vigilai-scan 0.1.0__tar.gz

vigilai_scan-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 VigilAI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vigilai_scan-0.1.0/PKG-INFO

@@ -0,0 +1,80 @@
+Metadata-Version: 2.4
+Name: vigilai-scan
+Version: 0.1.0
+Summary: Read-only AWS compliance baseline scanner — 15 checks mapped to SOC 2 criteria, with the Terraform fix for every failure
+Author: VigilAI
+License: MIT
+Keywords: aws,compliance,soc2,security,scanner
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: boto3>=1.28
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Dynamic: license-file
+
+# vigilai-scan
+
+**Find out in 60 seconds why your AWS account would fail an enterprise security review.**
+
+15 read-only checks against the controls that SOC 2 auditors, enterprise procurement teams, and security questionnaires actually ask about — each mapped to its SOC 2 criterion, each with a concrete fix.
+
+```
+  FAIL  LOG-01  A multi-region CloudTrail trail is logging      [CRITICAL · SOC2 CC7.2]
+  FAIL  NET-02  No security group opens SSH/RDP to the world    [CRITICAL · SOC2 CC6.6]
+         SG(s) with 0.0.0.0/0 on admin ports: sg-0892…, sg-0b37…
+  FAIL  S3-01   Account-level S3 public access block is on      [CRITICAL · SOC2 CC6.6]
+  ...
+  7 passed · 7 failed · 1 warnings
+```
+
+## Run it
+
+```bash
+pip install vigilai-scan          # or: pipx run vigilai-scan
+vigilai-scan                      # uses your default AWS profile
+vigilai-scan --profile prod --region us-west-2
+vigilai-scan --json > report.json # CI-friendly; exits 1 on any FAIL
+```
+
+**Read-only, local, zero telemetry.** Every AWS call is a `Describe`/`List`/`Get`. Nothing is modified, nothing leaves your machine. The safest way to run it is with the AWS-managed `SecurityAudit` policy. Audit the ~700 lines of source yourself — that's the point of it being open.
+
+## What it checks
+
+| ID | Check | SOC 2 |
+|---|---|---|
+| IAM-01 | Root account MFA | CC6.1 |
+| IAM-02 | No IAM users with console passwords (SSO roles instead) | CC6.2 |
+| IAM-03 | MFA on every human identity | CC6.1 |
+| IAM-04 | No access keys older than 90 days | CC6.2 |
+| IAM-05 | No `AdministratorAccess` attached directly to users | CC6.3 |
+| S3-01 | Account-level public access block | CC6.6 |
+| S3-02 | Default encryption on every bucket | CC6.1 |
+| S3-03 | Per-bucket public access blocks | CC6.6 |
+| NET-01 | Default security groups deny all traffic | CC6.6 |
+| NET-02 | No SSH/RDP open to 0.0.0.0/0 | CC6.6 |
+| NET-03 | VPC flow logs enabled | CC7.3 |
+| NET-04 | Peering routes scoped tighter than /24 | CC6.6 |
+| KMS-01 | Rotation on customer-managed keys | CC6.1 |
+| LOG-01 | Active multi-region CloudTrail | CC7.2 |
+| LOG-02 | EBS encryption-by-default | CC6.1 |
+
+## The full baseline checklist
+
+The scanner covers what's machine-checkable. The complete ~30-control checklist — including the process controls (access reviews, IR severity levels, vuln SLAs, change management) — is in [CHECKLIST.md](CHECKLIST.md). It's the engineering half of compliance, free under CC BY 4.0.
+
+## The kit
+
+Every failing check above has a ready-to-apply fix — a Terraform module or hardened template, plus the five corporate policies (Access Control, Change Management, Data Classification, Incident Response, Vulnerability Management) that enterprise reviewers ask for, pre-mapped to the code that enforces them.
+
+> **⚡ Compliance Kit — $349 one-time.** Versioned Terraform modules + policies + control-to-code mapping, delivered as a private git repo. [Get it here.](https://YOUR-CHECKOUT-LINK)
+>
+> **🚀 Compliance Sprint — done with you in 14 days.** We run the scan, deploy the fixes into your account, customize the policies, and hand you a filled-out security questionnaire answer bank. [Book a free scan review.](https://calendly.com/banhjosh/30min)
+
+## FAQ
+
+**Why not just use Prowler / ScoutSuite?** They're excellent and far more exhaustive — hundreds of findings across every service. This is deliberately the opposite: the 15 checks an enterprise security reviewer will actually probe first, with a fix attached to each. Run this to get deal-ready this week; run Prowler when you have a security team.
+
+**Will this get me SOC 2 certified?** No tool does. This gets your technical controls to the baseline auditors expect, which is most of the engineering work and the part that blocks deals.
+
+**License:** MIT (scanner), CC BY 4.0 (checklist).

