driftwatch-cli 3.0.0__tar.gz

driftwatch_cli-3.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nitin Gupta
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

driftwatch_cli-3.0.0/PKG-INFO

@@ -0,0 +1,13 @@
+Metadata-Version: 2.4
+Name: driftwatch-cli
+Version: 3.0.0
+Summary: CLI tool that detects Terraform infrastructure drift against live AWS, explains it with AI, and guides remediation.
+Requires-Python: >=3.10
+License-File: LICENSE
+Requires-Dist: boto3
+Requires-Dist: typer
+Requires-Dist: groq
+Requires-Dist: python-telegram-bot
+Requires-Dist: psycopg2-binary
+Requires-Dist: requests
+Dynamic: license-file

driftwatch_cli-3.0.0/drift_engine/aws_client.py

@@ -0,0 +1,217 @@
+import boto3
+from datetime import datetime, timedelta
+
+def fetch_live_ec2_instances(region: str) -> dict:
+    ec2 = boto3.client("ec2", region_name=region)
+    live = {}
+    paginator = ec2.get_paginator("describe_instances")
+    
+    for page in paginator.paginate():
+        for reservation in page["Reservations"]:
+            for instance in reservation["Instances"]:
+                if instance["State"]["Name"] == "terminated":
+                    continue
+                
+                tags_list = instance.get("Tags", [])
+                tags_dict = {t["Key"]: t["Value"] for t in tags_list}
+                name = tags_dict.get("Name", "Unknown")
+                
+                sg_ids = []
+                for sg in instance.get("SecurityGroups", []):
+                    sg_ids.append(sg.get("GroupId"))
+                sg_ids.sort()
+                
+                live[instance["InstanceId"]] = {
+                    "type": "aws_instance",
+                    "name": name,
+                    "attributes": {
+                        "id": instance["InstanceId"],
+                        "instance_type": instance["InstanceType"],
+                        "ami": instance["ImageId"],
+                        "tags": tags_dict,
+                        "vpc_security_group_ids": sg_ids
+                    },
+                }
+    return live
+
+def fetch_live_s3_buckets(region: str) -> dict:
+    s3 = boto3.client("s3", region_name=region)
+    live = {}
+    try:
+        response = s3.list_buckets()
+        for bucket in response.get("Buckets", []):
+            bucket_name = bucket["Name"]
+            try:
+                tags_response = s3.get_bucket_tagging(Bucket=bucket_name)
+                tags_list = tags_response.get("TagSet", [])
+                tags_dict = {t["Key"]: t["Value"] for t in tags_list}
+                name = tags_dict.get("Name", bucket_name)
+            except Exception:
+                tags_dict = {}
+                name = bucket_name
+
+            live[bucket_name] = {
+                "type": "aws_s3_bucket",
+                "name": name,
+                "attributes": {
+                    "id": bucket_name,
+                    "bucket": bucket_name,
+                    "tags": tags_dict,
+                },
+            }
+    except Exception as e:
+        pass
+    return live
+
+def fetch_live_security_groups(region: str) -> dict:
+    ec2 = boto3.client("ec2", region_name=region)
+    live = {}
+    paginator = ec2.get_paginator("describe_security_groups")
+    
+    try:
+        for page in paginator.paginate():
+            for sg in page["SecurityGroups"]:
+                sg_id = sg["GroupId"]
+                sg_name = sg["GroupName"]
+                
+                tags_list = sg.get("Tags", [])
+                tags_dict = {t["Key"]: t["Value"] for t in tags_list}
+                name_tag = tags_dict.get("Name", sg_name)
+                
+                ingress_rules = []
+                for perm in sg.get("IpPermissions", []):
+                    cidrs = [ip.get("CidrIp") for ip in perm.get("IpRanges", []) if ip.get("CidrIp")]
+                    if cidrs:
+                        ingress_rules.append({
+                            "from_port": perm.get("FromPort", 0),
+                            "to_port": perm.get("ToPort", 0),
+                            "protocol": perm.get("IpProtocol", "-1"),
+                            "cidr_blocks": cidrs
+                        })
+                
+                egress_rules = []
+                for perm in sg.get("IpPermissionsEgress", []):
+                    cidrs = [ip.get("CidrIp") for ip in perm.get("IpRanges", []) if ip.get("CidrIp")]
+                    if cidrs:
+                        egress_rules.append({
+                            "from_port": perm.get("FromPort", 0),
+                            "to_port": perm.get("ToPort", 0),
+                            "protocol": perm.get("IpProtocol", "-1"),
+                            "cidr_blocks": cidrs
+                        })
+                
+                live[sg_id] = {
+                    "type": "aws_security_group",
+                    "name": name_tag,
+                    "attributes": {
+                        "id": sg_id,
+                        "name": sg_name,
+                        "description": sg.get("Description", ""),
+                        "tags": tags_dict,
+                        "ingress": ingress_rules,
+                        "egress": egress_rules,
+                    },
+                }
+    except Exception as e:
+        pass
+    return live
+
+def fetch_live_rds_instances(region: str = "ap-south-1") -> dict:
+    rds = boto3.client("rds", region_name=region)
+    live = {}
+    paginator = rds.get_paginator("describe_db_instances")
+    try:
+        for page in paginator.paginate():
+            for db in page["DBInstances"]:
+                db_id = db.get("DbiResourceId") 
+                db_name = db["DBInstanceIdentifier"]
+                if not db_id:
+                    continue
+                live[db_id] = {
+                    "type": "aws_db_instance",
+                    "name": db_name,
+                    "attributes": {
+                        "id": db_id,
+                        "allocated_storage": db.get("AllocatedStorage"),
+                        "engine": db.get("Engine"),
+                        "engine_version": db.get("EngineVersion"),
+                        "instance_class": db.get("DBInstanceClass"),
+                        "multi_az": db.get("MultiAZ"),
+                    },
+                }
+    except Exception as e:
+        pass
+    return live
+
+def fetch_live_lambda_functions(region: str = "ap-south-1") -> dict:
+    lambda_client = boto3.client("lambda", region_name=region)
+    live = {}
+    paginator = lambda_client.get_paginator("list_functions")
+    try:
+        for page in paginator.paginate():
+            for func in page["Functions"]:
+                func_name = func["FunctionName"]
+                live[func_name] = {
+                    "type": "aws_lambda_function",
+                    "name": func_name,
+                    "attributes": {
+                        "id": func_name,
+                        "function_name": func_name,
+                        "runtime": func.get("Runtime"),
+                        "handler": func.get("Handler"),
+                        "memory_size": func.get("MemorySize"),
+                        "timeout": func.get("Timeout"),
+                        "role": func.get("Role"),
+                    },
+                }
+    except Exception as e:
+        pass
+    return live
+
+def fetch_live_iam_roles(region: str = "ap-south-1") -> dict:
+    iam = boto3.client("iam", region_name=region)
+    live = {}
+    try:
+        paginator = iam.get_paginator("list_roles")
+        for page in paginator.paginate():
+            for role in page["Roles"]:
+                role_name = role["RoleName"]
+                if role_name.startswith("AWSServiceRoleFor") or role.get("Path", "").startswith("/aws-service-role/"):
+                    continue
+                live[role_name] = {
+                    "type": "aws_iam_role",
+                    "name": role_name,
+                    "attributes": {
+                        "id": role_name,
+                        "name": role_name,
+                        "arn": role["Arn"]
+                    }
+                }
+    except Exception as e:
+        pass
+    return live
+
+def get_resource_cost(resource_id: str) -> float:
+    try:
+        client = boto3.client("ce", region_name="us-east-1")
+        
+        end_date = datetime.today().strftime("%Y-%m-%d")
+        start_date = (datetime.today() - timedelta(days=30)).strftime("%Y-%m-%d")
+        
+        response = client.get_cost_and_usage(
+            TimePeriod={"Start": start_date, "End": end_date},
+            Granularity="MONTHLY",
+            Metrics=["UnblendedCost"],
+            Filter={
+                "Dimensions": {
+                    "Key": "RESOURCE_ID",
+                    "Values": [resource_id]
+                }
+            }
+        )
+        
+        usd_cost = float(response["ResultsByTime"][0]["Total"]["UnblendedCost"]["Amount"])
+        inr_cost = round(usd_cost * 83.5, 2)
+        return inr_cost
+    except Exception:
+        return 0.0

