Metadata-Version: 2.4
Name: seesec-dpdp-scanner
Version: 0.4.0
Summary: Seesec DPDP Act 2023 Compliance Scanner — audit AWS, code, and files for DPDP violations
Author-email: "Seesec Infotech Pvt. Ltd." <opensource@seesec.io>
Project-URL: Homepage, https://seesec.io/
Project-URL: Repository, https://github.com/seesec-infotech/dpdp-scanner
Project-URL: Documentation, https://github.com/seesec-infotech/dpdp-scanner#readme
Keywords: dpdp,compliance,security,aws,pii,scanner,india
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: boto3>=1.34.0
Requires-Dist: typer>=0.12.0
Requires-Dist: rich>=13.7.0
Requires-Dist: cryptography>=41.0.0
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == "dev"
Requires-Dist: pytest-cov>=5.0; extra == "dev"
Requires-Dist: moto[dynamodb,ec2,guardduty,iam,kms,lambda,logs,rds,s3,secretsmanager,sns,sqs,sts]>=5.0; extra == "dev"
Dynamic: license-file

# Seesec DPDP Scanner

> 🛡️ India's first DPDP Act 2023 compliance scanner — audit AWS accounts, source code, and files for DPDP violations.

[![Tests](https://img.shields.io/badge/tests-passing-green)]() [![Checks](https://img.shields.io/badge/AWS%20checks-59-blue)]() [![Python](https://img.shields.io/badge/python-3.11%2B-blue)]() [![License](https://img.shields.io/badge/license-Apache%202.0-orange)]()

Built by **[Seesec Infotech Pvt. Ltd.](https://seesec.io)** 🇮🇳

---

## ⚡ Quick Start

```bash
# Install
pip install seesec-dpdp-scanner

# Scan your AWS account (scans ALL regions by default)
aws sso login --profile your-profile
dpdp aws --profile your-profile -o report.html

# Scan only a specific region
dpdp aws --profile your-profile --region ap-south-1

# Scan files for PII leakage (Aadhaar, PAN, credit cards...)
dpdp pii /path/to/logs -o pii-report.html

# Scan source code for hardcoded secrets & crypto misuse
dpdp code /path/to/repo -o code-report.html

# Encrypt sensitive data (DPDP-compliant AES-256-GCM)
dpdp crypto encrypt --data "1234-5678-9012" --key-id alias/my-kms-key
```

## 🔍 What It Scans — 59 AWS Checks

```bash
# See all checks
dpdp aws --list-checks
```

### AWS Account (`dpdp aws`) — Scans ALL Regions by Default
| Family | Checks | DPDP Section |
|--------|--------|-------------|
| 🔐 Encryption (ENC) | S3, RDS, DynamoDB, EBS, SQS, SNS, KMS, Redshift, ElastiCache, S3 versioning, MFA Delete, Account S3 Block | Sec 8(5), Rule 6(1)(a) |
| 👤 IAM (IAM) | Root MFA, password policy, user MFA, stale keys, wildcard policies, unused roles, RDS IAM auth | Sec 8(5), Rule 6(1)(b) |
| 📋 Logging (LOG) | CloudTrail, CloudWatch, VPC Flow Logs, S3 access logs, API Gateway, SSM Session Manager | Sec 8(5), Rule 6(1)(c-d) |
| 🌍 Data Residency (RES) | S3/RDS/Lambda in Indian regions | Sec 16 |
| 🚨 Breach Readiness (BRE) | GuardDuty, Security Hub, **Macie**, **SNS incident alerting** | Sec 8(6) |
| 🔑 Secrets (SEC) | Lambda env secrets, Secrets Manager rotation, ECR image scanning, **ECS task secrets**, **EC2 user data** | Sec 8(5) |
| 🌐 Network (NET) | Security group DB ports, ELB TLS 1.2+, CloudFront HTTPS, ACM cert expiry, WAF on ALBs, **CloudFront WAF** | Sec 8(5) |
| 🗑️ Retention (RET) | S3 lifecycle, RDS backups, RDS deletion protection, RDS Multi-AZ, DynamoDB PITR, **S3 Object Lock** | Sec 8(7) |
| ⚙️ Config (CFG) | AWS Config recording, IAM Access Analyzer, **Organizations SCPs** | Sec 8(5), Sec 16 |

**Smart scanning:** Global services (IAM, S3, CloudFront) are scanned once. Regional services are scanned per-region.

### PII Scanner (`dpdp pii`)
Detects Indian PII with checksum validation to minimize false positives:
- **Aadhaar** (Verhoeff checksum) · **PAN** (4th-char type validation)
- **Credit Cards** (Luhn algorithm) · **Indian Mobiles** · **Emails**
- **Passports** · **Voter ID** · **GSTIN** · **UPI IDs** · **DOB patterns**