vigilai_scan-0.1.0/README.md

@@ -0,0 +1,65 @@
+# vigilai-scan
+
+**Find out in 60 seconds why your AWS account would fail an enterprise security review.**
+
+15 read-only checks against the controls that SOC 2 auditors, enterprise procurement teams, and security questionnaires actually ask about — each mapped to its SOC 2 criterion, each with a concrete fix.
+
+```
+  FAIL  LOG-01  A multi-region CloudTrail trail is logging      [CRITICAL · SOC2 CC7.2]
+  FAIL  NET-02  No security group opens SSH/RDP to the world    [CRITICAL · SOC2 CC6.6]
+         SG(s) with 0.0.0.0/0 on admin ports: sg-0892…, sg-0b37…
+  FAIL  S3-01   Account-level S3 public access block is on      [CRITICAL · SOC2 CC6.6]
+  ...
+  7 passed · 7 failed · 1 warnings
+```
+
+## Run it
+
+```bash
+pip install vigilai-scan          # or: pipx run vigilai-scan
+vigilai-scan                      # uses your default AWS profile
+vigilai-scan --profile prod --region us-west-2
+vigilai-scan --json > report.json # CI-friendly; exits 1 on any FAIL
+```
+
+**Read-only, local, zero telemetry.** Every AWS call is a `Describe`/`List`/`Get`. Nothing is modified, nothing leaves your machine. The safest way to run it is with the AWS-managed `SecurityAudit` policy. Audit the ~700 lines of source yourself — that's the point of it being open.
+
+## What it checks
+
+| ID | Check | SOC 2 |
+|---|---|---|
+| IAM-01 | Root account MFA | CC6.1 |
+| IAM-02 | No IAM users with console passwords (SSO roles instead) | CC6.2 |
+| IAM-03 | MFA on every human identity | CC6.1 |
+| IAM-04 | No access keys older than 90 days | CC6.2 |
+| IAM-05 | No `AdministratorAccess` attached directly to users | CC6.3 |
+| S3-01 | Account-level public access block | CC6.6 |
+| S3-02 | Default encryption on every bucket | CC6.1 |
+| S3-03 | Per-bucket public access blocks | CC6.6 |
+| NET-01 | Default security groups deny all traffic | CC6.6 |
+| NET-02 | No SSH/RDP open to 0.0.0.0/0 | CC6.6 |
+| NET-03 | VPC flow logs enabled | CC7.3 |
+| NET-04 | Peering routes scoped tighter than /24 | CC6.6 |
+| KMS-01 | Rotation on customer-managed keys | CC6.1 |
+| LOG-01 | Active multi-region CloudTrail | CC7.2 |
+| LOG-02 | EBS encryption-by-default | CC6.1 |
+
+## The full baseline checklist
+
+The scanner covers what's machine-checkable. The complete ~30-control checklist — including the process controls (access reviews, IR severity levels, vuln SLAs, change management) — is in [CHECKLIST.md](CHECKLIST.md). It's the engineering half of compliance, free under CC BY 4.0.
+
+## The kit
+
+Every failing check above has a ready-to-apply fix — a Terraform module or hardened template, plus the five corporate policies (Access Control, Change Management, Data Classification, Incident Response, Vulnerability Management) that enterprise reviewers ask for, pre-mapped to the code that enforces them.
+
+> **⚡ Compliance Kit — $349 one-time.** Versioned Terraform modules + policies + control-to-code mapping, delivered as a private git repo. [Get it here.](https://YOUR-CHECKOUT-LINK)
+>
+> **🚀 Compliance Sprint — done with you in 14 days.** We run the scan, deploy the fixes into your account, customize the policies, and hand you a filled-out security questionnaire answer bank. [Book a free scan review.](https://calendly.com/banhjosh/30min)
+
+## FAQ
+
+**Why not just use Prowler / ScoutSuite?** They're excellent and far more exhaustive — hundreds of findings across every service. This is deliberately the opposite: the 15 checks an enterprise security reviewer will actually probe first, with a fix attached to each. Run this to get deal-ready this week; run Prowler when you have a security team.
+
+**Will this get me SOC 2 certified?** No tool does. This gets your technical controls to the baseline auditors expect, which is most of the engineering work and the part that blocks deals.
+
+**License:** MIT (scanner), CC BY 4.0 (checklist).

vigilai_scan-0.1.0/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "vigilai-scan"
+version = "0.1.0"
+description = "Read-only AWS compliance baseline scanner — 15 checks mapped to SOC 2 criteria, with the Terraform fix for every failure"
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "VigilAI" }]
+keywords = ["aws", "compliance", "soc2", "security", "scanner"]
+dependencies = ["boto3>=1.28"]
+
+[project.optional-dependencies]
+dev = ["pytest>=7"]
+
+[project.scripts]
+vigilai-scan = "vigilai_scan.cli:main"
+
+[tool.setuptools.packages.find]
+include = ["vigilai_scan*"]

