driftwatch-cli 3.0.0__tar.gz → 3.0.1__tar.gz

{driftwatch_cli-3.0.0 → driftwatch_cli-3.0.1}/PKG-INFO

@@ -1,7 +1,10 @@
 Metadata-Version: 2.4
 Name: driftwatch-cli
-Version: 3.0.0
+Version: 3.0.1
 Summary: CLI tool that detects Terraform infrastructure drift against live AWS, explains it with AI, and guides remediation.
+Author: Nitin Gupta
+Project-URL: Homepage, https://github.com/hastagnitin/driftwatch
+Project-URL: Repository, https://github.com/hastagnitin/driftwatch
 Requires-Python: >=3.10
 License-File: LICENSE
 Requires-Dist: boto3
@@ -10,4 +13,5 @@ Requires-Dist: groq
 Requires-Dist: python-telegram-bot
 Requires-Dist: psycopg2-binary
 Requires-Dist: requests
+Requires-Dist: python-dotenv
 Dynamic: license-file

{driftwatch_cli-3.0.0 → driftwatch_cli-3.0.1}/drift_engine/aws_client.py

@@ -1,37 +1,42 @@
+import sys
 import boto3
 from datetime import datetime, timedelta
 
 def fetch_live_ec2_instances(region: str) -> dict:
     ec2 = boto3.client("ec2", region_name=region)
     live = {}
-    paginator = ec2.get_paginator("describe_instances")
-    
-    for page in paginator.paginate():
-        for reservation in page["Reservations"]:
-            for instance in reservation["Instances"]:
-                if instance["State"]["Name"] == "terminated":
-                    continue
-                
-                tags_list = instance.get("Tags", [])
-                tags_dict = {t["Key"]: t["Value"] for t in tags_list}
-                name = tags_dict.get("Name", "Unknown")
-                
-                sg_ids = []
-                for sg in instance.get("SecurityGroups", []):
-                    sg_ids.append(sg.get("GroupId"))
-                sg_ids.sort()
-                
-                live[instance["InstanceId"]] = {
-                    "type": "aws_instance",
-                    "name": name,
-                    "attributes": {
-                        "id": instance["InstanceId"],
-                        "instance_type": instance["InstanceType"],
-                        "ami": instance["ImageId"],
-                        "tags": tags_dict,
-                        "vpc_security_group_ids": sg_ids
-                    },
-                }
+    try:
+        paginator = ec2.get_paginator("describe_instances")
+        
+        for page in paginator.paginate():
+            for reservation in page["Reservations"]:
+                for instance in reservation["Instances"]:
+                    if instance["State"]["Name"] == "terminated":
+                        continue
+                    
+                    tags_list = instance.get("Tags", [])
+                    tags_dict = {t["Key"]: t["Value"] for t in tags_list}
+                    name = tags_dict.get("Name", "Unknown")
+                    
+                    sg_ids = []
+                    for sg in instance.get("SecurityGroups", []):
+                        sg_ids.append(sg.get("GroupId"))
+                    sg_ids.sort()
+                    
+                    live[instance["InstanceId"]] = {
+                        "type": "aws_instance",
+                        "name": name,
+                        "attributes": {
+                            "id": instance["InstanceId"],
+                            "instance_type": instance["InstanceType"],
+                            "ami": instance["ImageId"],
+                            "tags": tags_dict,
+                            "vpc_security_group_ids": sg_ids
+                        },
+                    }
+    except Exception as e:
+        print(f"Failed to fetch aws_instance: {e}", file=sys.stderr)
+        return None
     return live
 
 def fetch_live_s3_buckets(region: str) -> dict:
@@ -60,15 +65,15 @@ def fetch_live_s3_buckets(region: str) -> dict:
                 },
             }
     except Exception as e:
-        pass
+        print(f"Failed to fetch aws_s3_bucket: {e}", file=sys.stderr)
+        return None
     return live
 
 def fetch_live_security_groups(region: str) -> dict:
     ec2 = boto3.client("ec2", region_name=region)
     live = {}
-    paginator = ec2.get_paginator("describe_security_groups")
-    
     try:
+        paginator = ec2.get_paginator("describe_security_groups")
         for page in paginator.paginate():
             for sg in page["SecurityGroups"]:
                 sg_id = sg["GroupId"]
@@ -113,14 +118,15 @@ def fetch_live_security_groups(region: str) -> dict:
                     },
                 }
     except Exception as e:
-        pass
+        print(f"Failed to fetch aws_security_group: {e}", file=sys.stderr)
+        return None
     return live
 
-def fetch_live_rds_instances(region: str = "ap-south-1") -> dict:
+def fetch_live_rds_instances(region: str) -> dict:
     rds = boto3.client("rds", region_name=region)
     live = {}
-    paginator = rds.get_paginator("describe_db_instances")
     try:
+        paginator = rds.get_paginator("describe_db_instances")
         for page in paginator.paginate():
             for db in page["DBInstances"]:
                 db_id = db.get("DbiResourceId") 
@@ -140,14 +146,15 @@ def fetch_live_rds_instances(region: str = "ap-south-1") -> dict:
                     },
                 }
     except Exception as e:
-        pass
+        print(f"Failed to fetch aws_db_instance: {e}", file=sys.stderr)
+        return None
     return live
 
-def fetch_live_lambda_functions(region: str = "ap-south-1") -> dict:
+def fetch_live_lambda_functions(region: str) -> dict:
     lambda_client = boto3.client("lambda", region_name=region)
     live = {}
-    paginator = lambda_client.get_paginator("list_functions")
     try:
+        paginator = lambda_client.get_paginator("list_functions")
         for page in paginator.paginate():
             for func in page["Functions"]:
                 func_name = func["FunctionName"]
@@ -165,10 +172,11 @@ def fetch_live_lambda_functions(region: str = "ap-south-1") -> dict:
                     },
                 }
     except Exception as e:
-        pass
+        print(f"Failed to fetch aws_lambda_function: {e}", file=sys.stderr)
+        return None
     return live
 