driftwatch_cli-3.0.0/drift_engine/core.py

@@ -0,0 +1,209 @@
+import os
+from datetime import datetime
+from models import DriftResult, DriftType, MONITORED_RESOURCES, MONITORED_ATTRIBUTES, IGNORED_ATTRIBUTES
+from tf_parser import load_terraform_state
+from aws_client import (
+    fetch_live_ec2_instances, fetch_live_s3_buckets,
+    fetch_live_security_groups, fetch_live_rds_instances,
+    fetch_live_lambda_functions, fetch_live_iam_roles,
+    get_resource_cost
+)
+from notifications import process_alerts, send_telegram_alert
+from database import save_drift_to_db
+from remediation import process_remediation
+from explain import get_drift_explanation
+
+def process_drift_results(resource_id, drift_status, ai_explanation=""):
+    if drift_status in ["MODIFIED", "UNMANAGED"]:
+        alert_msg = f"DRIFT ALERT\nResource: {resource_id}\nType: {drift_status}\nAction Required!\n\nAI Analysis:\n{ai_explanation}"
+        send_telegram_alert(alert_msg)
+
+def normalize_sg_rules(rules) -> list:
+    normalized = []
+    if not isinstance(rules, list):
+        return normalized
+        
+    for rule in rules:
+        if isinstance(rule, dict):
+            cidrs = rule.get('cidr_blocks') or []
+            if isinstance(cidrs, list):
+                cidrs = tuple(sorted(cidrs))
+            else:
+                cidrs = tuple()
+                
+            normalized.append({
+                'from_port': rule.get('from_port'),
+                'to_port': rule.get('to_port'),
+                'protocol': rule.get('protocol'),
+                'cidr_blocks': cidrs
+            })
+            
+    final_rules = []
+    for t in {tuple(sorted(d.items())) for d in normalized}:
+        rule_dict = dict(t)
+        rule_dict['cidr_blocks'] = list(rule_dict['cidr_blocks'])
+        final_rules.append(rule_dict)
+        
+    return final_rules
+
+def compare_attributes(tf, live, r_type) -> dict:
+    monitored = MONITORED_ATTRIBUTES.get(r_type, set())
+    diff = {}
+    
+    for key in monitored:
+        tf_val = tf.get(key)
+        live_val = live.get(key)
+        
+        if (tf_val in [None, "", [], {}]) and (live_val in [None, "", [], {}]):
+            continue
+            
+        if r_type == "aws_security_group" and key in ["ingress", "egress"]:
+            tf_norm = normalize_sg_rules(tf_val)
+            live_norm = normalize_sg_rules(live_val)
+            if tf_norm != live_norm:
+                diff[key] = {"terraform": tf_norm, "live": live_norm}
+        elif tf_val != live_val:
+            diff[key] = {"terraform": tf_val, "live": live_val}
+            
+    return diff
+
+def detect_drift(tf_state_path: str, region: str):
+    tf_resources = load_terraform_state(tf_state_path)
+    
+    if not tf_resources:
+        return [], 0
+        
+    live_ec2 = fetch_live_ec2_instances(region)
+    live_s3 = fetch_live_s3_buckets(region)
+    live_sg = fetch_live_security_groups(region)
+    live_rds = fetch_live_rds_instances(region)
+    live_lambda = fetch_live_lambda_functions(region)
+    live_iam = fetch_live_iam_roles(region)
+    
+    live_resources = {**live_ec2, **live_s3, **live_sg, **live_rds, **live_lambda, **live_iam}
+    
+    results = []
+    all_ids = set(tf_resources) | set(live_resources)
+    total_scanned = len(all_ids)
+    
+    for rid in all_ids:
+        in_tf = rid in tf_resources
+        in_live = rid in live_resources
+        
+        res_name = "Unknown"
+        if in_tf:
+            res_name = tf_resources[rid]["name"]
+        elif in_live:
+            res_name = live_resources[rid]["name"]
+            
+        if in_tf and not in_live:
+            results.append(DriftResult(
+                resource_type=tf_resources[rid]["type"],
+                resource_id=rid,
+                drift_type=DriftType.MISSING,
+                resource_name=res_name,
+                tf_attributes=tf_resources[rid]["attributes"]
+            ))
+        elif in_live and not in_tf:
+            results.append(DriftResult(
+                resource_type=live_resources[rid]["type"],
+                resource_id=rid,
+                drift_type=DriftType.UNMANAGED,
+                resource_name=res_name,
+                live_attributes=live_resources[rid]["attributes"]
+            ))
+        else:
+            diff = compare_attributes(
+                tf_resources[rid]["attributes"],
+                live_resources[rid]["attributes"],
+                tf_resources[rid]["type"]
+            )
+            if diff:
+                results.append(DriftResult(
+                    resource_type=tf_resources[rid]["type"],
+                    resource_id=rid,
+                    drift_type=DriftType.MODIFIED,
+                    resource_name=res_name,
+                    tf_attributes=tf_resources[rid]["attributes"],
+                    live_attributes=live_resources[rid]["attributes"],
+                    diff=diff
+                ))