vigilai_scan-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

vigilai_scan-0.1.0/tests/test_checks.py

@@ -0,0 +1,151 @@
+"""Unit tests for vigilai-scan checks using stubbed boto3 clients."""
+
+import datetime
+from unittest import mock
+
+import boto3
+import pytest
+from botocore.stub import Stubber
+
+from vigilai_scan import checks  # noqa: F401  (registers checks)
+from vigilai_scan.checks import iam as iam_checks
+from vigilai_scan.checks import network as network_checks
+from vigilai_scan.checks import logging_monitoring as log_checks
+from vigilai_scan.registry import all_checks, PASS, FAIL, WARN, ERROR
+
+
+CRED_REPORT_HEADER = (
+    "user,arn,user_creation_time,password_enabled,password_last_used,"
+    "password_last_changed,password_next_rotation,mfa_active,"
+    "access_key_1_active,access_key_1_last_rotated,"
+    "access_key_2_active,access_key_2_last_rotated"
+)
+
+
+def _session_with_stub(service, region="us-east-1"):
+    session = boto3.Session(
+        aws_access_key_id="testing", aws_secret_access_key="testing", region_name=region)
+    client = session.client(service, region_name=region)
+    stubber = Stubber(client)
+    patcher = mock.patch.object(session, "client", return_value=client)
+    return session, stubber, patcher
+
+
+def _cred_report_session(rows):
+    body = CRED_REPORT_HEADER + "\n" + "\n".join(rows)
+    session, stubber, patcher = _session_with_stub("iam")
+    stubber.add_response("get_credential_report", {
+        "Content": body.encode(), "ReportFormat": "text/csv",
+        "GeneratedTime": datetime.datetime(2026, 7, 10),
+    })
+    return session, stubber, patcher
+
+
+def test_root_mfa_fail():
+    session, stubber, patcher = _cred_report_session([
+        "<root_account>,arn:aws:iam::1:root,2020-01-01T00:00:00Z,true,N/A,N/A,N/A,false,false,N/A,false,N/A",
+    ])
+    with stubber, patcher:
+        result = iam_checks.root_mfa(session)[0]
+    assert result.status == FAIL
+    assert result.check_id == "IAM-01"
+
+
+def test_root_mfa_pass():
+    session, stubber, patcher = _cred_report_session([
+        "<root_account>,arn:aws:iam::1:root,2020-01-01T00:00:00Z,true,N/A,N/A,N/A,true,false,N/A,false,N/A",
+    ])
+    with stubber, patcher:
+        result = iam_checks.root_mfa(session)[0]
+    assert result.status == PASS
+
+
+def test_console_users_flags_password_users():
+    session, stubber, patcher = _cred_report_session([
+        "<root_account>,arn,2020-01-01T00:00:00Z,true,N/A,N/A,N/A,true,false,N/A,false,N/A",
+        "alice,arn,2021-01-01T00:00:00Z,true,N/A,N/A,N/A,true,false,N/A,false,N/A",
+        "ci-bot,arn,2021-01-01T00:00:00Z,false,N/A,N/A,N/A,false,true,2026-07-01T00:00:00Z,false,N/A",
+    ])
+    with stubber, patcher:
+        result = iam_checks.console_users(session)[0]
+    assert result.status == FAIL
+    assert "alice" in result.detail
+    assert "ci-bot" not in result.detail
+
+
+def test_stale_access_keys():
+    session, stubber, patcher = _cred_report_session([
+        "ci-bot,arn,2021-01-01T00:00:00Z,false,N/A,N/A,N/A,false,true,2020-01-01T00:00:00+00:00,false,N/A",
+    ])
+    with stubber, patcher:
+        result = iam_checks.stale_access_keys(session)[0]
+    assert result.status == FAIL
+    assert "ci-bot" in result.detail
+
+
+def test_default_sg_locked_pass_and_fail():
+    session, stubber, patcher = _session_with_stub("ec2")
+    stubber.add_response("describe_security_groups", {"SecurityGroups": [
+        {"GroupId": "sg-clean", "GroupName": "default", "OwnerId": "1",
+         "Description": "d", "IpPermissions": [], "IpPermissionsEgress": []},
+    ]})
+    with stubber, patcher:
+        assert network_checks.default_sg_locked(session)[0].status == PASS
+
+    session, stubber, patcher = _session_with_stub("ec2")
+    stubber.add_response("describe_security_groups", {"SecurityGroups": [
+        {"GroupId": "sg-open", "GroupName": "default", "OwnerId": "1", "Description": "d",
+         "IpPermissions": [{"IpProtocol": "-1", "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}],
+         "IpPermissionsEgress": []},
+    ]})
+    with stubber, patcher:
+        result = network_checks.default_sg_locked(session)[0]
+    assert result.status == FAIL
+    assert "sg-open" in result.detail
+
+
+def test_world_open_admin_ports():
+    session, stubber, patcher = _session_with_stub("ec2")
+    stubber.add_response("describe_security_groups", {"SecurityGroups": [
+        {"GroupId": "sg-ssh", "GroupName": "web", "OwnerId": "1", "Description": "d",
+         "IpPermissions": [{"IpProtocol": "tcp", "FromPort": 22, "ToPort": 22,
+                            "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]},
+        {"GroupId": "sg-https", "GroupName": "web2", "OwnerId": "1", "Description": "d",
+         "IpPermissions": [{"IpProtocol": "tcp", "FromPort": 443, "ToPort": 443,
+                            "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]},
+    ]})
+    with stubber, patcher:
+        result = network_checks.world_open_admin_ports(session)[0]
+    assert result.status == FAIL
+    assert "sg-ssh" in result.detail
+    assert "sg-https" not in result.detail
+
+
+def test_broad_peering_route_flagged():
+    session, stubber, patcher = _session_with_stub("ec2")
+    stubber.add_response("describe_route_tables", {"RouteTables": [
+        {"RouteTableId": "rtb-1", "Routes": [
+            {"DestinationCidrBlock": "10.1.0.0/16", "VpcPeeringConnectionId": "pcx-1"},
+            {"DestinationCidrBlock": "10.2.5.0/24", "VpcPeeringConnectionId": "pcx-2"},
+            {"DestinationCidrBlock": "0.0.0.0/0", "GatewayId": "igw-1"},
+        ]},
+    ]})
+    with stubber, patcher:
+        result = network_checks.broad_peering_routes(session)[0]
+    assert result.status == FAIL
+    assert "10.1.0.0/16" in result.detail
+    assert "10.2.5.0/24" not in result.detail
+
+
+def test_access_denied_becomes_skip():
+    session, stubber, patcher = _session_with_stub("ec2")
+    stubber.add_client_error("get_ebs_encryption_by_default",
+                             service_error_code="UnauthorizedOperation")
+    with stubber, patcher:
+        result = log_checks.ebs_default_encryption(session)[0]
+    assert result.status == ERROR
+    assert "SecurityAudit" in result.detail or "AWS error" in result.detail
+
+
+def test_registry_has_15_checks():
+    assert len(all_checks()) == 15

vigilai_scan-0.1.0/vigilai_scan/__init__.py

@@ -0,0 +1,3 @@
+"""vigilai-scan: read-only AWS compliance baseline scanner."""
+
+__version__ = "0.1.0"

vigilai_scan-0.1.0/vigilai_scan/checks/__init__.py

@@ -0,0 +1,3 @@
+"""Import all check modules so their @guard decorators register them."""
+
+from . import iam, s3, network, kms, logging_monitoring  # noqa: F401

