tf-eu-guard 0.1.0__tar.gz

tf_eu_guard-0.1.0/.claude/settings.local.json

@@ -0,0 +1,11 @@
+{
+  "permissions": {
+    "allow": [
+      "Skill(update-config)",
+      "Skill(update-config:*)",
+      "WebFetch(domain:eur-lex.europa.eu)",
+      "WebSearch",
+      "WebFetch(domain:github.com)"
+    ]
+  }
+}

tf_eu_guard-0.1.0/.claude/skills/tf-eu-guard/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: tf-eu-guard
+description: Scan Terraform/IaC for EU compliance gaps (NIS2 + GDPR) using the tf-eu-guard CLI, which wraps Checkov and maps each finding to specific NIS2 Art. 21(2) and GDPR Art. 32 articles. Use when the user asks to check Terraform for NIS2, GDPR, or EU compliance, map a Checkov scan to EU regulations, or produce a compliance report for infrastructure-as-code.
+---
+
+# tf-eu-guard — EU compliance scan for Terraform
+
+`tf-eu-guard` runs Checkov against Terraform, keeps only the findings that map to an EU
+compliance article, and enriches each with its **NIS2 Art. 21(2)** / **GDPR Art. 32** (and
+44–49) reference, a plain-language risk, remediation, and a severity.
+
+## When to use
+- The user asks to check Terraform / IaC for **NIS2**, **GDPR**, or "EU compliance".
+- The user has a Checkov JSON result and wants it mapped to EU regulatory requirements.
+- The user wants a compliance report (terminal, HTML, or JSON) for a Terraform stack.
+
+## Prerequisites
+Run from the repo root. Install once (this also installs Checkov 3.3.13; requires Python ≥ 3.10):
+
+```bash
+pip install -e .
+```
+
+Verify with `tf-eu-guard version` (should print a version string).
+
+## How to run
+
+**Mode 1 — scan a Terraform directory** (tf-eu-guard runs Checkov itself):
+
+```bash
+tf-eu-guard scan <terraform-dir> --output json --framework all
+```
+
+**Mode 2 — reuse a Checkov JSON the user already has** (no re-scan):
+
+```bash
+# from a file
+tf-eu-guard scan --checkov-json <file.json> --output json
+
+# or piped from a fresh Checkov run (use '-' for stdin)
+checkov -d <terraform-dir> --output json --framework terraform --quiet \
+  | tf-eu-guard scan --checkov-json - --output json
+```
+
+Flags:
+- `--output` — `dev` (Rich terminal), `json` (machine-readable), `security` (HTML dashboard
+  with severity breakdown), `auditor` (HTML article-by-article compliance matrix), or `all`
+  (writes the dev, security, and auditor HTML reports together). For a compliance review,
+  recommend `--output auditor`; for full coverage, `--output all`.
+- `--framework` — `nis2`, `gdpr`, or `all` (default). Filters to findings citing that framework.
+- `--fail-on-severity {CRITICAL,HIGH,MEDIUM,LOW}` / `--fail-on-any` — exit code 1 when
+  findings meet the threshold (CI/CD gating).
+
+Prefer `--output json` when you (Claude) will parse and summarize the result. HTML reports are
+written to `reports/` (or `--output-dir`); mention the file paths to the user so they can open them.
+
+## Interpreting the output
+Each finding has `check_id`, `severity` (CRITICAL/HIGH/MEDIUM), `resource`, `file_path`, and one
+or more `articles` (`{framework, article}`). Checkov findings with **no** EU mapping are dropped
+by design, so an empty result means "no *mapped* compliance gaps", not "no Checkov findings".
+
+When reporting back to the user:
+1. Give counts by severity and by framework (NIS2 vs GDPR).
+2. List the top findings (resource + file + the article each violates).
+3. For remediation detail, point to `docs/nis2-mapping.md` and `docs/gdpr-mapping.md`.
+
+## Notes
+- The compliance mappings live in `tf_eu_guard/mapping/registry.yaml`.
+- `examples/vulnerable-aws/` (and the broader `examples/end2end/` suite) are intentionally-insecure stacks you can use to demo the tool.
+- If Bash permission prompts are noisy, the user can allow `Bash(tf-eu-guard scan:*)` and
+  `Bash(checkov:*)` in `.claude/settings.local.json`.