+                
+    return results, total_scanned
+
+def get_severity(r_type, d_type):
+    if r_type in ["aws_security_group", "aws_iam_role"]:
+        return "CRITICAL"
+    if d_type == DriftType.MISSING or r_type == "aws_instance":
+        return "HIGH"
+    return "MEDIUM"
+
+def main():
+    tf_state_path = os.environ.get("TF_STATE_PATH", "terraform/terraform.tfstate")
+    region = os.environ.get("AWS_DEFAULT_REGION", "ap-south-1")
+    
+    try:
+        results, total_scanned = detect_drift(tf_state_path, region)
+        
+        current_time = datetime.now().strftime("%Y-%m-%d %H:%M:%S IST")
+        total_drift = len(results)
+        
+        print("\n=== DRIFTWATCH SCAN REPORT ===")
+        print(f"Scan time: {current_time} | Resources scanned: {total_scanned}\n")
+        
+        if not results:
+            print("No drift detected. Infrastructure matches IaC.")
+        else:
+            crit_count = 0
+            high_count = 0
+            
+            for r in results:
+                severity = get_severity(r.resource_type, r.drift_type)
+                
+                if severity == "CRITICAL":
+                    crit_count += 1
+                elif severity == "HIGH":
+                    high_count += 1
+                    
+                print(f"[{r.drift_type.value}] {r.resource_type}: {r.resource_id}")
+                
+                ai_text = ""
+                
+                if r.drift_type == DriftType.UNMANAGED and r.resource_type == "aws_instance":
+                    inst_type = r.live_attributes.get("instance_type", "unknown")
+                    cost = "{:,.2f}".format(get_resource_cost(r.resource_id))
+                    print(f"  Type: {inst_type} (created manually in console)")
+                    print(f"  Severity: {severity} | Cost: +Rs.{cost}/month (untracked)")
+                    
+                    ai_text = get_drift_explanation(r.resource_type, r.resource_id, r.live_attributes, r.drift_type.value)
+                    
+                elif r.diff:
+                    for attr, vals in r.diff.items():
+                        print(f"  Attribute: {attr}")
+                        print(f"  Terraform: {vals['terraform']}")
+                        print(f"  Live AWS:  {vals['live']}")
+                    print(f"  Severity: {severity}")
+                    
+                    ai_text = get_drift_explanation(r.resource_type, r.resource_id, r.diff, r.drift_type.value)
+                else:
+                    print(f"  Severity: {severity}")
+                    ai_text = get_drift_explanation(r.resource_type, r.resource_id, {"status": "missing"}, r.drift_type.value)
+
+                if ai_text:
+                    print(f"  AI Analysis: {ai_text}\n")
+                    r.ai_analysis = ai_text
+                else:
+                    print("\n")
+                    
+                process_drift_results(r.resource_id, r.drift_type.value, ai_text)
+            
+            print(f"Total drift found: {total_drift} resources  |  CRITICAL: {crit_count}  HIGH: {high_count}\n")
+            
+            process_alerts(results)
+            save_drift_to_db(results)
+                        
+    except Exception as e:
+        print(f"Error during execution: {e}")
+
+if __name__ == "__main__":
+    main()

driftwatch_cli-3.0.0/drift_engine/database.py

@@ -0,0 +1,43 @@
+import os
+import json
+import psycopg2
+
+def save_drift_to_db(drift_results: list):
+    if not drift_results:
+        return
+        
+    try:
+        conn = psycopg2.connect(
+            dbname=os.environ.get("DB_NAME", "driftwatch"),
+            user=os.environ.get("DB_USER", "admin"),
+            password=os.environ.get("DB_PASSWORD", "admin"),
+            host=os.environ.get("DB_HOST", "localhost"),
+            port=os.environ.get("DB_PORT", "5432")
+        )
+        cursor = conn.cursor()
+
+        cursor.execute('''
+            CREATE TABLE IF NOT EXISTS drift_history (
+                id SERIAL PRIMARY KEY,
+                scan_time TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                resource_type VARCHAR(255),
+                resource_id VARCHAR(255),
+                resource_name VARCHAR(255),
+                drift_type VARCHAR(50),
+                diff_details TEXT
+            )
+        ''')
+
+        for r in drift_results:
+            diff_json = json.dumps(r.diff) if r.diff else "{}"
+            cursor.execute('''
+                INSERT INTO drift_history (resource_type, resource_id, resource_name, drift_type, diff_details)
+                VALUES (%s, %s, %s, %s, %s)
+            ''', (r.resource_type, r.resource_id, r.resource_name, r.drift_type.value, diff_json))
+
+        conn.commit()
+        cursor.close()
+        conn.close()
+        print("✅ Drift history saved to PostgreSQL database.")
+    except Exception as e:
+        print(f"❌ Database error: {e}")