-def fetch_live_iam_roles(region: str = "ap-south-1") -> dict:
+def fetch_live_iam_roles(region: str) -> dict:
     iam = boto3.client("iam", region_name=region)
     live = {}
     try:
@@ -178,17 +186,23 @@ def fetch_live_iam_roles(region: str = "ap-south-1") -> dict:
                 role_name = role["RoleName"]
                 if role_name.startswith("AWSServiceRoleFor") or role.get("Path", "").startswith("/aws-service-role/"):
                     continue
+                
+                policies = iam.list_attached_role_policies(RoleName=role_name)
+                attached_policies = [p["PolicyArn"] for p in policies.get("AttachedPolicies", [])]
+                
                 live[role_name] = {
                     "type": "aws_iam_role",
                     "name": role_name,
                     "attributes": {
                         "id": role_name,
                         "name": role_name,
-                        "arn": role["Arn"]
+                        "arn": role["Arn"],
+                        "attached_policies": attached_policies
                     }
                 }
     except Exception as e:
-        pass
+        print(f"Failed to fetch aws_iam_role: {e}", file=sys.stderr)
+        return None
     return live
 
 def get_resource_cost(resource_id: str) -> float:
@@ -211,7 +225,6 @@ def get_resource_cost(resource_id: str) -> float:
         )
         
         usd_cost = float(response["ResultsByTime"][0]["Total"]["UnblendedCost"]["Amount"])
-        inr_cost = round(usd_cost * 83.5, 2)
-        return inr_cost
+        return usd_cost
     except Exception:
         return 0.0

{driftwatch_cli-3.0.0 → driftwatch_cli-3.0.1}/drift_engine/core.py

@@ -1,22 +1,11 @@
 import os
-from datetime import datetime
-from models import DriftResult, DriftType, MONITORED_RESOURCES, MONITORED_ATTRIBUTES, IGNORED_ATTRIBUTES
-from tf_parser import load_terraform_state
-from aws_client import (
+from drift_engine.models import DriftResult, DriftType, MONITORED_RESOURCES, MONITORED_ATTRIBUTES, IGNORED_ATTRIBUTES
+from drift_engine.tf_parser import load_terraform_state
+from drift_engine.aws_client import (
     fetch_live_ec2_instances, fetch_live_s3_buckets,
     fetch_live_security_groups, fetch_live_rds_instances,
-    fetch_live_lambda_functions, fetch_live_iam_roles,
-    get_resource_cost
+    fetch_live_lambda_functions, fetch_live_iam_roles
 )
-from notifications import process_alerts, send_telegram_alert
-from database import save_drift_to_db
-from remediation import process_remediation
-from explain import get_drift_explanation
-
-def process_drift_results(resource_id, drift_status, ai_explanation=""):
-    if drift_status in ["MODIFIED", "UNMANAGED"]:
-        alert_msg = f"DRIFT ALERT\nResource: {resource_id}\nType: {drift_status}\nAction Required!\n\nAI Analysis:\n{ai_explanation}"
-        send_telegram_alert(alert_msg)
 
 def normalize_sg_rules(rules) -> list:
     normalized = []
@@ -72,14 +61,39 @@ def detect_drift(tf_state_path: str, region: str):
     
     if not tf_resources:
         return [], 0
-        
+
+    failed_types = set()
+
     live_ec2 = fetch_live_ec2_instances(region)
+    if live_ec2 is None:
+        failed_types.add("aws_instance")
+        live_ec2 = {}
+
     live_s3 = fetch_live_s3_buckets(region)
+    if live_s3 is None:
+        failed_types.add("aws_s3_bucket")
+        live_s3 = {}
+
     live_sg = fetch_live_security_groups(region)
+    if live_sg is None:
+        failed_types.add("aws_security_group")
+        live_sg = {}
+
     live_rds = fetch_live_rds_instances(region)
+    if live_rds is None:
+        failed_types.add("aws_db_instance")
+        live_rds = {}
+
     live_lambda = fetch_live_lambda_functions(region)
+    if live_lambda is None:
+        failed_types.add("aws_lambda_function")
+        live_lambda = {}
+
     live_iam = fetch_live_iam_roles(region)
-    
+    if live_iam is None:
+        failed_types.add("aws_iam_role")
+        live_iam = {}
+        
     live_resources = {**live_ec2, **live_s3, **live_sg, **live_rds, **live_lambda, **live_iam}
     
     results = []
@@ -97,6 +111,8 @@ def detect_drift(tf_state_path: str, region: str):
             res_name = live_resources[rid]["name"]
             
         if in_tf and not in_live:
+            if tf_resources[rid]["type"] in failed_types:
+                continue
             results.append(DriftResult(
                 resource_type=tf_resources[rid]["type"],
                 resource_id=rid,
@@ -136,74 +152,4 @@ def get_severity(r_type, d_type):
         return "CRITICAL"
     if d_type == DriftType.MISSING or r_type == "aws_instance":
         return "HIGH"
-    return "MEDIUM"
-
-def main():
-    tf_state_path = os.environ.get("TF_STATE_PATH", "terraform/terraform.tfstate")
-    region = os.environ.get("AWS_DEFAULT_REGION", "ap-south-1")
-    
-    try:
-        results, total_scanned = detect_drift(tf_state_path, region)
-        
-        current_time = datetime.now().strftime("%Y-%m-%d %H:%M:%S IST")
-        total_drift = len(results)
-        
-        print("\n=== DRIFTWATCH SCAN REPORT ===")
-        print(f"Scan time: {current_time} | Resources scanned: {total_scanned}\n")
-        
-        if not results:
-            print("No drift detected. Infrastructure matches IaC.")
-        else:
-            crit_count = 0
-            high_count = 0
-            
-            for r in results:
-                severity = get_severity(r.resource_type, r.drift_type)
-                
-                if severity == "CRITICAL":
-                    crit_count += 1
-                elif severity == "HIGH":
-                    high_count += 1
-                    
-                print(f"[{r.drift_type.value}] {r.resource_type}: {r.resource_id}")
-                
-                ai_text = ""
-                
-                if r.drift_type == DriftType.UNMANAGED and r.resource_type == "aws_instance":
-                    inst_type = r.live_attributes.get("instance_type", "unknown")
-                    cost = "{:,.2f}".format(get_resource_cost(r.resource_id))
-                    print(f"  Type: {inst_type} (created manually in console)")
-                    print(f"  Severity: {severity} | Cost: +Rs.{cost}/month (untracked)")
-                    
-                    ai_text = get_drift_explanation(r.resource_type, r.resource_id, r.live_attributes, r.drift_type.value)
-                    
-                elif r.diff:
-                    for attr, vals in r.diff.items():
-                        print(f"  Attribute: {attr}")
-                        print(f"  Terraform: {vals['terraform']}")
-                        print(f"  Live AWS:  {vals['live']}")
-                    print(f"  Severity: {severity}")
-                    
-                    ai_text = get_drift_explanation(r.resource_type, r.resource_id, r.diff, r.drift_type.value)
-                else:
-                    print(f"  Severity: {severity}")
-                    ai_text = get_drift_explanation(r.resource_type, r.resource_id, {"status": "missing"}, r.drift_type.value)
-
-                if ai_text:
-                    print(f"  AI Analysis: {ai_text}\n")
-                    r.ai_analysis = ai_text
-                else:
-                    print("\n")
-                    
-                process_drift_results(r.resource_id, r.drift_type.value, ai_text)
-            
-            print(f"Total drift found: {total_drift} resources  |  CRITICAL: {crit_count}  HIGH: {high_count}\n")
-            
-            process_alerts(results)
-            save_drift_to_db(results)
-                        
-    except Exception as e:
-        print(f"Error during execution: {e}")
-
-if __name__ == "__main__":
-    main()
+    return "MEDIUM"