tf_eu_guard-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,128 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          pip install -e ".[dev]"
+
+      - name: Lint with ruff
+        run: |
+          ruff check tf_eu_guard/
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          pip install -e ".[dev]"
+
+      - name: Run tests
+        run: |
+          pytest
+
+      - name: Validate registry schema
+        run: |
+          python -c "from tf_eu_guard.mapping.loader import validate_all; print(validate_all())"
+
+  example-scan:
+    runs-on: ubuntu-latest
+    needs: test
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install tf-eu-guard
+        run: |
+          pip install -e .
+
+      - name: Scan vulnerable examples
+        run: |
+          tf-eu-guard scan examples/vulnerable-aws/ --output all
+
+      - name: Scan Azure/GCP examples
+        run: |
+          set -euo pipefail
+          for d in vulnerable-azure vulnerable-gcp; do
+            tf-eu-guard scan "examples/$d/" --output json > "scan-$d.json"
+            count=$(jq 'length' "scan-$d.json")
+            if [ "$count" -lt 1 ]; then
+              echo "::error::$d produced $count mapped findings (expected several)"
+              exit 1
+            fi
+            echo "OK: $d -> $count mapped findings"
+          done
+
+      - name: Scan end2end test suite
+        run: |
+          tf-eu-guard scan examples/end2end/ --output dev
+
+      - name: Assert custom EU-compliance checks fire
+        run: |
+          set -euo pipefail
+          tf-eu-guard scan examples/end2end/ --output json > scan.json
+          for id in EUGUARD_GDPR_001 EUGUARD_NIS2_001; do
+            if grep -q "\"$id\"" scan.json; then
+              echo "OK: $id fired and was enriched"
+            else
+              echo "::error::Custom check $id did not fire against examples/end2end/ (external-check loading may be broken)"
+              exit 1
+            fi
+          done
+
+      - name: Scan compliant examples (should be clean)
+        run: |
+          set -euo pipefail
+          tf-eu-guard scan examples/compliant-aws/ --output json > compliant-scan.json
+          # --output json emits a top-level array of enriched findings
+          finding_count=$(jq 'length' compliant-scan.json)
+          if [ "$finding_count" -le 2 ]; then
+            echo "OK: Compliant example has $finding_count mapped findings (acceptable threshold)"
+          else
+            echo "::warning::Compliant example has $finding_count mapped findings (expected 0-2)"
+          fi
+
+      - name: Upload HTML reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: compliance-reports
+          path: |
+            dev-report.html
+            scan-report.html
+            auditor-report.html
+          retention-days: 30

tf_eu_guard-0.1.0/.gitignore

@@ -0,0 +1,54 @@
+# Python bytecode
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+
+# Virtual environments
+venv/
+env/
+ENV/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# Project-specific
+checkov-repo/
+*.log
+
+# Generated HTML reports (tf-eu-guard --output security|auditor|all)
+# Stored in reports/ directory with timestamped format: dev_report_DDMMYYYYHHMM.html
+reports/
+tests/results/*.html
+
+# OS
+.DS_Store
+Thumbs.db
+.ruff_cache/

tf_eu_guard-0.1.0/.pre-commit-hooks.yaml

@@ -0,0 +1,7 @@
+- id: tf-eu-guard
+  name: tf-eu-guard EU Compliance Check
+  description: Scans Terraform for NIS2/GDPR compliance gaps and fails on findings.
+  entry: tf-eu-guard scan
+  language: python
+  files: \.tf$
+  args: ['--output', 'dev', '--fail-on-severity', 'HIGH']