vigilai_scan-0.1.0/vigilai_scan/checks/iam.py

@@ -0,0 +1,111 @@
+"""IAM checks — all built on the credential report plus two List calls."""
+
+import csv
+import io
+import time
+from datetime import datetime, timedelta, timezone
+
+from ..registry import CheckResult, guard, PASS, FAIL, WARN
+
+KEY_MAX_AGE_DAYS = 90
+
+
+def _credential_report(session) -> list:
+    """Fetch (generating if needed) the IAM credential report as dict rows."""
+    iam = session.client("iam")
+    for _ in range(10):
+        try:
+            report = iam.get_credential_report()
+            break
+        except iam.exceptions.CredentialReportNotPresentException:
+            iam.generate_credential_report()
+            time.sleep(2)
+    else:
+        raise RuntimeError("credential report never became available")
+    body = report["Content"].decode("utf-8")
+    return list(csv.DictReader(io.StringIO(body)))
+
+
+@guard("IAM-01", "Root account has MFA enabled", "CRITICAL", "CC6.1")
+def root_mfa(session, region=None):
+    rows = _credential_report(session)
+    root = next((r for r in rows if r["user"] == "<root_account>"), None)
+    ok = root is not None and root.get("mfa_active") == "true"
+    return [CheckResult(
+        "IAM-01", "Root account has MFA enabled", "CRITICAL", "CC6.1",
+        PASS if ok else FAIL,
+        "" if ok else "The root account can be taken over with a single password.",
+        fix="checklist: Access Control — MFA enforced on console",
+    )]
+
+
+@guard("IAM-02", "No IAM users with console passwords (use SSO roles)", "HIGH", "CC6.2")
+def console_users(session, region=None):
+    rows = _credential_report(session)
+    with_pw = [r["user"] for r in rows
+               if r["user"] != "<root_account>" and r.get("password_enabled") == "true"]
+    ok = not with_pw
+    return [CheckResult(
+        "IAM-02", "No IAM users with console passwords (use SSO roles)", "HIGH", "CC6.2",
+        PASS if ok else FAIL,
+        "" if ok else f"{len(with_pw)} IAM user(s) with passwords: {', '.join(with_pw[:5])}"
+                      + ("…" if len(with_pw) > 5 else ""),
+        fix="kit: terraform/modules/iam-least-privilege (SSO-federated roles)",
+    )]
+
+
+@guard("IAM-03", "Every human identity has MFA", "HIGH", "CC6.1")
+def users_without_mfa(session, region=None):
+    rows = _credential_report(session)
+    no_mfa = [r["user"] for r in rows
+              if r["user"] != "<root_account>"
+              and r.get("password_enabled") == "true"
+              and r.get("mfa_active") != "true"]
+    ok = not no_mfa
+    return [CheckResult(
+        "IAM-03", "Every human identity has MFA", "HIGH", "CC6.1",
+        PASS if ok else FAIL,
+        "" if ok else f"{len(no_mfa)} console user(s) without MFA: {', '.join(no_mfa[:5])}"
+                      + ("…" if len(no_mfa) > 5 else ""),
+        fix="checklist: Access Control — MFA enforced on console, IdP, and source control",
+    )]
+
+
+@guard("IAM-04", f"No access keys older than {KEY_MAX_AGE_DAYS} days", "MEDIUM", "CC6.2")
+def stale_access_keys(session, region=None):
+    rows = _credential_report(session)
+    cutoff = datetime.now(timezone.utc) - timedelta(days=KEY_MAX_AGE_DAYS)
+    stale = []
+    for r in rows:
+        for slot in ("1", "2"):
+            if r.get(f"access_key_{slot}_active") == "true":
+                rotated = r.get(f"access_key_{slot}_last_rotated", "")
+                if rotated and rotated not in ("N/A", "not_supported"):
+                    when = datetime.fromisoformat(rotated.replace("Z", "+00:00"))
+                    if when < cutoff:
+                        stale.append(f"{r['user']} (key {slot})")
+    ok = not stale
+    return [CheckResult(
+        "IAM-04", f"No access keys older than {KEY_MAX_AGE_DAYS} days", "MEDIUM", "CC6.2",
+        PASS if ok else FAIL,
+        "" if ok else f"{len(stale)} stale key(s): {', '.join(stale[:5])}"
+                      + ("…" if len(stale) > 5 else ""),
+        fix="kit: terraform/modules/iam-least-privilege (OIDC short-lived credentials for CI)",
+    )]
+
+
+@guard("IAM-05", "AdministratorAccess is not attached directly to users", "HIGH", "CC6.3")
+def admin_attached_to_users(session, region=None):
+    iam = session.client("iam")
+    entities = iam.list_entities_for_policy(
+        PolicyArn="arn:aws:iam::aws:policy/AdministratorAccess",
+        EntityFilter="User",
+    )
+    users = [u["UserName"] for u in entities.get("PolicyUsers", [])]
+    ok = not users
+    return [CheckResult(
+        "IAM-05", "AdministratorAccess is not attached directly to users", "HIGH", "CC6.3",
+        PASS if ok else FAIL,
+        "" if ok else f"Admin users: {', '.join(users[:5])}" + ("…" if len(users) > 5 else ""),
+        fix="kit: terraform/modules/iam-least-privilege (MFA-gated break-glass role instead)",
+    )]

vigilai_scan-0.1.0/vigilai_scan/checks/kms.py

@@ -0,0 +1,35 @@
+"""KMS checks: rotation on customer-managed keys."""
+
+from ..registry import CheckResult, guard, PASS, FAIL, WARN
+
+
+@guard("KMS-01", "Customer-managed keys have rotation enabled", "MEDIUM", "CC6.1")
+def key_rotation(session, region=None):
+    kms = session.client("kms", region_name=region)
+    unrotated, checked = [], 0
+    paginator = kms.get_paginator("list_keys")
+    for page in paginator.paginate():
+        for key in page.get("Keys", []):
+            meta = kms.describe_key(KeyId=key["KeyId"])["KeyMetadata"]
+            if meta.get("KeyManager") != "CUSTOMER" or meta.get("KeyState") != "Enabled":
+                continue
+            if meta.get("KeySpec", "SYMMETRIC_DEFAULT") != "SYMMETRIC_DEFAULT":
+                continue  # rotation only applies to symmetric keys
+            checked += 1
+            status = kms.get_key_rotation_status(KeyId=key["KeyId"])
+            if not status.get("KeyRotationEnabled"):
+                unrotated.append(key["KeyId"])
+    if checked == 0:
+        return [CheckResult(
+            "KMS-01", "Customer-managed keys have rotation enabled", "MEDIUM", "CC6.1",
+            WARN, "No customer-managed keys found — are you encrypting with CMKs at all?",
+            fix="kit: terraform/modules/kms-baseline",
+        )]
+    ok = not unrotated
+    return [CheckResult(
+        "KMS-01", "Customer-managed keys have rotation enabled", "MEDIUM", "CC6.1",
+        PASS if ok else FAIL,
+        "" if ok else f"{len(unrotated)} key(s) without rotation: {', '.join(unrotated[:3])}"
+                      + ("…" if len(unrotated) > 3 else ""),
+        fix="kit: terraform/modules/kms-baseline (enable_key_rotation = true)",
+    )]

