inventag-aws 5.0.0__tar.gz

inventag_aws-5.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 InvenTag Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

inventag_aws-5.0.0/PKG-INFO

@@ -0,0 +1,175 @@
+Metadata-Version: 2.4
+Name: inventag-aws
+Version: 5.0.0
+Summary: AWS resource inventory, tag compliance checks, and Excel/Word BOM reports. Read-only.
+Author: InvenTag Contributors
+License-Expression: MIT
+Project-URL: Homepage, https://habhabhabs.github.io/inventag-aws/
+Project-URL: Documentation, https://habhabhabs.github.io/inventag-aws/docs/
+Project-URL: Source, https://github.com/habhabhabs/inventag-aws
+Project-URL: Issues, https://github.com/habhabhabs/inventag-aws/issues
+Project-URL: Changelog, https://github.com/habhabhabs/inventag-aws/blob/main/CHANGELOG.md
+Keywords: aws,inventory,bom,tagging,compliance
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: boto3>=1.35.0
+Requires-Dist: PyYAML>=6.0
+Requires-Dist: openpyxl>=3.0.0
+Requires-Dist: python-docx>=0.8.11
+Requires-Dist: colorama>=0.4.4
+Requires-Dist: semver>=3.0.0
+Requires-Dist: psutil>=5.9.0
+Requires-Dist: keyring>=24.0.0
+Requires-Dist: cryptography>=50.0.0
+Requires-Dist: requests>=2.33.0
+Requires-Dist: urllib3>=2.8.0
+Requires-Dist: certifi>=2026.10.18
+Requires-Dist: idna>=3.15
+Requires-Dist: lxml>=6.1.0
+Dynamic: license-file
+
+<p align="center">
+  <img src="website/static/img/logo-wordmark.svg#gh-light-mode-only" alt="InvenTag" width="366" height="96">
+  <img src="website/static/img/logo-wordmark-dark.svg#gh-dark-mode-only" alt="InvenTag" width="366" height="96">
+</p>
+
+<p align="center">
+  <strong>Find out what is running in your AWS accounts, check it is tagged properly, and hand over an Excel or Word bill of materials.</strong>
+</p>
+
+[![Automated Release](https://github.com/habhabhabs/inventag-aws/workflows/Automated%20Release/badge.svg)](https://github.com/habhabhabs/inventag-aws/actions)
+[![Documentation](https://github.com/habhabhabs/inventag-aws/workflows/Documentation%20Deployment/badge.svg)](https://habhabhabs.github.io/inventag-aws/)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+**Docs:** <https://habhabhabs.github.io/inventag-aws/>
+
+## Quick start
+
+```bash
+git clone https://github.com/habhabhabs/inventag-aws.git
+cd inventag-aws
+python3 -m venv .venv && source .venv/bin/activate
+pip install -r requirements.txt
+
+./inventag.sh --validate-credentials       # uses your current AWS credentials
+./inventag.sh --create-excel --verbose     # -> bom_output/multi_account_bom_<timestamp>.xlsx
+```
+
+Use a read-only IAM identity. By default, discovery makes two Cost Explorer
+requests for each account, and AWS bills each request. Add
+`--no-billing-validation` to make no Cost Explorer request. Details:
+[Installation](https://habhabhabs.github.io/inventag-aws/docs/getting-started/installation).
+
+## What it does
+
+- **Discovery** across accounts and regions through the Resource Groups Tagging
+  API, per-service `List*`/`Describe*`/`Get*` calls and Cost Explorer billing data.
+- **Bill of materials** as an Excel workbook (`--create-excel`) and/or Word
+  document (`--create-word`), with your own tag columns (`--tag-mappings`) and
+  service descriptions (`--service-descriptions`).
+- **Report templates** (`--word-template`, `--excel-template`): a YAML or JSON
+  file selects the title, the sections or sheets, the columns, and the header
+  and footer text.
+- **Several accounts** from a file (`--accounts-file`), interactively
+  (`--accounts-prompt`) or through an assumed role (`--cross-account-role`),
+  processed in parallel.
+- **Change tracking**: each run saves a snapshot in `bom_output/state/`; the
+  next run reports what was added, removed or changed.
+- **Upload to Amazon S3** (`--s3-bucket`) with server-side encryption.
+- **Read-only guard**: the CLI blocks each AWS API call that is not a read
