwatch = driftwatch.cli:app

driftwatch_cli-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nitin Gupta
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

driftwatch_cli-0.1.0.dist-info/top_level.txt

@@ -0,0 +1,2 @@
+drift_engine
+driftwatch