vigilai_scan-0.1.0/vigilai_scan/checks/logging_monitoring.py

@@ -0,0 +1,35 @@
+"""Logging & monitoring checks: CloudTrail coverage, EBS default encryption."""
+
+from ..registry import CheckResult, guard, PASS, FAIL, WARN
+
+
+@guard("LOG-01", "A multi-region CloudTrail trail is logging", "CRITICAL", "CC7.2")
+def cloudtrail_active(session, region=None):
+    ct = session.client("cloudtrail", region_name=region)
+    trails = ct.describe_trails(includeShadowTrails=True).get("trailList", [])
+    active_multiregion = []
+    for t in trails:
+        if not t.get("IsMultiRegionTrail"):
+            continue
+        status = ct.get_trail_status(Name=t["TrailARN"])
+        if status.get("IsLogging"):
+            active_multiregion.append(t["Name"])
+    ok = bool(active_multiregion)
+    return [CheckResult(
+        "LOG-01", "A multi-region CloudTrail trail is logging", "CRITICAL", "CC7.2",
+        PASS if ok else FAIL,
+        "" if ok else "No active multi-region trail — you cannot answer 'who did what' during an incident.",
+        fix="checklist: Incident Response — evidence collection before you need it",
+    )]
+
+
+@guard("LOG-02", "EBS encryption-by-default is on", "MEDIUM", "CC6.1")
+def ebs_default_encryption(session, region=None):
+    ec2 = session.client("ec2", region_name=region)
+    enabled = ec2.get_ebs_encryption_by_default().get("EbsEncryptionByDefault", False)
+    return [CheckResult(
+        "LOG-02", "EBS encryption-by-default is on", "MEDIUM", "CC6.1",
+        PASS if enabled else FAIL,
+        "" if enabled else "New volumes are created unencrypted unless every engineer remembers the flag.",
+        fix="checklist: Encryption — one API call fixes this account-wide",
+    )]

vigilai_scan-0.1.0/vigilai_scan/checks/network.py

@@ -0,0 +1,94 @@
+"""Network checks: default SGs, world-open admin ports, flow logs, broad peering routes."""
+
+import ipaddress
+
+from ..registry import CheckResult, guard, PASS, FAIL, WARN
+
+ADMIN_PORTS = {22, 3389}
+PEER_MAX_PREFIX = 24  # peering routes broader than /24 are flagged
+
+
+@guard("NET-01", "Default security groups allow no traffic", "HIGH", "CC6.6")
+def default_sg_locked(session, region=None):
+    ec2 = session.client("ec2", region_name=region)
+    groups = ec2.describe_security_groups(
+        Filters=[{"Name": "group-name", "Values": ["default"]}]).get("SecurityGroups", [])
+    open_defaults = [g["GroupId"] for g in groups
+                     if g.get("IpPermissions") or g.get("IpPermissionsEgress")]
+    ok = not open_defaults
+    return [CheckResult(
+        "NET-01", "Default security groups allow no traffic", "HIGH", "CC6.6",
+        PASS if ok else FAIL,
+        "" if ok else f"Default SG(s) with rules: {', '.join(open_defaults[:5])}"
+                      + ("…" if len(open_defaults) > 5 else ""),
+        fix="kit: terraform/modules/vpc-baseline (aws_default_security_group with no rules)",
+    )]
+
+
+def _rule_hits_admin_port(perm) -> bool:
+    if perm.get("IpProtocol") == "-1":
+        return True
+    from_p, to_p = perm.get("FromPort"), perm.get("ToPort")
+    if from_p is None or to_p is None:
+        return False
+    return any(from_p <= p <= to_p for p in ADMIN_PORTS)
+
+
+@guard("NET-02", "No security group opens SSH/RDP to the world", "CRITICAL", "CC6.6")
+def world_open_admin_ports(session, region=None):
+    ec2 = session.client("ec2", region_name=region)
+    offenders = []
+    paginator = ec2.get_paginator("describe_security_groups")
+    for page in paginator.paginate():
+        for g in page.get("SecurityGroups", []):
+            for perm in g.get("IpPermissions", []):
+                world = any(r.get("CidrIp") == "0.0.0.0/0" for r in perm.get("IpRanges", [])) or \
+                        any(r.get("CidrIpv6") == "::/0" for r in perm.get("Ipv6Ranges", []))
+                if world and _rule_hits_admin_port(perm):
+                    offenders.append(g["GroupId"])
+                    break
+    ok = not offenders
+    return [CheckResult(
+        "NET-02", "No security group opens SSH/RDP to the world", "CRITICAL", "CC6.6",
+        PASS if ok else FAIL,
+        "" if ok else f"SG(s) with 0.0.0.0/0 on admin ports: {', '.join(offenders[:5])}"
+                      + ("…" if len(offenders) > 5 else ""),
+        fix="checklist: Network — no world-open admin ports; use SSM Session Manager",
+    )]
+
+
+@guard("NET-03", "Every VPC has flow logs enabled", "MEDIUM", "CC7.3")
+def vpc_flow_logs(session, region=None):
+    ec2 = session.client("ec2", region_name=region)
+    vpcs = {v["VpcId"] for v in ec2.describe_vpcs().get("Vpcs", [])}
+    logged = {f["ResourceId"] for f in ec2.describe_flow_logs().get("FlowLogs", [])}
+    missing = sorted(vpcs - logged)
+    ok = not missing
+    return [CheckResult(
+        "NET-03", "Every VPC has flow logs enabled", "MEDIUM", "CC7.3",
+        PASS if ok else FAIL,
+        "" if ok else f"VPC(s) without flow logs: {', '.join(missing[:5])}"
+                      + ("…" if len(missing) > 5 else ""),
+        fix="kit: terraform/modules/vpc-baseline (aws_flow_log, 90-day retention)",
+    )]
+
+
+@guard("NET-04", f"Peering routes are scoped tighter than /{PEER_MAX_PREFIX}", "HIGH", "CC6.6")
+def broad_peering_routes(session, region=None):
+    ec2 = session.client("ec2", region_name=region)
+    broad = []
+    for table in ec2.describe_route_tables().get("RouteTables", []):
+        for route in table.get("Routes", []):
+            if route.get("VpcPeeringConnectionId") and route.get("DestinationCidrBlock"):
+                net = ipaddress.ip_network(route["DestinationCidrBlock"], strict=False)
+                if net.prefixlen < PEER_MAX_PREFIX:
+                    broad.append(f"{table['RouteTableId']}→{route['DestinationCidrBlock']}")
+    ok = not broad
+    return [CheckResult(
+        "NET-04", f"Peering routes are scoped tighter than /{PEER_MAX_PREFIX}", "HIGH", "CC6.6",
+        PASS if ok else FAIL,
+        "" if ok else f"Broad peering route(s): {', '.join(broad[:5])}"
+                      + ("…" if len(broad) > 5 else "")
+                      + " — a compromised peer network can reach everything in these ranges.",
+        fix="kit: terraform/modules/vpc-baseline (scoped peer routes, none to data subnets)",
+    )]