{driftwatch_cli-3.0.0 → driftwatch_cli-3.0.1}/drift_engine/database.py

@@ -5,14 +5,25 @@ import psycopg2
 def save_drift_to_db(drift_results: list):
     if not drift_results:
         return
+
+    db_user = os.environ.get("DB_USER")
+    db_password = os.environ.get("DB_PASSWORD")
+    db_name = os.environ.get("DB_NAME", "driftwatch")
+    db_host = os.environ.get("DB_HOST", "localhost")
+    db_port = os.environ.get("DB_PORT", "5432")
+
+    # Security Fix: Check if credentials exist before connecting
+    if not db_user or not db_password:
+        print("⚠️ DB_USER or DB_PASSWORD not found in environment. Skipping database save.")
+        return
         
     try:
         conn = psycopg2.connect(
-            dbname=os.environ.get("DB_NAME", "driftwatch"),
-            user=os.environ.get("DB_USER", "admin"),
-            password=os.environ.get("DB_PASSWORD", "admin"),
-            host=os.environ.get("DB_HOST", "localhost"),
-            port=os.environ.get("DB_PORT", "5432")
+            dbname=db_name,
+            user=db_user,
+            password=db_password,
+            host=db_host,
+            port=db_port
         )
         cursor = conn.cursor()
 

{driftwatch_cli-3.0.0 → driftwatch_cli-3.0.1}/drift_engine/models.py

@@ -31,12 +31,12 @@ IGNORED_ATTRIBUTES = {
 }
 
 MONITORED_ATTRIBUTES = {
-    "aws_instance": {"instance_type", "ami", "vpc_security_group_ids"},
+    "aws_instance": {"instance_type", "ami"},
     "aws_security_group": {"ingress", "egress", "description"},
     "aws_s3_bucket": {"bucket"},
-    "aws_iam_role": set(),
     "aws_db_instance": {"instance_class", "engine", "allocated_storage"},
-    "aws_lambda_function": {"runtime", "handler", "memory_size", "timeout"}
+    "aws_lambda_function": {"runtime", "handler"},
+    "aws_iam_role": {"attached_policies"}
 }
 
 MONITORED_RESOURCES = list(MONITORED_ATTRIBUTES.keys())