driftwatch_cli-3.0.0/drift_engine/explain.py

@@ -0,0 +1,47 @@
+import os
+import json
+import requests
+
+def get_drift_explanation(resource_type, resource_id, diff_data, drift_type):
+    api_key = os.environ.get("GROQ_API_KEY", "").strip()
+    
+    if not api_key:
+        return "AI explanation unavailable: GROQ_API_KEY not set in environment."
+
+    url = "https://api.groq.com/openai/v1/chat/completions"
+    
+    prompt = (
+        f"You are a strict AWS DevOps expert. Analyze this infrastructure drift.\n"
+        f"Resource Type: {resource_type}\n"
+        f"Resource ID: {resource_id}\n"
+        f"Drift Type: {drift_type}\n"
+        f"Diff Data: {json.dumps(diff_data)}\n\n"
+        f"Strict Remediation Rules based on Drift Type:\n"
+        f"- UNMANAGED: This resource exists in AWS but is not tracked by Terraform state. The ONLY fix is to provide an exact `terraform import` command. Do NOT create a resource block.\n"
+        f"- MISSING: This resource exists in Terraform state but was manually deleted from AWS. The fix is to provide a fresh Terraform resource block to recreate it.\n"
+        f"- MODIFIED: This resource attributes in AWS differ from Terraform state. Provide a short Terraform snippet to correct the drift.\n\n"
+        f"Provide a brief, plain-English explanation of the security or operational risk (max 3 sentences). "
+        f"Then, provide the exact Terraform fix as instructed above."
+    )
+
+    payload = {
+        "model": "llama-3.1-8b-instant",
+        "messages": [
+            {"role": "system", "content": "You are a helpful AWS DevOps assistant."},
+            {"role": "user", "content": prompt}
+        ],
+        "temperature": 0.2
+    }
+    
+    headers = {
+        "Content-Type": "application/json",
+        "Authorization": f"Bearer {api_key}"
+    }
+
+    try:
+        response = requests.post(url, json=payload, headers=headers)
+        response.raise_for_status()
+        data = response.json()
+        return data["choices"][0]["message"]["content"]
+    except Exception as e:
+        return f"AI API Error (Groq): {e}"

driftwatch_cli-3.0.0/drift_engine/models.py

@@ -0,0 +1,42 @@
+from dataclasses import dataclass, field
+from enum import Enum
+
+class DriftType(Enum):
+    MISSING = "MISSING"
+    MODIFIED = "MODIFIED"
+    UNMANAGED = "UNMANAGED"
+
+@dataclass
+class DriftResult:
+    resource_type: str
+    resource_id: str
+    drift_type: DriftType
+    resource_name: str
+    tf_attributes: dict = field(default_factory=dict)
+    live_attributes: dict = field(default_factory=dict)
+    diff: dict = field(default_factory=dict)
+    ai_analysis: str = ""
+
+IGNORED_ATTRIBUTES = {
+    "aws_instance": {
+        "private_ip", "public_ip", "network_interface_id",
+        "instance_state", "private_dns", "public_dns", "tags_all"
+    },
+    "aws_security_group": {"owner_id"},
+    "aws_s3_bucket": {
+        "arn", "bucket_domain_name", "bucket_regional_domain_name",
+        "hosted_zone_id", "region", "request_payer", "tags_all"
+    },
+    "aws_db_instance": {"engine_version"}
+}
+
+MONITORED_ATTRIBUTES = {
+    "aws_instance": {"instance_type", "ami", "vpc_security_group_ids"},
+    "aws_security_group": {"ingress", "egress", "description"},
+    "aws_s3_bucket": {"bucket"},
+    "aws_iam_role": set(),
+    "aws_db_instance": {"instance_class", "engine", "allocated_storage"},
+    "aws_lambda_function": {"runtime", "handler", "memory_size", "timeout"}
+}
+
+MONITORED_RESOURCES = list(MONITORED_ATTRIBUTES.keys())