vigilai_scan-0.1.0/vigilai_scan/checks/s3.py

@@ -0,0 +1,86 @@
+"""S3 checks: account-level public access block, per-bucket encryption and PAB."""
+
+from botocore.exceptions import ClientError
+
+from ..registry import CheckResult, guard, PASS, FAIL, WARN
+
+MAX_BUCKETS = 200  # keep scans fast on large accounts
+
+
+@guard("S3-01", "Account-level S3 public access block is fully on", "CRITICAL", "CC6.6")
+def account_public_access_block(session, region=None):
+    sts = session.client("sts")
+    account_id = sts.get_caller_identity()["Account"]
+    s3control = session.client("s3control", region_name=region or "us-east-1")
+    try:
+        cfg = s3control.get_public_access_block(AccountId=account_id)[
+            "PublicAccessBlockConfiguration"]
+        ok = all(cfg.get(k) for k in (
+            "BlockPublicAcls", "IgnorePublicAcls", "BlockPublicPolicy", "RestrictPublicBuckets"))
+        detail = "" if ok else "One or more account-level public access settings are off."
+    except ClientError as exc:
+        if exc.response["Error"]["Code"] == "NoSuchPublicAccessBlockConfiguration":
+            ok, detail = False, "No account-level public access block configured at all."
+        else:
+            raise
+    return [CheckResult(
+        "S3-01", "Account-level S3 public access block is fully on", "CRITICAL", "CC6.6",
+        PASS if ok else FAIL, detail,
+        fix="kit: terraform/modules/kms-baseline (bucket hardening pattern)",
+    )]
+
+
+def _bucket_names(session):
+    s3 = session.client("s3")
+    return [b["Name"] for b in s3.list_buckets().get("Buckets", [])][:MAX_BUCKETS]
+
+
+@guard("S3-02", "Every bucket has default encryption", "HIGH", "CC6.1")
+def bucket_encryption(session, region=None):
+    s3 = session.client("s3")
+    unencrypted = []
+    for name in _bucket_names(session):
+        try:
+            s3.get_bucket_encryption(Bucket=name)
+        except ClientError as exc:
+            if exc.response["Error"]["Code"] == "ServerSideEncryptionConfigurationNotFoundError":
+                unencrypted.append(name)
+            elif exc.response["Error"]["Code"] in ("AccessDenied", "AccessDeniedException"):
+                continue  # skip buckets we can't read rather than failing the check
+            else:
+                raise
+    ok = not unencrypted
+    return [CheckResult(
+        "S3-02", "Every bucket has default encryption", "HIGH", "CC6.1",
+        PASS if ok else FAIL,
+        "" if ok else f"{len(unencrypted)} unencrypted bucket(s): {', '.join(unencrypted[:5])}"
+                      + ("…" if len(unencrypted) > 5 else ""),
+        fix="kit: terraform/modules/kms-baseline (SSE-KMS with rotation)",
+    )]
+
+
+@guard("S3-03", "Every bucket has its own public access block", "HIGH", "CC6.6")
+def bucket_public_access_block(session, region=None):
+    s3 = session.client("s3")
+    missing = []
+    for name in _bucket_names(session):
+        try:
+            cfg = s3.get_public_access_block(Bucket=name)["PublicAccessBlockConfiguration"]
+            if not all(cfg.get(k) for k in (
+                    "BlockPublicAcls", "IgnorePublicAcls", "BlockPublicPolicy", "RestrictPublicBuckets")):
+                missing.append(name)
+        except ClientError as exc:
+            if exc.response["Error"]["Code"] == "NoSuchPublicAccessBlockConfiguration":
+                missing.append(name)
+            elif exc.response["Error"]["Code"] in ("AccessDenied", "AccessDeniedException"):
+                continue
+            else:
+                raise
+    ok = not missing
+    return [CheckResult(
+        "S3-03", "Every bucket has its own public access block", "HIGH", "CC6.6",
+        PASS if ok else FAIL,
+        "" if ok else f"{len(missing)} bucket(s) without full PAB: {', '.join(missing[:5])}"
+                      + ("…" if len(missing) > 5 else ""),
+        fix="kit: terraform/modules/kms-baseline (aws_s3_bucket_public_access_block)",
+    )]

vigilai_scan-0.1.0/vigilai_scan/cli.py

@@ -0,0 +1,60 @@
+"""vigilai-scan CLI entry point.
+
+Usage:
+    vigilai-scan                       # default profile & region
+    vigilai-scan --profile staging --region us-west-2
+    vigilai-scan --json > report.json  # machine-readable, CI-friendly
+
+Exit codes: 0 = all clear, 1 = at least one FAIL, 2 = couldn't run.
+"""
+
+import argparse
+import sys
+
+import boto3
+from botocore.exceptions import NoCredentialsError, ClientError
+
+from . import __version__, checks  # noqa: F401  (import registers checks)
+from .registry import all_checks, FAIL
+from .report import render_terminal, render_json, supports_color
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="vigilai-scan",
+        description="Read-only AWS compliance baseline scanner (15 checks, SOC 2 mapped).",
+    )
+    parser.add_argument("--profile", help="AWS profile name")
+    parser.add_argument("--region", help="AWS region (defaults to profile/env region)")
+    parser.add_argument("--json", action="store_true", help="emit JSON instead of the terminal report")
+    parser.add_argument("--no-color", action="store_true", help="disable ANSI colors")
+    parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    args = parser.parse_args(argv)
+
+    try:
+        session = boto3.Session(profile_name=args.profile, region_name=args.region)
+        region = args.region or session.region_name or "us-east-1"
+        account = session.client("sts").get_caller_identity()["Account"]
+    except NoCredentialsError:
+        print("No AWS credentials found. Configure with `aws configure` or set AWS_PROFILE.",
+              file=sys.stderr)
+        return 2
+    except ClientError as exc:
+        print(f"Could not authenticate to AWS: {exc}", file=sys.stderr)
+        return 2
+
+    results = []
+    for check in all_checks():
+        results.extend(check.func(session, region))
+
+    if args.json:
+        print(render_json(results, account, region))
+    else:
+        color = supports_color() and not args.no_color
+        print(render_terminal(results, account, region, color=color))
+
+    return 1 if any(r.status == FAIL for r in results) else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