### Code Scanner (`dpdp code`)
18 static analysis rules detecting:
- Hardcoded passwords, API keys, AWS keys, connection strings
- Crypto misuse (ECB mode, DES/RC4, MD5/SHA1, static IVs)
- PII in log statements, URL parameters, and exception messages
- Disabled SSL verification

### Crypto Toolkit (`dpdp crypto`)
- **Encrypt/Decrypt**: AES-256-GCM with KMS Envelope Encryption
- **Blind Indexing**: HMAC-SHA256 for searching encrypted fields
- **Format Validation**: Verify DPDP ciphertext structure

## 📊 Output Formats

| Format | Command | Use Case |
|--------|---------|----------|
| Terminal | `dpdp aws` | Interactive use |
| HTML | `dpdp aws -o report.html` | Share with management |
| JSON | `dpdp aws -o report.json` | CI/CD pipelines |
| SARIF | `dpdp aws -o report.sarif` | GitHub Code Scanning |
| CSV | `dpdp aws -o report.csv` | Spreadsheets / Excel |

## 🛡️ Authentication

The scanner uses `boto3` and supports all standard AWS credential methods:

```bash
# Option 1: AWS SSO (recommended for enterprises)
aws sso login --profile my-profile
dpdp aws --profile my-profile

# Option 2: Environment Variables (for CI/CD)
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
dpdp aws

# Option 3: IAM Instance Roles (for EC2/ECS)
# No configuration needed — boto3 detects it automatically
dpdp aws
```

## 🔇 Suppressing False Positives

Create a `.dpdpignore` file in your project root:

```bash
# Ignore AWS-managed CloudFormation buckets
DPDP-ENC-001:cf-templates-*
DPDP-ENC-002:cf-templates-*

# Ignore a specific check entirely
DPDP-RES-001

# Ignore all checks for a test resource
*:my-test-bucket
```

## 🏗️ Multi-Region Scanning

```bash
# Default: scans ALL enabled AWS regions, in parallel
dpdp aws

# Scan only Mumbai
dpdp aws --region ap-south-1

# Multi-family filter (Prowler-style)
dpdp aws --checks ENC,IAM,LOG

# Severity filter
dpdp aws --severity critical,high

# Crank parallelism for big accounts
dpdp aws --workers 16

# Quiet mode for CI (one-line summary)
dpdp aws --quiet -o report.sarif
```

## 📊 Track Remediation Progress (Baseline Diff)

```bash
# First scan — save as baseline
dpdp aws --save-baseline baseline.json

# Future scans — only show NEW findings vs baseline
dpdp aws --baseline baseline.json
```

## 📦 Export Multiple Formats At Once

```bash
# Dump JSON, HTML, SARIF, CSV in one go
dpdp aws --output-dir ./reports
```

## 🚀 CI/CD Integration

### GitHub Actions
```yaml
- name: DPDP Compliance Scan
  run: |
    pip install seesec-dpdp-scanner
    dpdp aws -o dpdp-report.sarif
    
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: dpdp-report.sarif
```

Exit codes: `0` = no violations, `1` = violations found.

## 🧪 Development

```bash
git clone https://github.com/seesec-infotech/dpdp-scanner
cd dpdp-scanner
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest tests/ -v
```

## ⚖️ Scope: What This Tool Does (and Does Not) Check

The DPDP Scanner is a **technical posture** tool. It checks AWS infrastructure, source code, and files. It **cannot** evaluate organisational, legal, or runtime obligations on its own. Use it alongside the manual checklist below.

| Covered ✅ | Manual / Out of Scope ❌ |
|---|---|
| Sec 8(5) Security safeguards (encryption, IAM, network, secrets) | Sec 5 Privacy notice content (legal review) |
| Sec 16 Data residency (region, SCPs) | Sec 6, 7 Consent UX (granular, withdrawable, recorded) |
| Sec 8(6) Breach detection readiness (GuardDuty, Macie, SNS) | Sec 8(2) Written processor agreements with vendors |
| Sec 8(7) Erasure capability (S3 lifecycle, RDS backups) | Sec 8(6) The 72-hr breach *notification* process |
| PII leakage in logs and source code | Sec 8(9) Grievance officer published on website |
| DPDP-compliant crypto helpers | Sec 9 Verifiable parental consent for children |
|  | Sec 10 DPIA, audit, DPO (Significant Data Fiduciaries) |
|  | Sec 11–13 DSAR SLAs (access / correction / erasure) |

If you're a **Significant Data Fiduciary** under Sec 10, you'll also need governance documentation, a DPIA, and a DPO — those live outside this tool.

## 📜 License

Apache 2.0 — see [LICENSE](LICENSE)

---

<p align="center">
  <strong>Made with ❤️ in India by <a href="https://seesec.io">Seesec Infotech</a></strong>
</p>