tf_eu_guard-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,89 @@
+# Contributing to tf-eu-guard
+
+Thanks for your interest in improving EU infrastructure compliance tooling!
+
+## Ways to contribute
+
+1. **Registry expansion** — map more Checkov checks to NIS2/GDPR articles (the highest-value contribution)
+2. **New custom checks** — EU-specific patterns upstream Checkov doesn't cover
+3. **Report improvements** — better visualizations, export formats
+4. **Bug fixes & docs**
+
+For registry expansion, please **open an issue first** describing the checks you
+want to map — this avoids duplicate work and lets us discuss article choices
+before you invest time in a PR.
+
+## Proposing a new mapping
+
+The registry is split per provider in `tf_eu_guard/mapping/`:
+
+| File | Provider |
+|------|----------|
+| `registry-aws.yaml` | AWS (116 mappings) |
+| `registry-azure.yaml` | Azure (23 mappings) |
+| `registry-gcp.yaml` | GCP (22 mappings) |
+
+### Schema
+
+Every entry must have these fields (validated in CI by
+`tf_eu_guard.mapping.loader.validate_all`):
+
+```yaml
+CKV_AWS_18:
+  check_name: "Ensure the S3 bucket has access logging enabled"
+  articles:                          # at least one; framework must be NIS2 or GDPR
+    - framework: NIS2
+      article: "Art. 21(2)(b)"       # format: "Art. N(P)(letter)" or "Art. N"
+      title: "Incident handling"
+    - framework: GDPR
+      article: "Art. 32(1)(b)"
+      title: "Confidentiality, integrity and availability"
+  risk: "Plain-language explanation citing the specific legal requirement."
+  remediation: |
+    resource "aws_s3_bucket" "example" {
+      # copy-pasteable Terraform
+    }
+  severity: MEDIUM                   # CRITICAL | HIGH | MEDIUM | LOW
+```
+
+### Quality bar
+
+- **Risk explanations must cite specific legal text.** Name the article and the
+  requirement it imposes; don't just restate the check. Cross-check sub-point
+  letters against the directive/regulation (see `docs/nis2-mapping.md` and
+  `docs/gdpr-mapping.md` for verified citations).
+- **Remediation must be copy-paste Terraform code**, not a prose description.
+- **Verify the Checkov ID against a real scan.** Run
+  `checkov -d <dir> --framework terraform --quiet -o json` against a stack that
+  triggers the check and confirm the ID appears. A mispredicted ID means a
+  silent miss — the finding will never be enriched. (The test suite enforces
+  that every registry ID exists in the installed Checkov.)
+
+### Test requirements
+
+Add a fixture that triggers your new check and assert it appears in the output:
+
+1. Add or extend a Terraform file under `examples/` that fails the check.
+2. Add an assertion in `tests/` that the check ID is present in the enriched
+   output of that example (see `tests/test_registry.py` for patterns).
+
+Run the full suite before opening a PR:
+
+```bash
+bash install_and_test.sh
+```
+
+(creates a venv, installs dev extras, runs pytest with coverage, and smoke-tests
+a scan of `examples/vulnerable-aws/`).
+
+## Proposing a custom check
+
+Custom `EUGUARD_*` checks live in `tf_eu_guard/checks/`. They must:
+- target an EU-specific requirement stock Checkov doesn't cover,
+- have a registry mapping (severity, articles, risk, remediation), and
+- fire against a fixture in `examples/`.
+
+## Labels
+
+Look for `good first issue` on the issue tracker for entry-point tasks — mostly
+registry expansion where the legal reasoning is already agreed.

tf_eu_guard-0.1.0/Dockerfile

@@ -0,0 +1,6 @@
+FROM python:3.12-slim
+
+COPY . /src
+RUN pip install --no-cache-dir /src
+
+ENTRYPOINT ["tf-eu-guard", "scan"]

tf_eu_guard-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 44aayush
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.