+  operation. `--audit-output audit.json` writes a list of the calls.
+- **Tag-policy checks** (required tags, allowed values) with
+  `scripts/legacy/tag_compliance_checker.py --config policy.yaml`.
+
+### Not implemented
+
+These flags stop the CLI with an error message and exit code `2`:
+`--create-google-docs`, `--per-account-reports`, `--compliance-standard`,
+`--risk-threshold` and `--disable-production-safety`. InvenTag does not certify
+compliance with SOC 2 or other standards. For the full list, see
+[Current status and known limitations](https://habhabhabs.github.io/inventag-aws/docs/getting-started/status).
+
+## More examples
+
+```bash
+# Several accounts, Excel + Word, your own tag columns
+./inventag.sh --accounts-file accounts.json \
+  --create-excel --create-word \
+  --tag-mappings config/defaults/mappings/tag_to_column_mappings_example.yaml \
+  --service-descriptions config/defaults/services/service_descriptions_example.yaml
+
+# Assume a read-only role (full role ARN)
+./inventag.sh --cross-account-role arn:aws:iam::123456789012:role/InvenTagReadOnly \
+  --create-excel
+
+# Assume the same role name in each account of accounts.json
+./inventag.sh --accounts-file accounts.json --cross-account-role InvenTagReadOnly \
+  --create-excel
+
+# Upload the reports to S3 (server-side encrypted)
+./inventag.sh --create-excel --s3-bucket my-reports-bucket
+
+# Faster runs: fewer regions, more accounts in parallel
+./inventag.sh --accounts-file accounts.json --create-excel \
+  --account-regions us-east-1,ap-southeast-1 --max-concurrent-accounts 8
+```
+
+Every flag: [CLI user guide](https://habhabhabs.github.io/inventag-aws/docs/user-guides/cli-user-guide).
+
+## Documentation
+
+| Section | Link |
+|---|---|
+| Quick start | [docs/getting-started/quick-start.md](docs/getting-started/quick-start.md) |
+| Current status and known limitations | [docs/getting-started/status.md](docs/getting-started/status.md) |
+| CLI user guide | [docs/user-guides/cli-user-guide.md](docs/user-guides/cli-user-guide.md) |
+| Configuration examples | [docs/user-guides/configuration-examples.md](docs/user-guides/configuration-examples.md) |
+| Report templates | [docs/user-guides/report-templates.md](docs/user-guides/report-templates.md) |
+| Permissions and production safety | [docs/user-guides/production-safety.md](docs/user-guides/production-safety.md) |
+| Architecture | [docs/architecture/core-module-integration.md](docs/architecture/core-module-integration.md) |
+| Contributing | [docs/development/CONTRIBUTING.md](docs/development/CONTRIBUTING.md) |
+
+The same Markdown files are published as the documentation site (Docusaurus,
+in `website/`). Brand assets (logo, favicon, social card) and the script that
+regenerates them live in [`website/brand/`](website/brand/README.md).
+
+## Project layout
+
+```text
+inventag-aws/
+├── inventag_cli.py              # CLI entry point (inventag.sh / inventag.bat wrap it)
+├── inventag/                    # Python package: cli, core, discovery, compliance, reporting, state
+├── scripts/legacy/              # standalone scripts (inventory, tag compliance, BOM converter)
+├── config/                      # example configs, IAM policy, JSON schemas
+├── examples/                    # account files and CI examples
+├── docs/                        # documentation (Markdown)
+├── website/                     # Docusaurus site, brand assets
+└── tests/
+```
+
+## Support
+
+- [Issues](https://github.com/habhabhabs/inventag-aws/issues): bugs and feature requests
+- [Discussions](https://github.com/habhabhabs/inventag-aws/discussions): questions
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+---
+
+*AWS is a trademark of Amazon.com, Inc. or its affiliates. InvenTag is an
+independent tool and is not affiliated with, endorsed by, or sponsored by
+Amazon Web Services, Inc.*