driftwatch_cli-3.0.1/drift_engine/remediation.py

@@ -0,0 +1,224 @@
+import boto3
+import os
+
+def get_environment_tag(tags):
+    if not tags:
+        return 'unknown'
+    if isinstance(tags, dict):
+        value = tags.get('Environment')
+        return value.lower() if value else 'unknown'
+    for tag in tags:
+        if isinstance(tag, dict) and tag.get('Key') == 'Environment':
+            return tag.get('Value').lower()
+    return 'unknown'
+
+def confirm_action(action_desc: str, env: str = 'unknown', is_disruptive: bool = False) -> bool:
+    if env in ['dev', 'staging']:
+        print(f"[*] [{env.upper()}] Auto-approving: {action_desc}")
+        return True
+
+    print(f"[!] [{env.upper()}] Protection Active. Manual action required.")
+    if is_disruptive:
+        print("[!] WARNING: This is a disruptive action -> Downtime risk!")
+
+    while True:
+        choice = input(f"⚠️ {action_desc}. Proceed? (y/n): ").strip().lower()
+        if choice in ['y', 'yes']:
+            return True
+        elif choice in ['n', 'no']:
+            return False
+        print("Invalid input. Please enter 'y' or 'n'.")
+
+def remediate_ec2_instance_type(region: str, instance_id: str, expected_type: str, env: str):
+    if not confirm_action(f"Change EC2 {instance_id} instance type to {expected_type}", env, True):
+        print(f"⏭️  Skipped remediation for EC2 {instance_id}")
+        return
+
+    ec2 = boto3.client('ec2', region_name=region)
+    print(f"Stopping instance {instance_id} for remediation...")
+    ec2.stop_instances(InstanceIds=[instance_id])
+    waiter = ec2.get_waiter('instance_stopped')
+    waiter.wait(InstanceIds=[instance_id])
+    print(f"Modifying instance type to {expected_type}...")
+    ec2.modify_instance_attribute(
+        InstanceId=instance_id,
+        InstanceType={'Value': expected_type}
+    )
+    print(f"Restarting instance {instance_id}...")
+    ec2.start_instances(InstanceIds=[instance_id])
+    print(f"✅ [REMEDIATED] Successfully remediated {instance_id} back to {expected_type}")
+
+def remediate_security_group(region: str, sg_id: str, diff_data: dict, env: str):
+    ec2 = boto3.client('ec2', region_name=region)
+    
+    # 1. INGRESS RULES
+    if "ingress" in diff_data:
+        expected_ingress = diff_data["ingress"].get("terraform", [])
+        live_ingress = diff_data["ingress"].get("live", [])
+        
+        print(f"Checking Security Group {sg_id} for Ingress drift...")
+        for live_rule in live_ingress:
+            if live_rule not in expected_ingress:
+                if confirm_action(f"Revoke unauthorized Inbound rule (Port {live_rule.get('from_port')}) in {sg_id}", env, False):
+                    try:
+                        ec2.revoke_security_group_ingress(GroupId=sg_id, IpPermissions=[{
+                            'IpProtocol': live_rule['protocol'], 'FromPort': live_rule['from_port'], 'ToPort': live_rule['to_port'],
+                            'IpRanges': [{'CidrIp': c} for c in live_rule.get('cidr_blocks', []) if c]
+                        }])
+                        print(f"✅ [REMEDIATED] Removed unauthorized Inbound Rule from {sg_id}")
+                    except Exception as e:
+                        print(f"❌ Failed to revoke Inbound rule: {e}")
+
+        for exp_rule in expected_ingress:
+            if exp_rule not in live_ingress:
+                if confirm_action(f"Restore missing IaC Inbound rule (Port {exp_rule.get('from_port')}) in {sg_id}", env, False):
+                    try:
+                        ec2.authorize_security_group_ingress(GroupId=sg_id, IpPermissions=[{
+                            'IpProtocol': exp_rule['protocol'], 'FromPort': exp_rule['from_port'], 'ToPort': exp_rule['to_port'],
+                            'IpRanges': [{'CidrIp': c} for c in exp_rule.get('cidr_blocks', []) if c]
+                        }])
+                        print(f"✅ [REMEDIATED] Restored missing Inbound Rule to {sg_id}")
+                    except Exception as e:
+                        print(f"❌ Failed to restore Inbound rule: {e}")
+
+    # 2. EGRESS RULES
+    if "egress" in diff_data:
+        expected_egress = diff_data["egress"].get("terraform", [])
+        live_egress = diff_data["egress"].get("live", [])
+        
+        print(f"Checking Security Group {sg_id} for Egress drift...")
+        for live_rule in live_egress:
+            if live_rule not in expected_egress:
+                if confirm_action(f"Revoke unauthorized Outbound rule (Port {live_rule.get('from_port')}) in {sg_id}", env, False):
+                    try:
+                        ec2.revoke_security_group_egress(GroupId=sg_id, IpPermissions=[{
+                            'IpProtocol': live_rule['protocol'], 'FromPort': live_rule['from_port'], 'ToPort': live_rule['to_port'],
+                            'IpRanges': [{'CidrIp': c} for c in live_rule.get('cidr_blocks', []) if c]
+                        }])
+                        print(f"✅ [REMEDIATED] Removed unauthorized Outbound Rule from {sg_id}")
+                    except Exception as e:
+                        print(f"❌ Failed to revoke Outbound rule: {e}")
+
+        for exp_rule in expected_egress:
+            if exp_rule not in live_egress:
+                if confirm_action(f"Restore missing IaC Outbound rule (Port {exp_rule.get('from_port')}) in {sg_id}", env, False):
+                    try:
+                        ec2.authorize_security_group_egress(GroupId=sg_id, IpPermissions=[{
+                            'IpProtocol': exp_rule['protocol'], 'FromPort': exp_rule['from_port'], 'ToPort': exp_rule['to_port'],
+                            'IpRanges': [{'CidrIp': c} for c in exp_rule.get('cidr_blocks', []) if c]
+                        }])
+                        print(f"✅ [REMEDIATED] Restored missing Outbound Rule to {sg_id}")
+                    except Exception as e:
+                        print(f"❌ Failed to restore Outbound rule: {e}")
+
+    # 3. DESCRIPTION
+    if "description" in diff_data:
+        print(f"⚠️  Description drift detected for {sg_id}. SG descriptions cannot be updated dynamically. Please recreate via Terraform.")
+
+def remediate_s3_bucket(bucket_name: str, diff_data: dict, env: str):
+    s3 = boto3.client('s3')
+    
+    if "tags" in diff_data:
+        expected_tags = diff_data["tags"].get("terraform", {})
+        if confirm_action(f"Restore IaC tags for S3 Bucket '{bucket_name}'", env, False):
+            try:
+                tag_set = [{'Key': k, 'Value': v} for k, v in expected_tags.items()]
+                s3.put_bucket_tagging(Bucket=bucket_name, Tagging={'TagSet': tag_set})
+                print(f"✅ [REMEDIATED] Successfully restored tags for {bucket_name}")
+            except Exception as e:
+                print(f"❌ Failed to restore S3 tags: {e}")
+                
+    if "bucket" in diff_data:
+        print(f"⚠️  Bucket name drift detected for {bucket_name}. S3 buckets cannot be renamed. Please recreate via Terraform.")
+
+def remediate_rds_instance(region: str, db_id: str, diff_data: dict, env: str):
+    rds = boto3.client('rds', region_name=region)
+    updates = {}
+    
+    if "instance_class" in diff_data:
+        updates['DBInstanceClass'] = diff_data["instance_class"]["terraform"]
+    if "allocated_storage" in diff_data:
+        updates['AllocatedStorage'] = diff_data["allocated_storage"]["terraform"]
+        
+    if updates:
+        if confirm_action(f"Modify RDS {db_id} with new configs: {updates}", env, True):
+            try:
+                updates['ApplyImmediately'] = True
+                rds.modify_db_instance(DBInstanceIdentifier=db_id, **updates)
+                print(f"✅ [REMEDIATED] Initiated RDS modification for {db_id}. This may take several minutes.")
+            except Exception as e:
+                print(f"❌ Failed to remediate RDS {db_id}: {e}")
+
+def remediate_lambda_function(region: str, func_name: str, diff_data: dict, env: str):
+    lam = boto3.client('lambda', region_name=region)
+    updates = {}
+    
+    if "runtime" in diff_data: updates['Runtime'] = diff_data["runtime"]["terraform"]
+    if "handler" in diff_data: updates['Handler'] = diff_data["handler"]["terraform"]
+    if "memory_size" in diff_data: updates['MemorySize'] = diff_data["memory_size"]["terraform"]
+    if "timeout" in diff_data: updates['Timeout'] = diff_data["timeout"]["terraform"]
+    
+    if updates:
+        if confirm_action(f"Modify Lambda {func_name} with {updates}", env, False):
+            try:
+                lam.update_function_configuration(FunctionName=func_name, **updates)
+                print(f"✅ [REMEDIATED] Successfully modified Lambda {func_name}")
+            except Exception as e:
+                print(f"❌ Failed to remediate Lambda {func_name}: {e}")
+
+def remediate_iam_role(role_name: str, diff_data: dict, env: str):
+    iam = boto3.client('iam')
+    expected_policies = diff_data.get("attached_policies", {}).get("terraform", [])
+    live_policies = diff_data.get("attached_policies", {}).get("live", [])
+
+    print(f"Checking IAM Role {role_name} for unauthorized policies...")
+    for live_policy in live_policies:
+        if live_policy not in expected_policies:
+            if confirm_action(f"Detach unauthorized policy '{live_policy}' from Role '{role_name}'", env, False):
+                try:
+                    iam.detach_role_policy(RoleName=role_name, PolicyArn=live_policy)
+                    print(f"✅ [REMEDIATED] Successfully detached {live_policy} from {role_name}")
+                except Exception as e:
+                    print(f"❌ Failed to detach policy from {role_name}: {e}")
+
+    for exp_policy in expected_policies:
+        if exp_policy not in live_policies:
+            if confirm_action(f"Attach missing IaC policy '{exp_policy}' to Role '{role_name}'", env, False):
+                try:
+                    iam.attach_role_policy(RoleName=role_name, PolicyArn=exp_policy)
+                    print(f"✅ [REMEDIATED] Successfully attached {exp_policy} to {role_name}")
+                except Exception as e:
+                    print(f"❌ Failed to attach policy to {role_name}: {e}")
+
+def process_remediation(drift_results: list):
+    region = os.environ.get("AWS_DEFAULT_REGION", "ap-south-1")
+    for result in drift_results:
+        attrs = result.live_attributes or result.tf_attributes or {}
+        tags = attrs.get('tags', {})
+        env = get_environment_tag(tags)
+
+        if result.drift_type.value == "MODIFIED":
+            print(f"\n--- Drift Detected: {result.resource_type} ({result.resource_id}) ---")
+            
+            if result.resource_type == "aws_instance" and "instance_type" in result.diff:
+                expected_type = result.diff["instance_type"]["terraform"]
+                remediate_ec2_instance_type(region, result.resource_id, expected_type, env)
+            
+            elif result.resource_type == "aws_security_group":
+                remediate_security_group(region, result.resource_id, result.diff, env)
+
+            elif result.resource_type == "aws_s3_bucket":
+                remediate_s3_bucket(result.resource_id, result.diff, env)
+                
+            elif result.resource_type == "aws_db_instance":
+                remediate_rds_instance(region, result.resource_id, result.diff, env)
+                
+            elif result.resource_type == "aws_lambda_function":
+                remediate_lambda_function(region, result.resource_id, result.diff, env)
+
+            elif result.resource_type == "aws_iam_role":
+                remediate_iam_role(result.resource_id, result.diff, env)
+                
+        elif result.drift_type.value in ["MISSING", "UNMANAGED"]:
+            print(f"\n--- {result.drift_type.value} Resource Detected: {result.resource_type} ({result.resource_id}) ---")
+            print(f"⚠️  Auto-remediation for {result.drift_type.value} resources is not executed directly. Please review the AI Analysis in the scan report for the exact `terraform import` or creation commands required to fix this.")