vigilai_scan-0.1.0/vigilai_scan/registry.py

@@ -0,0 +1,86 @@
+"""Check result model and registry.
+
+Every check is a function taking a boto3 Session and returning a list of
+CheckResult. Checks make exclusively read-only (Describe/List/Get) calls.
+"""
+
+from dataclasses import dataclass, field
+from typing import Callable, List, Optional
+
+from botocore.exceptions import ClientError, NoCredentialsError
+
+PASS = "PASS"
+FAIL = "FAIL"
+WARN = "WARN"
+ERROR = "ERROR"  # couldn't evaluate (usually AccessDenied)
+
+SEVERITY_ORDER = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
+
+
+@dataclass
+class CheckResult:
+    check_id: str
+    title: str
+    severity: str  # CRITICAL / HIGH / MEDIUM / LOW
+    soc2: str  # e.g. "CC6.1"
+    status: str  # PASS / FAIL / WARN / ERROR
+    detail: str = ""
+    fix: str = ""  # pointer to the remediation in the kit/checklist
+
+    def to_dict(self) -> dict:
+        return {
+            "id": self.check_id,
+            "title": self.title,
+            "severity": self.severity,
+            "soc2": self.soc2,
+            "status": self.status,
+            "detail": self.detail,
+            "fix": self.fix,
+        }
+
+
+@dataclass
+class Check:
+    func: Callable
+    name: str
+
+
+_REGISTRY: List[Check] = []
+
+
+def register(func: Callable) -> Callable:
+    _REGISTRY.append(Check(func=func, name=func.__name__))
+    return func
+
+
+def all_checks() -> List[Check]:
+    return list(_REGISTRY)
+
+
+def guard(check_id: str, title: str, severity: str, soc2: str):
+    """Wrap a check so auth/permission failures become ERROR results
+    instead of crashing the whole scan."""
+
+    def decorator(func: Callable):
+        def wrapper(session, region: Optional[str] = None) -> List[CheckResult]:
+            try:
+                return func(session, region)
+            except NoCredentialsError:
+                raise  # fatal: handled by the CLI with a clear message
+            except ClientError as exc:
+                code = exc.response.get("Error", {}).get("Code", "")
+                if code in ("AccessDenied", "AccessDeniedException", "UnauthorizedOperation", "AuthorizationError"):
+                    return [CheckResult(
+                        check_id=check_id, title=title, severity=severity, soc2=soc2,
+                        status=ERROR,
+                        detail="Access denied — attach the AWS-managed SecurityAudit policy to the scanning role.",
+                    )]
+                return [CheckResult(
+                    check_id=check_id, title=title, severity=severity, soc2=soc2,
+                    status=ERROR, detail=f"AWS error: {code}",
+                )]
+
+        wrapper.__name__ = func.__name__
+        return register(wrapper)
+
+    return decorator

vigilai_scan-0.1.0/vigilai_scan/report.py

@@ -0,0 +1,90 @@
+"""Terminal and JSON rendering for scan results."""
+
+import json
+import sys
+from typing import List
+
+from .registry import CheckResult, PASS, FAIL, WARN, ERROR, SEVERITY_ORDER
+
+RESET = "\033[0m"
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RED = "\033[31m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+
+STATUS_STYLE = {
+    PASS: (GREEN, "PASS"),
+    FAIL: (RED, "FAIL"),
+    WARN: (YELLOW, "WARN"),
+    ERROR: (DIM, "SKIP"),
+}
+
+
+def _c(text: str, *styles: str, color: bool = True) -> str:
+    if not color:
+        return text
+    return "".join(styles) + text + RESET
+
+
+def render_terminal(results: List[CheckResult], account: str, region: str,
+                    color: bool = True) -> str:
+    lines = []
+    lines.append("")
+    lines.append(_c("  vigilai-scan", BOLD, color=color) + _c(
+        f"  ·  account {account}  ·  region {region}", DIM, color=color))
+    lines.append(_c("  15 read-only checks mapped to SOC 2 — nothing is modified or sent anywhere.",
+                    DIM, color=color))
+    lines.append("")
+
+    ordered = sorted(results, key=lambda r: (
+        0 if r.status == FAIL else 1 if r.status == WARN else 2 if r.status == ERROR else 3,
+        SEVERITY_ORDER.get(r.severity, 9), r.check_id))
+
+    for r in ordered:
+        style, label = STATUS_STYLE[r.status]
+        head = f"  {_c(label, style, BOLD, color=color)}  {r.check_id:<7} {r.title}"
+        head += _c(f"  [{r.severity} · SOC2 {r.soc2}]", DIM, color=color)
+        lines.append(head)
+        if r.detail and r.status != PASS:
+            lines.append(_c(f"         {r.detail}", color=color))
+        if r.fix and r.status in (FAIL, WARN):
+            lines.append(_c(f"         fix → {r.fix}", DIM, color=color))
+
+    fails = sum(1 for r in results if r.status == FAIL)
+    warns = sum(1 for r in results if r.status == WARN)
+    skips = sum(1 for r in results if r.status == ERROR)
+    passes = sum(1 for r in results if r.status == PASS)
+
+    lines.append("")
+    summary = f"  {passes} passed · {fails} failed · {warns} warnings"
+    if skips:
+        summary += f" · {skips} skipped (missing permissions)"
+    lines.append(_c(summary, BOLD, color=color))
+
+    if fails:
+        lines.append("")
+        lines.append(_c("  Every failing check has a ready-to-apply fix in the compliance kit:",
+                        color=color))
+        lines.append(_c("  https://github.com/Joshugoi/VigilAI#the-kit",
+                        BOLD, color=color))
+    lines.append("")
+    return "\n".join(lines)
+
+
+def render_json(results: List[CheckResult], account: str, region: str) -> str:
+    return json.dumps({
+        "account": account,
+        "region": region,
+        "summary": {
+            "pass": sum(1 for r in results if r.status == PASS),
+            "fail": sum(1 for r in results if r.status == FAIL),
+            "warn": sum(1 for r in results if r.status == WARN),
+            "skipped": sum(1 for r in results if r.status == ERROR),
+        },
+        "checks": [r.to_dict() for r in results],
+    }, indent=2)
+
+
+def supports_color(stream=sys.stdout) -> bool:
+    return hasattr(stream, "isatty") and stream.isatty()