driftwatch_cli-3.0.0/drift_engine/notifications.py

@@ -0,0 +1,121 @@
+import os
+import json
+import urllib.request
+import smtplib
+import requests
+from email.mime.text import MIMEText
+from email.mime.multipart import MIMEMultipart
+
+def send_telegram_alert(message: str):
+    bot_token = os.environ.get("TELEGRAM_BOT_TOKEN")
+    chat_id = os.environ.get("TELEGRAM_CHAT_ID")
+    
+    if not bot_token or not chat_id:
+        print("Telegram credentials missing in environment variables.")
+        return
+        
+    url = f"https://api.telegram.org/bot{bot_token}/sendMessage"
+    payload = {
+        "chat_id": chat_id,
+        "text": message
+    }
+    
+    try:
+        response = requests.post(url, json=payload)
+        response.raise_for_status()
+        print("Telegram alert sent successfully.")
+    except Exception as e:
+        print(f"Failed to send Telegram alert: {e}")
+
+def send_slack_alert(webhook_url: str, drift_results: list):
+    if not webhook_url:
+        return
+
+    message_lines = ["*DriftWatch Alert: Infrastructure Drift Detected!*"]
+    for r in drift_results:
+        line = f"• [{r.drift_type.value}] {r.resource_type}: {r.resource_name} ({r.resource_id})"
+        message_lines.append(line)
+        if r.diff:
+            for attr, vals in r.diff.items():
+                message_lines.append(f"    - {attr}: Expected '{vals['terraform']}', Found '{vals['live']}'")
+        if hasattr(r, 'ai_analysis') and r.ai_analysis:
+            message_lines.append(f"    - AI Analysis: {r.ai_analysis}")
+            message_lines.append("")
+
+    payload = {"text": "\n".join(message_lines)}
+    req = urllib.request.Request(
+        webhook_url, 
+        data=json.dumps(payload).encode('utf-8'),
+        headers={'Content-Type': 'application/json'}
+    )
+    
+    try:
+        urllib.request.urlopen(req)
+        print("Slack alert sent successfully.")
+    except Exception as e:
+        print(f"Failed to send Slack alert: {e}")
+
+def send_email_alert(smtp_server: str, smtp_port: int, sender_email: str, sender_password: str, recipient_email: str, drift_results: list):
+    if not all([smtp_server, sender_email, sender_password, recipient_email]):
+        return
+
+    msg = MIMEMultipart()
+    msg['From'] = sender_email
+    msg['To'] = recipient_email
+    msg['Subject'] = "DriftWatch Alert: Infrastructure Drift Detected"
+
+    body_lines = ["DriftWatch has detected changes in your infrastructure:\n"]
+    for r in drift_results:
+        line = f"[{r.drift_type.value}] {r.resource_type}: {r.resource_name} ({r.resource_id})"
+        body_lines.append(line)
+        if r.diff:
+            for attr, vals in r.diff.items():
+                body_lines.append(f"    - {attr}: Expected '{vals['terraform']}', Found '{vals['live']}'")
+        if hasattr(r, 'ai_analysis') and r.ai_analysis:
+            body_lines.append(f"\n    AI Analysis:\n    {r.ai_analysis}\n")
+        else:
+            body_lines.append("")
+
+    msg.attach(MIMEText("\n".join(body_lines), 'plain'))
+
+    try:
+        server = smtplib.SMTP(smtp_server, smtp_port)
+        server.starttls()
+        server.login(sender_email, sender_password)
+        server.send_message(msg)
+        server.quit()
+        print("Email alert sent successfully.")
+    except Exception as e:
+        print(f"Failed to send Email alert: {e}")
+
+def process_alerts(drift_results: list):
+    if not drift_results:
+        return
+        
+    slack_webhook = os.environ.get("SLACK_WEBHOOK_URL")
+    smtp_server = os.environ.get("SMTP_SERVER", "smtp.gmail.com")
+    smtp_port = int(os.environ.get("SMTP_PORT", 587))
+    sender_email = os.environ.get("SENDER_EMAIL")
+    sender_password = os.environ.get("SENDER_PASSWORD")
+    recipient_email = os.environ.get("RECIPIENT_EMAIL")
+    bot_token = os.environ.get("TELEGRAM_BOT_TOKEN")
+    chat_id = os.environ.get("TELEGRAM_CHAT_ID")
+
+    if slack_webhook:
+        send_slack_alert(slack_webhook, drift_results)
+    
+    if sender_email and sender_password and recipient_email:
+        send_email_alert(smtp_server, smtp_port, sender_email, sender_password, recipient_email, drift_results)
+
+    if bot_token and chat_id:
+        message_lines = ["DriftWatch Alert Summary:"]
+        for r in drift_results:
+            line = f"[{r.drift_type.value}] {r.resource_type}: {r.resource_name} ({r.resource_id})"
+            message_lines.append(line)
+            
+        telegram_message = "\n".join(message_lines)
+        
+        if len(telegram_message) > 4000:
+            telegram_message = telegram_message[:4000] + "\n...[TRUNCATED]"
+            
+        send_telegram_alert(telegram_message)