driftwatch_cli-3.0.1/drift_engine/tf_parser.py

@@ -0,0 +1,67 @@
+import json
+
+def load_terraform_state(state_path: str) -> dict:
+    try:
+        with open(state_path) as f:
+            state = json.load(f)
+    except FileNotFoundError:
+        print(f"Error: Terraform state file not found at '{state_path}'")
+        return {}
+    except json.JSONDecodeError:
+        print(f"Error: Terraform state file at '{state_path}' is corrupted or invalid JSON.")
+        return {}
+        
+    resources = {}
+    
+    for resource in state.get("resources", []):
+        r_type = resource["type"]
+        
+        if r_type == "archive_file":
+            continue
+            
+        for instance in resource.get("instances", []):
+            attrs = instance.get("attributes", {})
+            
+            if r_type == "aws_iam_role_policy_attachment":
+                role_name = attrs.get("role")
+                policy_arn = attrs.get("policy_arn")
+                if role_name and policy_arn:
+                    if role_name not in resources:
+                        resources[role_name] = {
+                            "type": "aws_iam_role", 
+                            "name": role_name, 
+                            "attributes": {"id": role_name, "name": role_name, "attached_policies": []}
+                        }
+                    if "attached_policies" not in resources[role_name]["attributes"]:
+                        resources[role_name]["attributes"]["attached_policies"] = []
+                    resources[role_name]["attributes"]["attached_policies"].append(policy_arn)
+                continue
+
+            resource_id = attrs.get("id")
+            
+            tags = attrs.get("tags", {})
+            if tags and tags.get("Name"):
+                name = tags.get("Name")
+            elif r_type == "aws_lambda_function":
+                name = attrs.get("function_name", "Unknown")
+            elif r_type == "aws_db_instance":
+                name = attrs.get("identifier", "Unknown")
+            elif r_type == "aws_iam_role":
+                name = attrs.get("name", "Unknown")
+                if "attached_policies" not in attrs:
+                    attrs["attached_policies"] = []
+            else:
+                name = "Unknown"
+            
+            if resource_id:
+                if resource_id in resources and r_type == "aws_iam_role":
+                    existing_policies = resources[resource_id]["attributes"].get("attached_policies", [])
+                    attrs["attached_policies"] = list(set(attrs.get("attached_policies", []) + existing_policies))
+                    
+                resources[resource_id] = {
+                    "type": r_type, 
+                    "name": name, 
+                    "attributes": attrs
+                }
+                
+    return resources

{driftwatch_cli-3.0.0 → driftwatch_cli-3.0.1}/driftwatch/cli.py

@@ -1,23 +1,13 @@
 import typer
 import os
-import sys
+import boto3
 from datetime import datetime
+from dotenv import load_dotenv
 