vigilai_scan-0.1.0/vigilai_scan.egg-info/PKG-INFO

@@ -0,0 +1,80 @@
+Metadata-Version: 2.4
+Name: vigilai-scan
+Version: 0.1.0
+Summary: Read-only AWS compliance baseline scanner — 15 checks mapped to SOC 2 criteria, with the Terraform fix for every failure
+Author: VigilAI
+License: MIT
+Keywords: aws,compliance,soc2,security,scanner
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: boto3>=1.28
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Dynamic: license-file
+
+# vigilai-scan
+
+**Find out in 60 seconds why your AWS account would fail an enterprise security review.**
+
+15 read-only checks against the controls that SOC 2 auditors, enterprise procurement teams, and security questionnaires actually ask about — each mapped to its SOC 2 criterion, each with a concrete fix.
+
+```
+  FAIL  LOG-01  A multi-region CloudTrail trail is logging      [CRITICAL · SOC2 CC7.2]
+  FAIL  NET-02  No security group opens SSH/RDP to the world    [CRITICAL · SOC2 CC6.6]
+         SG(s) with 0.0.0.0/0 on admin ports: sg-0892…, sg-0b37…
+  FAIL  S3-01   Account-level S3 public access block is on      [CRITICAL · SOC2 CC6.6]
+  ...
+  7 passed · 7 failed · 1 warnings
+```
+
+## Run it
+
+```bash
+pip install vigilai-scan          # or: pipx run vigilai-scan
+vigilai-scan                      # uses your default AWS profile
+vigilai-scan --profile prod --region us-west-2
+vigilai-scan --json > report.json # CI-friendly; exits 1 on any FAIL
+```
+
+**Read-only, local, zero telemetry.** Every AWS call is a `Describe`/`List`/`Get`. Nothing is modified, nothing leaves your machine. The safest way to run it is with the AWS-managed `SecurityAudit` policy. Audit the ~700 lines of source yourself — that's the point of it being open.
+
+## What it checks
+
+| ID | Check | SOC 2 |
+|---|---|---|
+| IAM-01 | Root account MFA | CC6.1 |
+| IAM-02 | No IAM users with console passwords (SSO roles instead) | CC6.2 |
+| IAM-03 | MFA on every human identity | CC6.1 |
+| IAM-04 | No access keys older than 90 days | CC6.2 |
+| IAM-05 | No `AdministratorAccess` attached directly to users | CC6.3 |
+| S3-01 | Account-level public access block | CC6.6 |
+| S3-02 | Default encryption on every bucket | CC6.1 |
+| S3-03 | Per-bucket public access blocks | CC6.6 |
+| NET-01 | Default security groups deny all traffic | CC6.6 |
+| NET-02 | No SSH/RDP open to 0.0.0.0/0 | CC6.6 |
+| NET-03 | VPC flow logs enabled | CC7.3 |
+| NET-04 | Peering routes scoped tighter than /24 | CC6.6 |
+| KMS-01 | Rotation on customer-managed keys | CC6.1 |
+| LOG-01 | Active multi-region CloudTrail | CC7.2 |
+| LOG-02 | EBS encryption-by-default | CC6.1 |
+
+## The full baseline checklist
+
+The scanner covers what's machine-checkable. The complete ~30-control checklist — including the process controls (access reviews, IR severity levels, vuln SLAs, change management) — is in [CHECKLIST.md](CHECKLIST.md). It's the engineering half of compliance, free under CC BY 4.0.
+
+## The kit
+
+Every failing check above has a ready-to-apply fix — a Terraform module or hardened template, plus the five corporate policies (Access Control, Change Management, Data Classification, Incident Response, Vulnerability Management) that enterprise reviewers ask for, pre-mapped to the code that enforces them.
+
+> **⚡ Compliance Kit — $349 one-time.** Versioned Terraform modules + policies + control-to-code mapping, delivered as a private git repo. [Get it here.](https://YOUR-CHECKOUT-LINK)
+>
+> **🚀 Compliance Sprint — done with you in 14 days.** We run the scan, deploy the fixes into your account, customize the policies, and hand you a filled-out security questionnaire answer bank. [Book a free scan review.](https://calendly.com/banhjosh/30min)
+
+## FAQ
+
+**Why not just use Prowler / ScoutSuite?** They're excellent and far more exhaustive — hundreds of findings across every service. This is deliberately the opposite: the 15 checks an enterprise security reviewer will actually probe first, with a fix attached to each. Run this to get deal-ready this week; run Prowler when you have a security team.
+
+**Will this get me SOC 2 certified?** No tool does. This gets your technical controls to the baseline auditors expect, which is most of the engineering work and the part that blocks deals.
+
+**License:** MIT (scanner), CC BY 4.0 (checklist).

vigilai_scan-0.1.0/vigilai_scan.egg-info/SOURCES.txt

@@ -0,0 +1,20 @@
+LICENSE
+README.md
+pyproject.toml
+tests/test_checks.py
+vigilai_scan/__init__.py
+vigilai_scan/cli.py
+vigilai_scan/registry.py
+vigilai_scan/report.py
+vigilai_scan.egg-info/PKG-INFO
+vigilai_scan.egg-info/SOURCES.txt
+vigilai_scan.egg-info/dependency_links.txt
+vigilai_scan.egg-info/entry_points.txt
+vigilai_scan.egg-info/requires.txt
+vigilai_scan.egg-info/top_level.txt
+vigilai_scan/checks/__init__.py
+vigilai_scan/checks/iam.py
+vigilai_scan/checks/kms.py
+vigilai_scan/checks/logging_monitoring.py
+vigilai_scan/checks/network.py
+vigilai_scan/checks/s3.py

vigilai_scan-0.1.0/vigilai_scan.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

vigilai_scan-0.1.0/vigilai_scan.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+vigilai-scan = vigilai_scan.cli:main

vigilai_scan-0.1.0/vigilai_scan.egg-info/requires.txt

@@ -0,0 +1,4 @@
+boto3>=1.28
+
+[dev]
+pytest>=7

vigilai_scan-0.1.0/vigilai_scan.egg-info/top_level.txt

@@ -0,0 +1 @@
+vigilai_scan