driftwatch_cli-3.0.0/drift_engine/remediation.py

@@ -0,0 +1,193 @@
+import boto3
+import os
+
+def get_environment_tag(tags):
+    if not tags:
+        return 'unknown'
+    if isinstance(tags, dict):
+        value = tags.get('Environment')
+        return value.lower() if value else 'unknown'
+    for tag in tags:
+        if isinstance(tag, dict) and tag.get('Key') == 'Environment':
+            return tag.get('Value').lower()
+    return 'unknown'
+
+def confirm_action(action_desc: str, env: str = 'unknown', is_disruptive: bool = False) -> bool:
+    if env in ['dev', 'staging']:
+        print(f"[*] [{env.upper()}] Auto-approving: {action_desc}")
+        return True
+
+    print(f"[!] [{env.upper()}] Protection Active. Manual action required.")
+    if is_disruptive:
+        print("[!] WARNING: This is a disruptive action -> Downtime risk!")
+
+    while True:
+        choice = input(f"⚠️ {action_desc}. Proceed? (y/n): ").strip().lower()
+        if choice in ['y', 'yes']:
+            return True
+        elif choice in ['n', 'no']:
+            return False
+        print("Invalid input. Please enter 'y' or 'n'.")
+
+def remediate_ec2_instance_type(region: str, instance_id: str, expected_type: str, env: str):
+    if not confirm_action(f"Change EC2 {instance_id} instance type to {expected_type}", env, True):
+        print(f"⏭️  Skipped remediation for EC2 {instance_id}")
+        return
+
+    ec2 = boto3.client('ec2', region_name=region)
+    print(f"Stopping instance {instance_id} for remediation...")
+    ec2.stop_instances(InstanceIds=[instance_id])
+    waiter = ec2.get_waiter('instance_stopped')
+    waiter.wait(InstanceIds=[instance_id])
+    print(f"Modifying instance type to {expected_type}...")
+    ec2.modify_instance_attribute(
+        InstanceId=instance_id,
+        InstanceType={'Value': expected_type}
+    )
+    print(f"Restarting instance {instance_id}...")
+    ec2.start_instances(InstanceIds=[instance_id])
+    print(f"✅ [REMEDIATED] Successfully remediated {instance_id} back to {expected_type}")
+
+def remediate_security_group(region: str, sg_id: str, diff_data: dict, env: str):
+    ec2 = boto3.client('ec2', region_name=region)
+    expected_ingress = diff_data.get("ingress", {}).get("terraform", [])
+    live_ingress = diff_data.get("ingress", {}).get("live", [])
+    
+    print(f"Checking Security Group {sg_id} for unauthorized rules...")
+    for live_rule in live_ingress:
+        is_authorized = False
+        for exp_rule in expected_ingress:
+            if (live_rule.get('from_port') == exp_rule.get('from_port') and
+                live_rule.get('to_port') == exp_rule.get('to_port') and
+                live_rule.get('protocol') == exp_rule.get('protocol')):
+                is_authorized = True
+                break
+                
+        if not is_authorized:
+            if confirm_action(f"Revoke unauthorized rule (Port {live_rule.get('from_port')}) in {sg_id}", env, False):
+                print(f"Revoking unauthorized rule: {live_rule}")
+                try:
+                    ec2.revoke_security_group_ingress(
+                        GroupId=sg_id,
+                        IpPermissions=[{
+                            'IpProtocol': live_rule['protocol'],
+                            'FromPort': live_rule['from_port'],
+                            'ToPort': live_rule['to_port'],
+                            'IpRanges': [{'CidrIp': cidr} for cidr in live_rule.get('cidr_blocks', []) if cidr]
+                        }]
+                    )
+                    print(f"✅ [REMEDIATED] Successfully removed unauthorized Inbound Rule from {sg_id}")
+                except Exception as e:
+                    print(f"❌ Failed to revoke rule in {sg_id}: {e}")
+            else:
+                print(f"⏭️  Skipped revoking rule for Port {live_rule.get('from_port')}")
+
+    print(f"Checking Security Group {sg_id} for missing IaC rules...")
+    for exp_rule in expected_ingress:
+        is_missing = True
+        for live_rule in live_ingress:
+            if (live_rule.get('from_port') == exp_rule.get('from_port') and
+                live_rule.get('to_port') == exp_rule.get('to_port') and
+                live_rule.get('protocol') == exp_rule.get('protocol')):
+                is_missing = False
+                break
+        
+        if is_missing:
+            if confirm_action(f"Restore missing IaC rule (Port {exp_rule.get('from_port')}) in {sg_id}", env, False):
+                print(f"Restoring missing IaC rule: Port {exp_rule.get('from_port')}")
+                try:
+                    ec2.authorize_security_group_ingress(
+                        GroupId=sg_id,
+                        IpPermissions=[{
+                            'IpProtocol': exp_rule['protocol'],
+                            'FromPort': exp_rule['from_port'],
+                            'ToPort': exp_rule['to_port'],
+                            'IpRanges': [{'CidrIp': cidr} for cidr in exp_rule.get('cidr_blocks', []) if cidr]
+                        }]
+                    )
+                    print(f"✅ [REMEDIATED] Successfully restored missing IaC Inbound Rule to {sg_id}")
+                except Exception as e:
+                    print(f"❌ Failed to restore rule in {sg_id}: {e}")
+            else:
+                print(f"⏭️  Skipped restoring rule for Port {exp_rule.get('from_port')}")
+                
+    print(f"Completed remediation check for Security Group {sg_id}")
+
+def remediate_s3_bucket(bucket_name: str, env: str):
+    if not confirm_action(f"Enforce strict Public Access Block on S3 Bucket '{bucket_name}'", env, False):
+        print(f"⏭️  Skipped remediation for S3 bucket {bucket_name}")
+        return
+
+    s3 = boto3.client('s3')
+    print(f"Remediating S3 Bucket {bucket_name} by enforcing public access block...")
+    try:
+        s3.put_public_access_block(
+            Bucket=bucket_name,
+            PublicAccessBlockConfiguration={
+                'BlockPublicAcls': True,
+                'IgnorePublicAcls': True,
+                'BlockPublicPolicy': True,
+                'RestrictPublicBuckets': True
+            }
+        )
+        print(f"✅ [REMEDIATED] Successfully blocked public access for {bucket_name}")
+    except Exception as e:
+        print(f"❌ Failed to remediate S3 bucket {bucket_name}: {e}")
+
+def remediate_iam_role(role_name: str, diff_data: dict, env: str):
+    iam = boto3.client('iam')
+    expected_policies = diff_data.get("attached_policies", {}).get("terraform", [])
+    live_policies = diff_data.get("attached_policies", {}).get("live", [])
+
+    print(f"Checking IAM Role {role_name} for unauthorized policies...")
+    for live_policy in live_policies:
+        if live_policy not in expected_policies:
+            if confirm_action(f"Detach unauthorized policy '{live_policy}' from Role '{role_name}'", env, False):
+                print(f"Detaching unauthorized policy: {live_policy}")
+                try:
+                    iam.detach_role_policy(
+                        RoleName=role_name,
+                        PolicyArn=live_policy
+                    )
+                    print(f"✅ [REMEDIATED] Successfully detached {live_policy} from {role_name}")
+                except Exception as e:
+                    print(f"❌ Failed to detach policy from {role_name}: {e}")
+            else:
+                print(f"⏭️  Skipped detaching policy {live_policy}")
+
+def process_remediation(drift_results: list):
+    region = os.environ.get("AWS_DEFAULT_REGION", "ap-south-1")
+    for result in drift_results:
+        attrs = result.live_attributes or result.tf_attributes or {}
+        tags = attrs.get('tags', {})
+        env = get_environment_tag(tags)
+
+        if result.drift_type.value == "MODIFIED":
+            if result.resource_type == "aws_instance" and "instance_type" in result.diff:
+                expected_type = result.diff["instance_type"]["terraform"]
+                print(f"\n--- Drift Detected: EC2 Instance ({result.resource_id}) ---")
+                try:
+                    remediate_ec2_instance_type(region, result.resource_id, expected_type, env)
+                except Exception as e:
+                    print(f"Remediation failed for {result.resource_id}: {e}")
+            
+            elif result.resource_type == "aws_security_group" and "ingress" in result.diff:
+                print(f"\n--- Drift Detected: Security Group ({result.resource_id}) ---")
+                try:
+                    remediate_security_group(region, result.resource_id, result.diff, env)
+                except Exception as e:   
+                    print(f"Remediation failed for {result.resource_id}: {e}")
+
+            elif result.resource_type == "aws_s3_bucket":
+                print(f"\n--- Drift Detected: S3 Bucket ({result.resource_id}) ---")
+                try:
+                    remediate_s3_bucket(result.resource_id, env)
+                except Exception as e:
+                    print(f"Remediation failed for {result.resource_id}: {e}")
+
+            elif result.resource_type == "aws_iam_role" and "attached_policies" in result.diff:
+                print(f"\n--- Drift Detected: IAM Role ({result.resource_id}) ---")
+                try:
+                    remediate_iam_role(result.resource_id, result.diff, env)
+                except Exception as e:
+                    print(f"Remediation failed for {result.resource_id}: {e}")