-base_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-sys.path.append(base_dir)
-sys.path.append(os.path.join(base_dir, "drift_engine"))
-
-env_file = os.path.join(base_dir, ".env")
-if os.path.exists(env_file):
-    with open(env_file, "r") as f:
-        for line in f:
-            stripped_line = line.strip()
-            if stripped_line and not stripped_line.startswith("#"):
-                if "=" in stripped_line:
-                    k, v = stripped_line.split("=", 1)
-                    os.environ.setdefault(k.strip(), v.strip().strip('"').strip("'"))
-
-from drift_engine.core import detect_drift, get_severity, get_resource_cost, process_drift_results
+load_dotenv()
+
+from drift_engine.core import detect_drift, get_severity
+from drift_engine.aws_client import get_resource_cost
 from drift_engine.explain import get_drift_explanation
 from drift_engine.models import DriftType
 from drift_engine.notifications import process_alerts
@@ -31,15 +21,21 @@ SEVERITY_RANK = {"LOW": 0, "MEDIUM": 1, "HIGH": 2, "CRITICAL": 3}
 @app.command()
 def scan(
     state: str = typer.Option("terraform/terraform.tfstate"),
-    region: str = typer.Option("ap-south-1"),
+    region: str = typer.Option(None),
     fail_on: str = typer.Option(None)
 ):
-    typer.echo("Scanning AWS Infrastructure...\n")
+    actual_region = region or os.environ.get("AWS_DEFAULT_REGION") or boto3.Session().region_name
+    
+    if not actual_region:
+        typer.secho("No AWS region found. Pass --region or set AWS_DEFAULT_REGION.", fg=typer.colors.RED)
+        raise typer.Exit(1)
+
+    typer.echo(f"Scanning AWS Infrastructure in {actual_region}...\n")
     os.environ["TF_STATE_PATH"] = state
-    os.environ["AWS_DEFAULT_REGION"] = region
+    os.environ["AWS_DEFAULT_REGION"] = actual_region
 
     try:
-        results, total_scanned = detect_drift(state, region)
+        results, total_scanned = detect_drift(state, actual_region)
         current_time = datetime.now().strftime("%Y-%m-%d %H:%M:%S IST")
         total_drift = len(results)
 
@@ -77,16 +73,13 @@ def scan(
                 inst_type = r.live_attributes.get("instance_type", "unknown")
                 typer.echo(f"  Type: {inst_type} (created manually in console)")
                 typer.echo(f"  Severity: {severity} | Cost: +Rs.{cost}/month (untracked)")
-
                 ai_text = get_drift_explanation(r.resource_type, r.resource_id, r.live_attributes, r.drift_type.value)
-
             elif r.diff:
                 typer.echo(f"  Severity: {severity}")
                 for attr, vals in r.diff.items():
                     typer.echo(f"  Attribute: {attr}")
                     typer.echo(f"  Terraform: {vals['terraform']}")
                     typer.echo(f"  Live AWS:  {vals['live']}")
-
                 ai_text = get_drift_explanation(r.resource_type, r.resource_id, r.diff, r.drift_type.value)
             else:
                 typer.echo(f"  Severity: {severity}")
@@ -98,8 +91,6 @@ def scan(
             else:
                 typer.echo("\n")
 
-            process_drift_results(r.resource_id, r.drift_type.value, ai_text)
-
         typer.echo(f"Total drift found: {total_drift} resources  |  CRITICAL: {crit_count}  HIGH: {high_count}\n")
 
         process_alerts(results)
@@ -122,19 +113,46 @@ def scan(
         raise typer.Exit(code=1)
 
 @app.command()
-def explain(resource_id: str):
-    typer.echo(f"Fetching AI explanation for {resource_id}...")
-    ai_text = get_drift_explanation("unknown", resource_id, {}, "UNKNOWN")
+def explain(
+    resource_id: str,
+    state: str = typer.Option("terraform/terraform.tfstate"),
+    region: str = typer.Option(None)
+):
+    actual_region = region or os.environ.get("AWS_DEFAULT_REGION") or boto3.Session().region_name
+    
+    if not actual_region:
+        typer.secho("No AWS region found. Pass --region or set AWS_DEFAULT_REGION.", fg=typer.colors.RED)
+        raise typer.Exit(1)
+        
+    typer.echo(f"Fetching current drift state for {resource_id}...")
+    results, _ = detect_drift(state, actual_region)
+    match = [r for r in results if r.resource_id == resource_id]
+    
+    if not match:
+        typer.secho(f"No current drift found for {resource_id}.", fg=typer.colors.YELLOW)
+        raise typer.Exit(code=1)
+        
+    r = match[0]
+    diff_data = r.diff if r.diff else r.live_attributes
+    
+    typer.echo(f"Generating AI explanation...")
+    ai_text = get_drift_explanation(r.resource_type, r.resource_id, diff_data, r.drift_type.value)
     typer.echo(f"\nAI Analysis:\n{ai_text}")
 
 @app.command()
 def remediate(
     resource_id: str,
     state: str = typer.Option("terraform/terraform.tfstate"),
-    region: str = typer.Option("ap-south-1"),
+    region: str = typer.Option(None),
     dry_run: bool = typer.Option(True, "--dry-run/--apply"),
 ):
-    results, _ = detect_drift(state, region)
+    actual_region = region or os.environ.get("AWS_DEFAULT_REGION") or boto3.Session().region_name
+    
+    if not actual_region:
+        typer.secho("No AWS region found. Pass --region or set AWS_DEFAULT_REGION.", fg=typer.colors.RED)
+        raise typer.Exit(1)
+
+    results, _ = detect_drift(state, actual_region)
     match = [r for r in results if r.resource_id == resource_id]
 
     if not match:

{driftwatch_cli-3.0.0 → driftwatch_cli-3.0.1}/driftwatch_cli.egg-info/PKG-INFO

@@ -1,7 +1,10 @@
 Metadata-Version: 2.4
 Name: driftwatch-cli
-Version: 3.0.0
+Version: 3.0.1
 Summary: CLI tool that detects Terraform infrastructure drift against live AWS, explains it with AI, and guides remediation.
+Author: Nitin Gupta
+Project-URL: Homepage, https://github.com/hastagnitin/driftwatch
+Project-URL: Repository, https://github.com/hastagnitin/driftwatch
 Requires-Python: >=3.10
 License-File: LICENSE
 Requires-Dist: boto3
@@ -10,4 +13,5 @@ Requires-Dist: groq
 Requires-Dist: python-telegram-bot
 Requires-Dist: psycopg2-binary
 Requires-Dist: requests
+Requires-Dist: python-dotenv
 Dynamic: license-file

{driftwatch_cli-3.0.0 → driftwatch_cli-3.0.1}/driftwatch_cli.egg-info/requires.txt

@@ -4,3 +4,4 @@ groq
 python-telegram-bot
 psycopg2-binary
 requests
+python-dotenv

{driftwatch_cli-3.0.0 → driftwatch_cli-3.0.1}/pyproject.toml

@@ -4,8 +4,11 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "driftwatch-cli"
-version = "3.0.0"
+version = "3.0.1"
 description = "CLI tool that detects Terraform infrastructure drift against live AWS, explains it with AI, and guides remediation."
+authors = [
+    {name = "Nitin Gupta"}
+]
 requires-python = ">=3.10"
 dependencies = [
     "boto3",
@@ -13,9 +16,14 @@ dependencies = [
     "groq",
     "python-telegram-bot",
     "psycopg2-binary",
-    "requests"
+    "requests",
+    "python-dotenv"
 ]
 
+[project.urls]
+Homepage = "https://github.com/hastagnitin/driftwatch"
+Repository = "https://github.com/hastagnitin/driftwatch"
+
 [project.scripts]
 driftwatch = "driftwatch.cli:app"
 

