Metadata-Version: 2.4
Name: seesec-dpdp-scanner
Version: 0.3.0
Summary: Seesec DPDP Act 2023 Compliance Scanner — audit AWS, code, and files for DPDP violations
Author-email: "Seesec Infotech Pvt. Ltd." <opensource@seesec.io>
Project-URL: Homepage, https://seesec.io/
Project-URL: Repository, https://github.com/seesec-infotech/dpdp-scanner
Project-URL: Documentation, https://github.com/seesec-infotech/dpdp-scanner#readme
Keywords: dpdp,compliance,security,aws,pii,scanner,india
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: boto3>=1.34.0
Requires-Dist: typer>=0.12.0
Requires-Dist: rich>=13.7.0
Requires-Dist: cryptography>=41.0.0
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == "dev"
Requires-Dist: pytest-cov>=5.0; extra == "dev"
Requires-Dist: moto[dynamodb,ec2,guardduty,iam,kms,lambda,logs,rds,s3,secretsmanager,sns,sqs,sts]>=5.0; extra == "dev"
Dynamic: license-file

# Seesec DPDP Scanner

> 🛡️ India's first DPDP Act 2023 compliance scanner — audit AWS accounts, source code, and files for DPDP violations.

[![Tests](https://img.shields.io/badge/tests-64%20passed-green)]() [![Checks](https://img.shields.io/badge/AWS%20checks-51-blue)]() [![Python](https://img.shields.io/badge/python-3.11%2B-blue)]() [![License](https://img.shields.io/badge/license-Apache%202.0-orange)]()

Built by **[Seesec Infotech Pvt. Ltd.](https://seesec.io)** 🇮🇳

---

## ⚡ Quick Start

```bash
# Install
pip install seesec-dpdp-scanner

# Scan your AWS account (scans ALL regions by default)
aws sso login --profile your-profile
dpdp aws --profile your-profile -o report.html

# Scan only a specific region
dpdp aws --profile your-profile --region ap-south-1

# Scan files for PII leakage (Aadhaar, PAN, credit cards...)
dpdp pii /path/to/logs -o pii-report.html

# Scan source code for hardcoded secrets & crypto misuse
dpdp code /path/to/repo -o code-report.html

# Encrypt sensitive data (DPDP-compliant AES-256-GCM)
dpdp crypto encrypt --data "1234-5678-9012" --key-id alias/my-kms-key
```

## 🔍 What It Scans — 51 AWS Checks

```bash
# See all checks
dpdp aws --list-checks
```

### AWS Account (`dpdp aws`) — Scans ALL Regions by Default
| Family | Checks | DPDP Section |
|--------|--------|-------------|
| 🔐 Encryption (ENC) | S3, RDS, DynamoDB, EBS, SQS, SNS, KMS, Redshift, ElastiCache, S3 versioning, MFA Delete, Account S3 Block | Sec 8(5), Rule 6(1)(a) |
| 👤 IAM (IAM) | Root MFA, password policy, user MFA, stale keys, wildcard policies, unused roles | Sec 8(5), Rule 6(1)(b) |
| 📋 Logging (LOG) | CloudTrail, CloudWatch, VPC Flow Logs, S3 access logs, API Gateway, SSM Session Manager | Sec 8(5), Rule 6(1)(c-d) |
| 🌍 Data Residency (RES) | S3/RDS/Lambda in Indian regions | Sec 16 |
| 🚨 Breach Readiness (BRE) | GuardDuty, Security Hub | Sec 8(6) |
| 🔑 Secrets (SEC) | Lambda env secrets, Secrets Manager rotation, ECR image scanning | Sec 8(5) |
| 🌐 Network (NET) | Security group DB ports, ELB TLS 1.2+, CloudFront HTTPS, ACM cert expiry, WAF on ALBs | Sec 8(5) |
| 🗑️ Retention (RET) | S3 lifecycle, RDS backups, RDS deletion protection, RDS Multi-AZ, DynamoDB PITR | Sec 8(7) |
| ⚙️ Config (CFG) | AWS Config recording, IAM Access Analyzer | Sec 8(5) |

**Smart scanning:** Global services (IAM, S3, CloudFront) are scanned once. Regional services are scanned per-region.

### PII Scanner (`dpdp pii`)
Detects Indian PII with checksum validation to minimize false positives:
- **Aadhaar** (Verhoeff checksum) · **PAN** (4th-char type validation)
- **Credit Cards** (Luhn algorithm) · **Indian Mobiles** · **Emails**
- **Passports** · **Voter ID** · **GSTIN** · **UPI IDs** · **DOB patterns**

### Code Scanner (`dpdp code`)
18 static analysis rules detecting:
- Hardcoded passwords, API keys, AWS keys, connection strings
- Crypto misuse (ECB mode, DES/RC4, MD5/SHA1, static IVs)
- PII in log statements, URL parameters, and exception messages
- Disabled SSL verification

### Crypto Toolkit (`dpdp crypto`)
- **Encrypt/Decrypt**: AES-256-GCM with KMS Envelope Encryption
- **Blind Indexing**: HMAC-SHA256 for searching encrypted fields
- **Format Validation**: Verify DPDP ciphertext structure

## 📊 Output Formats

| Format | Command | Use Case |
|--------|---------|----------|
| Terminal | `dpdp aws` | Interactive use |
| HTML | `dpdp aws -o report.html` | Share with management |
| JSON | `dpdp aws -o report.json` | CI/CD pipelines |
| SARIF | `dpdp aws -o report.sarif` | GitHub Code Scanning |
| CSV | `dpdp aws -o report.csv` | Spreadsheets / Excel |

## 🛡️ Authentication

The scanner uses `boto3` and supports all standard AWS credential methods:

```bash
# Option 1: AWS SSO (recommended for enterprises)
aws sso login --profile my-profile
dpdp aws --profile my-profile

# Option 2: Environment Variables (for CI/CD)
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
dpdp aws

# Option 3: IAM Instance Roles (for EC2/ECS)
# No configuration needed — boto3 detects it automatically
dpdp aws
```

## 🔇 Suppressing False Positives

Create a `.dpdpignore` file in your project root:

```bash
# Ignore AWS-managed CloudFormation buckets
DPDP-ENC-001:cf-templates-*
DPDP-ENC-002:cf-templates-*

# Ignore a specific check entirely
DPDP-RES-001

# Ignore all checks for a test resource
*:my-test-bucket
```

## 🏗️ Multi-Region Scanning

```bash
# Default: scans ALL enabled AWS regions
dpdp aws

# Scan only Mumbai
dpdp aws --region ap-south-1

# Filter by check family
dpdp aws --checks ENC          # Only encryption checks
dpdp aws --checks IAM          # Only IAM checks
dpdp aws --severity critical   # Only critical findings
```

## 🚀 CI/CD Integration

### GitHub Actions
```yaml
- name: DPDP Compliance Scan
  run: |
    pip install seesec-dpdp-scanner
    dpdp aws -o dpdp-report.sarif
    
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: dpdp-report.sarif
```

Exit codes: `0` = no violations, `1` = violations found.

## 🧪 Development

```bash
git clone https://github.com/seesec-infotech/dpdp-scanner
cd dpdp-scanner
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest tests/ -v
```

## 📜 License

Apache 2.0 — see [LICENSE](LICENSE)

---

<p align="center">
  <strong>Made with ❤️ in India by <a href="https://seesec.io">Seesec Infotech</a></strong>
</p>