driftwatch_cli-3.0.0/drift_engine/tf_parser.py

@@ -0,0 +1,40 @@
+import json
+
+def load_terraform_state(state_path: str) -> dict:
+    try:
+        with open(state_path) as f:
+            state = json.load(f)
+    except FileNotFoundError:
+        print(f"Error: Terraform state file not found at '{state_path}'")
+        return {}
+        
+    resources = {}
+    for resource in state.get("resources", []):
+        r_type = resource["type"]
+        
+        if r_type in ["archive_file", "aws_iam_role_policy_attachment"]:
+            continue
+            
+        for instance in resource.get("instances", []):
+            attrs = instance.get("attributes", {})
+            resource_id = attrs.get("id")
+            
+            tags = attrs.get("tags", {})
+            if tags and tags.get("Name"):
+                name = tags.get("Name")
+            elif r_type == "aws_lambda_function":
+                name = attrs.get("function_name", "Unknown")
+            elif r_type == "aws_db_instance":
+                name = attrs.get("identifier", "Unknown")
+            elif r_type == "aws_iam_role":
+                name = attrs.get("name", "Unknown")
+            else:
+                name = "Unknown"
+            
+            if resource_id:
+                resources[resource_id] = {
+                    "type": r_type, 
+                    "name": name, 
+                    "attributes": attrs
+                }
+    return resources

driftwatch_cli-3.0.0/driftwatch/cli.py

@@ -0,0 +1,156 @@
+import typer
+import os
+import sys
+from datetime import datetime
+
+base_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.append(base_dir)
+sys.path.append(os.path.join(base_dir, "drift_engine"))
+
+env_file = os.path.join(base_dir, ".env")
+if os.path.exists(env_file):
+    with open(env_file, "r") as f:
+        for line in f:
+            stripped_line = line.strip()
+            if stripped_line and not stripped_line.startswith("#"):
+                if "=" in stripped_line:
+                    k, v = stripped_line.split("=", 1)
+                    os.environ.setdefault(k.strip(), v.strip().strip('"').strip("'"))
+
+from drift_engine.core import detect_drift, get_severity, get_resource_cost, process_drift_results
+from drift_engine.explain import get_drift_explanation
+from drift_engine.models import DriftType
+from drift_engine.notifications import process_alerts
+from drift_engine.database import save_drift_to_db
+from drift_engine.remediation import process_remediation
+
+app = typer.Typer()
+
+SEVERITY_RANK = {"LOW": 0, "MEDIUM": 1, "HIGH": 2, "CRITICAL": 3}
+
+@app.command()
+def scan(
+    state: str = typer.Option("terraform/terraform.tfstate"),
+    region: str = typer.Option("ap-south-1"),
+    fail_on: str = typer.Option(None)
+):
+    typer.echo("Scanning AWS Infrastructure...\n")
+    os.environ["TF_STATE_PATH"] = state
+    os.environ["AWS_DEFAULT_REGION"] = region
+
+    try:
+        results, total_scanned = detect_drift(state, region)
+        current_time = datetime.now().strftime("%Y-%m-%d %H:%M:%S IST")
+        total_drift = len(results)
+
+        typer.echo("=== DRIFTWATCH SCAN REPORT ===")
+        typer.echo(f"Scan time: {current_time} | Resources scanned: {total_scanned}\n")
+
+        if not results:
+            typer.secho("No drift detected. Infrastructure matches IaC.", fg=typer.colors.GREEN)
+            return
+
+        highest_severity_found = "LOW"
+        crit_count = 0
+        high_count = 0
+
+        for r in results:
+            severity = get_severity(r.resource_type, r.drift_type)
+
+            if SEVERITY_RANK.get(severity, 0) > SEVERITY_RANK.get(highest_severity_found, 0):
+                highest_severity_found = severity
+
+            if severity == "CRITICAL":
+                crit_count += 1
+                color = typer.colors.RED
+            elif severity == "HIGH":
+                high_count += 1
+                color = typer.colors.YELLOW
+            else:
+                color = typer.colors.BLUE
+
+            typer.secho(f"[{r.drift_type.value}] {r.resource_type}: {r.resource_id}", fg=color, bold=True)
+            ai_text = ""
+
+            if r.drift_type == DriftType.UNMANAGED and r.resource_type == "aws_instance":
+                cost = "{:,.2f}".format(get_resource_cost(r.resource_id))
+                inst_type = r.live_attributes.get("instance_type", "unknown")
+                typer.echo(f"  Type: {inst_type} (created manually in console)")
+                typer.echo(f"  Severity: {severity} | Cost: +Rs.{cost}/month (untracked)")
+
+                ai_text = get_drift_explanation(r.resource_type, r.resource_id, r.live_attributes, r.drift_type.value)
+
+            elif r.diff:
+                typer.echo(f"  Severity: {severity}")
+                for attr, vals in r.diff.items():
+                    typer.echo(f"  Attribute: {attr}")
+                    typer.echo(f"  Terraform: {vals['terraform']}")
+                    typer.echo(f"  Live AWS:  {vals['live']}")
+
+                ai_text = get_drift_explanation(r.resource_type, r.resource_id, r.diff, r.drift_type.value)
+            else:
+                typer.echo(f"  Severity: {severity}")
+                ai_text = get_drift_explanation(r.resource_type, r.resource_id, {"status": "missing"}, r.drift_type.value)
+
+            if ai_text:
+                typer.echo(f"  AI Analysis: {ai_text}\n")
+                r.ai_analysis = ai_text
+            else:
+                typer.echo("\n")
+
+            process_drift_results(r.resource_id, r.drift_type.value, ai_text)
+
+        typer.echo(f"Total drift found: {total_drift} resources  |  CRITICAL: {crit_count}  HIGH: {high_count}\n")
+
+        process_alerts(results)
+        save_drift_to_db(results)
+        
+        if results:
+            typer.echo("Tip: run 'driftwatch remediate <resource_id>' to fix a specific resource.\n")
+
+        if fail_on and SEVERITY_RANK.get(highest_severity_found, 0) >= SEVERITY_RANK.get(fail_on.upper(), 0):
+            typer.secho(
+                f"\nBUILD FAILED: highest severity found is {highest_severity_found} (gate: {fail_on.upper()})",
+                fg=typer.colors.RED, bold=True,
+            )
+            raise typer.Exit(code=1)
+
+    except typer.Exit:
+        raise
+    except Exception as e:
+        typer.secho(f"Error during execution: {e}", fg=typer.colors.RED)
+        raise typer.Exit(code=1)
+
+@app.command()
+def explain(resource_id: str):
+    typer.echo(f"Fetching AI explanation for {resource_id}...")
+    ai_text = get_drift_explanation("unknown", resource_id, {}, "UNKNOWN")
+    typer.echo(f"\nAI Analysis:\n{ai_text}")
+
+@app.command()
+def remediate(
+    resource_id: str,
+    state: str = typer.Option("terraform/terraform.tfstate"),
+    region: str = typer.Option("ap-south-1"),
+    dry_run: bool = typer.Option(True, "--dry-run/--apply"),
+):
+    results, _ = detect_drift(state, region)
+    match = [r for r in results if r.resource_id == resource_id]
+
+    if not match:
+        typer.secho(f"No current drift found for {resource_id}. Run 'driftwatch scan' first.", fg=typer.colors.YELLOW)
+        raise typer.Exit(code=1)
+
+    r = match[0]
+    typer.secho(f"[{r.drift_type.value}] {r.resource_type}: {r.resource_id}", bold=True)
+    for attr, vals in (r.diff or {}).items():
+        typer.echo(f"  {attr}: terraform={vals['terraform']}  live={vals['live']}")
+
+    if dry_run:
+        typer.secho("\n[DRY RUN] No changes made. Re-run with --apply to remediate.", fg=typer.colors.BLUE)
+        return
+
+    process_remediation(match)
+
+if __name__ == "__main__":
+    app()