driftwatch_cli-3.0.0/drift_engine/remediation.py

@@ -1,193 +0,0 @@
-import boto3
-import os
-
-def get_environment_tag(tags):
-    if not tags:
-        return 'unknown'
-    if isinstance(tags, dict):
-        value = tags.get('Environment')
-        return value.lower() if value else 'unknown'
-    for tag in tags:
-        if isinstance(tag, dict) and tag.get('Key') == 'Environment':
-            return tag.get('Value').lower()
-    return 'unknown'
-
-def confirm_action(action_desc: str, env: str = 'unknown', is_disruptive: bool = False) -> bool:
-    if env in ['dev', 'staging']:
-        print(f"[*] [{env.upper()}] Auto-approving: {action_desc}")
-        return True
-
-    print(f"[!] [{env.upper()}] Protection Active. Manual action required.")
-    if is_disruptive:
-        print("[!] WARNING: This is a disruptive action -> Downtime risk!")
-
-    while True:
-        choice = input(f"⚠️ {action_desc}. Proceed? (y/n): ").strip().lower()
-        if choice in ['y', 'yes']:
-            return True
-        elif choice in ['n', 'no']:
-            return False
-        print("Invalid input. Please enter 'y' or 'n'.")
-
-def remediate_ec2_instance_type(region: str, instance_id: str, expected_type: str, env: str):
-    if not confirm_action(f"Change EC2 {instance_id} instance type to {expected_type}", env, True):
-        print(f"⏭️  Skipped remediation for EC2 {instance_id}")
-        return
-
-    ec2 = boto3.client('ec2', region_name=region)
-    print(f"Stopping instance {instance_id} for remediation...")
-    ec2.stop_instances(InstanceIds=[instance_id])
-    waiter = ec2.get_waiter('instance_stopped')
-    waiter.wait(InstanceIds=[instance_id])
-    print(f"Modifying instance type to {expected_type}...")
-    ec2.modify_instance_attribute(
-        InstanceId=instance_id,
-        InstanceType={'Value': expected_type}
-    )
-    print(f"Restarting instance {instance_id}...")
-    ec2.start_instances(InstanceIds=[instance_id])
-    print(f"✅ [REMEDIATED] Successfully remediated {instance_id} back to {expected_type}")
-
-def remediate_security_group(region: str, sg_id: str, diff_data: dict, env: str):
-    ec2 = boto3.client('ec2', region_name=region)
-    expected_ingress = diff_data.get("ingress", {}).get("terraform", [])
-    live_ingress = diff_data.get("ingress", {}).get("live", [])
-    
-    print(f"Checking Security Group {sg_id} for unauthorized rules...")
-    for live_rule in live_ingress:
-        is_authorized = False
-        for exp_rule in expected_ingress:
-            if (live_rule.get('from_port') == exp_rule.get('from_port') and
-                live_rule.get('to_port') == exp_rule.get('to_port') and
-                live_rule.get('protocol') == exp_rule.get('protocol')):
-                is_authorized = True
-                break
-                
-        if not is_authorized:
-            if confirm_action(f"Revoke unauthorized rule (Port {live_rule.get('from_port')}) in {sg_id}", env, False):
-                print(f"Revoking unauthorized rule: {live_rule}")
-                try:
-                    ec2.revoke_security_group_ingress(
-                        GroupId=sg_id,
-                        IpPermissions=[{
-                            'IpProtocol': live_rule['protocol'],
-                            'FromPort': live_rule['from_port'],
-                            'ToPort': live_rule['to_port'],
-                            'IpRanges': [{'CidrIp': cidr} for cidr in live_rule.get('cidr_blocks', []) if cidr]
-                        }]
-                    )
-                    print(f"✅ [REMEDIATED] Successfully removed unauthorized Inbound Rule from {sg_id}")
-                except Exception as e:
-                    print(f"❌ Failed to revoke rule in {sg_id}: {e}")
-            else:
-                print(f"⏭️  Skipped revoking rule for Port {live_rule.get('from_port')}")
-
-    print(f"Checking Security Group {sg_id} for missing IaC rules...")
-    for exp_rule in expected_ingress:
-        is_missing = True
-        for live_rule in live_ingress:
-            if (live_rule.get('from_port') == exp_rule.get('from_port') and
-                live_rule.get('to_port') == exp_rule.get('to_port') and
-                live_rule.get('protocol') == exp_rule.get('protocol')):
-                is_missing = False
-                break
-        
-        if is_missing:
-            if confirm_action(f"Restore missing IaC rule (Port {exp_rule.get('from_port')}) in {sg_id}", env, False):
-                print(f"Restoring missing IaC rule: Port {exp_rule.get('from_port')}")
-                try:
-                    ec2.authorize_security_group_ingress(
-                        GroupId=sg_id,
-                        IpPermissions=[{
-                            'IpProtocol': exp_rule['protocol'],
-                            'FromPort': exp_rule['from_port'],
-                            'ToPort': exp_rule['to_port'],
-                            'IpRanges': [{'CidrIp': cidr} for cidr in exp_rule.get('cidr_blocks', []) if cidr]
-                        }]
-                    )
-                    print(f"✅ [REMEDIATED] Successfully restored missing IaC Inbound Rule to {sg_id}")
-                except Exception as e:
-                    print(f"❌ Failed to restore rule in {sg_id}: {e}")
-            else:
-                print(f"⏭️  Skipped restoring rule for Port {exp_rule.get('from_port')}")
-                
-    print(f"Completed remediation check for Security Group {sg_id}")
-
-def remediate_s3_bucket(bucket_name: str, env: str):
-    if not confirm_action(f"Enforce strict Public Access Block on S3 Bucket '{bucket_name}'", env, False):
-        print(f"⏭️  Skipped remediation for S3 bucket {bucket_name}")
-        return
-
-    s3 = boto3.client('s3')
-    print(f"Remediating S3 Bucket {bucket_name} by enforcing public access block...")
-    try:
-        s3.put_public_access_block(
-            Bucket=bucket_name,
-            PublicAccessBlockConfiguration={
-                'BlockPublicAcls': True,
-                'IgnorePublicAcls': True,
-                'BlockPublicPolicy': True,
-                'RestrictPublicBuckets': True
-            }
-        )
-        print(f"✅ [REMEDIATED] Successfully blocked public access for {bucket_name}")
-    except Exception as e:
-        print(f"❌ Failed to remediate S3 bucket {bucket_name}: {e}")
-
-def remediate_iam_role(role_name: str, diff_data: dict, env: str):
-    iam = boto3.client('iam')
-    expected_policies = diff_data.get("attached_policies", {}).get("terraform", [])
-    live_policies = diff_data.get("attached_policies", {}).get("live", [])
-
-    print(f"Checking IAM Role {role_name} for unauthorized policies...")
-    for live_policy in live_policies:
-        if live_policy not in expected_policies:
-            if confirm_action(f"Detach unauthorized policy '{live_policy}' from Role '{role_name}'", env, False):
-                print(f"Detaching unauthorized policy: {live_policy}")
-                try:
-                    iam.detach_role_policy(
-                        RoleName=role_name,
-                        PolicyArn=live_policy
-                    )
-                    print(f"✅ [REMEDIATED] Successfully detached {live_policy} from {role_name}")
-                except Exception as e:
-                    print(f"❌ Failed to detach policy from {role_name}: {e}")
-            else:
-                print(f"⏭️  Skipped detaching policy {live_policy}")
-
-def process_remediation(drift_results: list):
-    region = os.environ.get("AWS_DEFAULT_REGION", "ap-south-1")
-    for result in drift_results:
-        attrs = result.live_attributes or result.tf_attributes or {}
-        tags = attrs.get('tags', {})
-        env = get_environment_tag(tags)
-
-        if result.drift_type.value == "MODIFIED":
-            if result.resource_type == "aws_instance" and "instance_type" in result.diff:
-                expected_type = result.diff["instance_type"]["terraform"]
-                print(f"\n--- Drift Detected: EC2 Instance ({result.resource_id}) ---")
-                try:
-                    remediate_ec2_instance_type(region, result.resource_id, expected_type, env)
-                except Exception as e:
-                    print(f"Remediation failed for {result.resource_id}: {e}")
-            
-            elif result.resource_type == "aws_security_group" and "ingress" in result.diff:
-                print(f"\n--- Drift Detected: Security Group ({result.resource_id}) ---")
-                try:
-                    remediate_security_group(region, result.resource_id, result.diff, env)
-                except Exception as e:   
-                    print(f"Remediation failed for {result.resource_id}: {e}")
-
-            elif result.resource_type == "aws_s3_bucket":
-                print(f"\n--- Drift Detected: S3 Bucket ({result.resource_id}) ---")
-                try:
-                    remediate_s3_bucket(result.resource_id, env)
-                except Exception as e:
-                    print(f"Remediation failed for {result.resource_id}: {e}")
-
-            elif result.resource_type == "aws_iam_role" and "attached_policies" in result.diff:
-                print(f"\n--- Drift Detected: IAM Role ({result.resource_id}) ---")
-                try:
-                    remediate_iam_role(result.resource_id, result.diff, env)
-                except Exception as e:
-                    print(f"Remediation failed for {result.resource_id}: {e}")

driftwatch_cli-3.0.0/drift_engine/tf_parser.py

@@ -1,40 +0,0 @@
-import json
-
-def load_terraform_state(state_path: str) -> dict:
-    try:
-        with open(state_path) as f:
-            state = json.load(f)
-    except FileNotFoundError:
-        print(f"Error: Terraform state file not found at '{state_path}'")
-        return {}
-        
-    resources = {}
-    for resource in state.get("resources", []):
-        r_type = resource["type"]
-        
-        if r_type in ["archive_file", "aws_iam_role_policy_attachment"]:
-            continue
-            
-        for instance in resource.get("instances", []):
-            attrs = instance.get("attributes", {})
-            resource_id = attrs.get("id")
-            
-            tags = attrs.get("tags", {})
-            if tags and tags.get("Name"):
-                name = tags.get("Name")
-            elif r_type == "aws_lambda_function":
-                name = attrs.get("function_name", "Unknown")
-            elif r_type == "aws_db_instance":
-                name = attrs.get("identifier", "Unknown")
-            elif r_type == "aws_iam_role":
-                name = attrs.get("name", "Unknown")
-            else:
-                name = "Unknown"
-            
-            if resource_id:
-                resources[resource_id] = {
-                    "type": r_type, 
-                    "name": name, 
-                    "attributes": attrs
-                }
-    return resources