inventag_aws-5.0.0/README.md

@@ -0,0 +1,134 @@
+<p align="center">
+  <img src="website/static/img/logo-wordmark.svg#gh-light-mode-only" alt="InvenTag" width="366" height="96">
+  <img src="website/static/img/logo-wordmark-dark.svg#gh-dark-mode-only" alt="InvenTag" width="366" height="96">
+</p>
+
+<p align="center">
+  <strong>Find out what is running in your AWS accounts, check it is tagged properly, and hand over an Excel or Word bill of materials.</strong>
+</p>
+
+[![Automated Release](https://github.com/habhabhabs/inventag-aws/workflows/Automated%20Release/badge.svg)](https://github.com/habhabhabs/inventag-aws/actions)
+[![Documentation](https://github.com/habhabhabs/inventag-aws/workflows/Documentation%20Deployment/badge.svg)](https://habhabhabs.github.io/inventag-aws/)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+**Docs:** <https://habhabhabs.github.io/inventag-aws/>
+
+## Quick start
+
+```bash
+git clone https://github.com/habhabhabs/inventag-aws.git
+cd inventag-aws
+python3 -m venv .venv && source .venv/bin/activate
+pip install -r requirements.txt
+
+./inventag.sh --validate-credentials       # uses your current AWS credentials
+./inventag.sh --create-excel --verbose     # -> bom_output/multi_account_bom_<timestamp>.xlsx
+```
+
+Use a read-only IAM identity. By default, discovery makes two Cost Explorer
+requests for each account, and AWS bills each request. Add
+`--no-billing-validation` to make no Cost Explorer request. Details:
+[Installation](https://habhabhabs.github.io/inventag-aws/docs/getting-started/installation).
+
+## What it does
+
+- **Discovery** across accounts and regions through the Resource Groups Tagging
+  API, per-service `List*`/`Describe*`/`Get*` calls and Cost Explorer billing data.
+- **Bill of materials** as an Excel workbook (`--create-excel`) and/or Word
+  document (`--create-word`), with your own tag columns (`--tag-mappings`) and
+  service descriptions (`--service-descriptions`).
+- **Report templates** (`--word-template`, `--excel-template`): a YAML or JSON
+  file selects the title, the sections or sheets, the columns, and the header
+  and footer text.
+- **Several accounts** from a file (`--accounts-file`), interactively
+  (`--accounts-prompt`) or through an assumed role (`--cross-account-role`),
+  processed in parallel.
+- **Change tracking**: each run saves a snapshot in `bom_output/state/`; the
+  next run reports what was added, removed or changed.
+- **Upload to Amazon S3** (`--s3-bucket`) with server-side encryption.
+- **Read-only guard**: the CLI blocks each AWS API call that is not a read
+  operation. `--audit-output audit.json` writes a list of the calls.
+- **Tag-policy checks** (required tags, allowed values) with
+  `scripts/legacy/tag_compliance_checker.py --config policy.yaml`.
+
+### Not implemented
+
+These flags stop the CLI with an error message and exit code `2`:
+`--create-google-docs`, `--per-account-reports`, `--compliance-standard`,
+`--risk-threshold` and `--disable-production-safety`. InvenTag does not certify
+compliance with SOC 2 or other standards. For the full list, see
+[Current status and known limitations](https://habhabhabs.github.io/inventag-aws/docs/getting-started/status).
+
+## More examples
+
+```bash
+# Several accounts, Excel + Word, your own tag columns
+./inventag.sh --accounts-file accounts.json \
+  --create-excel --create-word \
+  --tag-mappings config/defaults/mappings/tag_to_column_mappings_example.yaml \
+  --service-descriptions config/defaults/services/service_descriptions_example.yaml
+
+# Assume a read-only role (full role ARN)
+./inventag.sh --cross-account-role arn:aws:iam::123456789012:role/InvenTagReadOnly \
+  --create-excel
+
+# Assume the same role name in each account of accounts.json
+./inventag.sh --accounts-file accounts.json --cross-account-role InvenTagReadOnly \
+  --create-excel
+
+# Upload the reports to S3 (server-side encrypted)
+./inventag.sh --create-excel --s3-bucket my-reports-bucket
+
+# Faster runs: fewer regions, more accounts in parallel
+./inventag.sh --accounts-file accounts.json --create-excel \
+  --account-regions us-east-1,ap-southeast-1 --max-concurrent-accounts 8
+```
+
+Every flag: [CLI user guide](https://habhabhabs.github.io/inventag-aws/docs/user-guides/cli-user-guide).
+
+## Documentation
+
+| Section | Link |
+|---|---|
+| Quick start | [docs/getting-started/quick-start.md](docs/getting-started/quick-start.md) |
+| Current status and known limitations | [docs/getting-started/status.md](docs/getting-started/status.md) |
+| CLI user guide | [docs/user-guides/cli-user-guide.md](docs/user-guides/cli-user-guide.md) |
+| Configuration examples | [docs/user-guides/configuration-examples.md](docs/user-guides/configuration-examples.md) |
+| Report templates | [docs/user-guides/report-templates.md](docs/user-guides/report-templates.md) |
+| Permissions and production safety | [docs/user-guides/production-safety.md](docs/user-guides/production-safety.md) |
+| Architecture | [docs/architecture/core-module-integration.md](docs/architecture/core-module-integration.md) |
+| Contributing | [docs/development/CONTRIBUTING.md](docs/development/CONTRIBUTING.md) |
+
+The same Markdown files are published as the documentation site (Docusaurus,
+in `website/`). Brand assets (logo, favicon, social card) and the script that
+regenerates them live in [`website/brand/`](website/brand/README.md).
+
+## Project layout
+
+```text
+inventag-aws/
+├── inventag_cli.py              # CLI entry point (inventag.sh / inventag.bat wrap it)
+├── inventag/                    # Python package: cli, core, discovery, compliance, reporting, state
+├── scripts/legacy/              # standalone scripts (inventory, tag compliance, BOM converter)
+├── config/                      # example configs, IAM policy, JSON schemas
+├── examples/                    # account files and CI examples
+├── docs/                        # documentation (Markdown)
+├── website/                     # Docusaurus site, brand assets
+└── tests/
+```
+
+## Support
+
+- [Issues](https://github.com/habhabhabs/inventag-aws/issues): bugs and feature requests
+- [Discussions](https://github.com/habhabhabs/inventag-aws/discussions): questions
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+---
+
+*AWS is a trademark of Amazon.com, Inc. or its affiliates. InvenTag is an
+independent tool and is not affiliated with, endorsed by, or sponsored by
+Amazon Web Services, Inc.*