driftwatch_cli-3.0.0/driftwatch_cli.egg-info/PKG-INFO

@@ -0,0 +1,13 @@
+Metadata-Version: 2.4
+Name: driftwatch-cli
+Version: 3.0.0
+Summary: CLI tool that detects Terraform infrastructure drift against live AWS, explains it with AI, and guides remediation.
+Requires-Python: >=3.10
+License-File: LICENSE
+Requires-Dist: boto3
+Requires-Dist: typer
+Requires-Dist: groq
+Requires-Dist: python-telegram-bot
+Requires-Dist: psycopg2-binary
+Requires-Dist: requests
+Dynamic: license-file

driftwatch_cli-3.0.0/driftwatch_cli.egg-info/SOURCES.txt

@@ -0,0 +1,20 @@
+LICENSE
+pyproject.toml
+drift_engine/__init__.py
+drift_engine/aws_client.py
+drift_engine/core.py
+drift_engine/database.py
+drift_engine/explain.py
+drift_engine/models.py
+drift_engine/notifications.py
+drift_engine/remediation.py
+drift_engine/tf_parser.py
+driftwatch/__init__.py
+driftwatch/cli.py
+driftwatch_cli.egg-info/PKG-INFO
+driftwatch_cli.egg-info/SOURCES.txt
+driftwatch_cli.egg-info/dependency_links.txt
+driftwatch_cli.egg-info/entry_points.txt
+driftwatch_cli.egg-info/requires.txt
+driftwatch_cli.egg-info/top_level.txt
+tests/test_diff_engine.py

driftwatch_cli-3.0.0/driftwatch_cli.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

driftwatch_cli-3.0.0/driftwatch_cli.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+driftwatch = driftwatch.cli:app

driftwatch_cli-3.0.0/driftwatch_cli.egg-info/requires.txt

@@ -0,0 +1,6 @@
+boto3
+typer
+groq
+python-telegram-bot
+psycopg2-binary
+requests

driftwatch_cli-3.0.0/driftwatch_cli.egg-info/top_level.txt

@@ -0,0 +1,2 @@
+drift_engine
+driftwatch

driftwatch_cli-3.0.0/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "driftwatch-cli"
+version = "3.0.0"
+description = "CLI tool that detects Terraform infrastructure drift against live AWS, explains it with AI, and guides remediation."
+requires-python = ">=3.10"
+dependencies = [
+    "boto3",
+    "typer",
+    "groq",
+    "python-telegram-bot",
+    "psycopg2-binary",
+    "requests"
+]
+
+[project.scripts]
+driftwatch = "driftwatch.cli:app"
+
+[tool.setuptools.packages.find]
+include = ["driftwatch*", "drift_engine*"]

driftwatch_cli-3.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

driftwatch_cli-3.0.0/tests/test_diff_engine.py

@@ -0,0 +1,39 @@
+from drift_engine.core import compare_attributes, DriftType
+
+def test_ignored_attributes_do_not_trigger_drift():
+    tf = {"id": "i-123", "private_ip": "10.0.0.5"}
+    live = {"id": "i-123", "private_ip": "10.0.0.9"}
+    
+    diff = compare_attributes(tf, live, "aws_instance")
+    
+    assert diff == {}
+
+def test_real_attribute_change_is_detected():
+    tf = {"id": "i-123", "instance_type": "t3.micro"}
+    live = {"id": "i-123", "instance_type": "t3.small"}
+    
+    diff = compare_attributes(tf, live, "aws_instance")
+    
+    assert "instance_type" in diff
+    assert diff["instance_type"]["terraform"] == "t3.micro"
+    assert diff["instance_type"]["live"] == "t3.small"
+
+def test_security_group_changes_are_detected():
+    tf_attrs = {"id": "sg-123", "description": "Managed by TF"}
+    live_attrs = {"id": "sg-123", "description": "Manual edit in AWS"}
+    
+    diff = compare_attributes(tf_attrs, live_attrs, "aws_security_group")
+    
+    assert "description" in diff
+    assert diff["description"]["terraform"] == "Managed by TF"
+    assert diff["description"]["live"] == "Manual edit in AWS"
+
+def test_iam_role_changes_are_detected():
+    tf_attrs = {"id": "MyRole", "path": "/"}
+    live_attrs = {"id": "MyRole", "path": "/service-role/"}
+    
+    diff = compare_attributes(tf_attrs, live_attrs, "aws_iam_role")
+    
+    assert "path" in diff
+    assert diff["path"]["terraform"] == "/"
+    assert diff["path"]["live"] == "/service-role/"