inventag_aws-5.0.0/inventag/__init__.py

@@ -0,0 +1,77 @@
+"""
+InvenTag - Unified AWS Cloud Governance Platform
+
+A comprehensive Python package for AWS resource discovery, compliance checking,
+professional BOM (Bill of Materials) document generation, and state management
+with advanced change tracking capabilities.
+
+This package transforms the proven functionality from standalone scripts into
+a unified, enterprise-grade platform suitable for both CLI usage and service deployment.
+"""
+
+# Must stay first: fails with a plain message on Python older than 3.11.
+from ._python_version import MIN_PYTHON, check_python_version
+
+check_python_version()
+
+from ._version import __version__
+
+__author__ = "InvenTag Team"
+
+# Core modules
+from .discovery import AWSResourceInventory
+from .compliance import ComprehensiveTagComplianceChecker
+from .reporting import BOMConverter
+
+# Analysis modules
+from .discovery.network_analyzer import NetworkAnalyzer
+
+# State management modules
+from .state import StateManager, DeltaDetector, ChangelogGenerator
+
+# Main orchestrator
+from .core import (
+    CloudBOMGenerator,
+    MultiAccountConfig,
+    AccountContext,
+    AccountCredentials,
+    CredentialManager,
+    CredentialValidationResult,
+    CICDIntegration,
+    S3UploadConfig,
+    ComplianceGateConfig,
+    NotificationConfig,
+    PrometheusConfig,
+    PrometheusMetrics,
+    CICDResult,
+)
+
+# CLI components
+from .cli import main as cli_main, create_parser, ConfigValidator, setup_logging
+
+__all__ = [
+    "AWSResourceInventory",
+    "ComprehensiveTagComplianceChecker",
+    "BOMConverter",
+    "NetworkAnalyzer",
+    "StateManager",
+    "DeltaDetector",
+    "ChangelogGenerator",
+    "CloudBOMGenerator",
+    "MultiAccountConfig",
+    "AccountContext",
+    "AccountCredentials",
+    "CredentialManager",
+    "CredentialValidationResult",
+    "CICDIntegration",
+    "S3UploadConfig",
+    "ComplianceGateConfig",
+    "NotificationConfig",
+    "PrometheusConfig",
+    "PrometheusMetrics",
+    "CICDResult",
+    "cli_main",
+    "create_parser",
+    "ConfigValidator",
+    "setup_logging",
+]

inventag_aws-5.0.0/inventag/_python_version.py

@@ -0,0 +1,31 @@
+"""
+Minimum supported Python version.
+
+This module is imported first by ``inventag/__init__.py``. Keep it free of
+syntax newer than Python 2.7 / 3.0 (no f-strings, no annotations), so that an
+old interpreter reaches the plain error message below instead of failing with
+a SyntaxError somewhere else in the package.
+"""
+
+import sys
+
+MIN_PYTHON = (3, 11)
+
+
+def unsupported_python_message(version_info=None):
+    """Return an error message if ``version_info`` is too old, else ``None``."""
+    version_info = sys.version_info if version_info is None else version_info
+    if tuple(version_info[:2]) >= MIN_PYTHON:
+        return None
+    return (
+        "InvenTag requires Python %d.%d or later; this interpreter is Python %d.%d. "
+        "Install a newer Python (https://www.python.org/downloads/) and run "
+        "InvenTag with it." % (MIN_PYTHON + tuple(version_info[:2]))
+    )
+
+
+def check_python_version(version_info=None):
+    """Raise ``ImportError`` with a plain message on an unsupported Python."""
+    message = unsupported_python_message(version_info)
+    if message:
+        raise ImportError(message)

inventag_aws-5.0.0/inventag/_version.py

@@ -0,0 +1,6 @@
+"""Single source of the InvenTag version.
+
+The release workflow rewrites this file. pyproject.toml reads it at build time.
+"""
+
+__version__ = "5.0.0"

inventag_aws-5.0.0/inventag/cli/__init__.py

@@ -0,0 +1,12 @@
+"""
+Command Line Interface for InvenTag
+
+Comprehensive CLI with multi-account support, format-specific options,
+S3 upload capabilities, and extensive configuration management.
+"""
+
+from .main import main, create_parser
+from .config_validator import ConfigValidator
+from .logging_setup import setup_logging
+
+__all__ = ["main", "create_parser", "ConfigValidator", "setup_logging"]