Metadata-Version: 2.4
Name: pysecuredeploy
Version: 0.1.0
Summary: One-command secure cloud deployment engine for Python Web Apps (FastAPI, Flask, Django)
Author-email: Vignesh <vignesh@users.noreply.github.com>
License: MIT
Project-URL: Homepage, https://github.com/vignesh476/pysecuredeploy
Project-URL: Repository, https://github.com/vignesh476/pysecuredeploy
Project-URL: Documentation, https://github.com/vignesh476/pysecuredeploy#readme
Project-URL: Issues, https://github.com/vignesh476/pysecuredeploy/issues
Keywords: fastapi,flask,django,aws,gcp,azure,security,deployment,devops,ecs,cloudrun
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Topic :: Software Development :: Build Tools
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: typer[all]>=0.9.0
Requires-Dist: rich>=13.0.0
Requires-Dist: pydantic>=2.0.0
Requires-Dist: boto3>=1.28.0
Requires-Dist: python-dotenv>=1.0.0
Requires-Dist: pyyaml>=6.0
Requires-Dist: requests>=2.31.0
Requires-Dist: cryptography>=41.0.0
Provides-Extra: dev
Requires-Dist: pytest>=7.4.0; extra == "dev"
Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
Requires-Dist: fastapi>=0.100.0; extra == "dev"
Requires-Dist: uvicorn>=0.23.0; extra == "dev"
Requires-Dist: flask>=2.3.0; extra == "dev"
Requires-Dist: django>=4.2.0; extra == "dev"
Dynamic: license-file

# pysecuredeploy

**One-command secure cloud deployment engine for Python web applications.**

[![CI](https://github.com/vignesh476/pysecuredeploy/actions/workflows/ci.yml/badge.svg)](https://github.com/vignesh476/pysecuredeploy/actions/workflows/ci.yml)
[![PyPI version](https://img.shields.io/pypi/v/pysecuredeploy.svg)](https://pypi.org/project/pysecuredeploy/)
[![Python versions](https://img.shields.io/pypi/pyversions/pysecuredeploy.svg)](https://pypi.org/project/pysecuredeploy/)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)

`pysecuredeploy` automates the containerization, identity provisioning, secrets encryption, database wiring, WAF defense, and infrastructure deployment of **FastAPI**, **Flask**, and **Django** applications to **AWS**, **GCP**, and **Azure** with a single command—enforcing production security defaults out of the box.

---

## Key Features

- **Zero-Boilerplate Deployments**: Automatically detects framework, entrypoints, and ASGI/WSGI servers without requiring manual Dockerfiles or CloudFormation/HCL scripts.
- **One-Command Managed Databases & Cache**: Attach private RDS PostgreSQL, MySQL, or Redis with `--db postgres` and `--cache redis`—with automatic KMS password generation and secret injection.
- **WAF & DDoS Armor**: One-click OWASP Top 10 rule enforcement and IP rate limiting with `--waf`.
- **Ephemeral Preview Environments**: Spin up temporary, isolated staging environments for Pull Requests with `--preview --ttl 24h`.
- **SOC 2 & HIPAA Compliance Audit**: Generate instant compliance evidence reports with `pysecuredeploy compliance-report`.
- **FinOps Cost Estimator**: Preview granular monthly cloud run-rates and set budget alerts before deploying via `pysecuredeploy cost`.
- **Live Log Streaming**: Tail and stream container logs directly into your terminal with `pysecuredeploy logs <app>`.
- **Keyless OIDC CI/CD Generator**: Create secure GitHub Actions workflows with zero stored static AWS access keys via `pysecuredeploy ci init`.
- **Micro-Scoped Least-Privilege IAM**: Generates execution roles strictly bounded to the target application resources with zero unauthorized write wildcards.
- **Hardened Container Isolation**: Auto-generates multi-stage images running as an unprivileged system user (`UID 10001`) with dropped Linux capabilities and read-only root filesystems.
- **Automated Canary Probing & Rollback**: Probes endpoints post-deployment and triggers instant zero-downtime rollback if health checks fail.

---

## Architecture

```
                       +-----------------------------------+
                       |    FastAPI / Flask / Django       |
                       +-----------------+-----------------+
                                         |
                            [ pysecuredeploy CLI & API ]
                                         |
         +-------------------------------+-------------------------------+
         |                               |                               |
         v                               v                               v
[ Framework Inspector ]       [ Container Hardener ]         [ Identity & Secrets ]
 • AST & Entrypoint Resolver   • Multi-stage build (slim)     • Micro-scoped IAM
 • Port & Dependency Mapping   • Non-root runtime (UID 10001)  • KMS-encrypted vault
 • Health Probe Discovery      • Linux capability drops       • TLS 1.3 / ACM certs
         |                               |                               |
         +-------------------------------+-------------------------------+
                                         |
             [ Zero-Trust Infrastructure & Security Mesh ]
                                         |
         +-------------------------------+-------------------------------+
         |                               |                               |
         v                               v                               v
[ Managed DB & Cache ]          [ WAF & DDoS Shield ]        [ Telemetry & Probing ]
 • Private RDS Postgres/MySQL   • OWASP Top 10 CRS           • Synthetic Canary Probes
 • Private Redis Cluster        • Client IP Rate Limiting    • Automated Rollback
 • KMS Credential Auto-Wiring   • Bot & Scanner Control      • Live Log Streaming
         |                               |                               |
         +-------------------------------+-------------------------------+
                                         |
         +-------------------------------+-------------------------------+
         |                               |                               |
         v                               v                               v
      [ AWS ]                         [ GCP ]                         [ Azure ]
  • ECS Fargate (Private)         • Cloud Run                     • Container Apps
  • Application Load Balancer     • Artifact Registry             • Key Vault
  • Secrets Manager + KMS         • Secret Manager                • Managed Identity
  • CloudWatch Telemetry          • Cloud Logging                 • Azure Monitor
```

---

## Installation

Install via `pip`:

```bash
pip install pysecuredeploy
```

To install with development dependencies:

```bash
pip install "pysecuredeploy[dev]"
```

---

## Quickstart & CLI Commands

### 1. Deploy with Database, Redis Cache, and WAF Protection
```bash
pysecuredeploy deploy ./examples/fastapi_app --cloud aws --db postgres --cache redis --waf --rate-limit 120
```

### 2. Ephemeral Pull Request Preview Environment
```bash
pysecuredeploy preview ./examples/fastapi_app --branch pr-42 --ttl 24
```

### 3. Generate SOC 2 & HIPAA Compliance Report
```bash
pysecuredeploy compliance-report ./examples/fastapi_app
# Or export structured JSON for compliance auditors:
pysecuredeploy compliance-report ./examples/fastapi_app --format json
```

### 4. Estimate Monthly Cloud Infrastructure Costs
```bash
pysecuredeploy cost ./examples/fastapi_app --cloud aws --db postgres --waf
```

### 5. Stream Live Container Logs to Terminal
```bash
pysecuredeploy logs fastapi-app --follow --tail 50
```

### 6. Generate Keyless OIDC CI/CD Workflow (Zero Stored Secrets)
```bash
pysecuredeploy ci init . --provider github
```

### 7. Run Locally with Hardened Config
```bash
pysecuredeploy local ./examples/fastapi_app --port 8000
```

### 8. Pre-Deployment Security Audit
```bash
pysecuredeploy audit ./examples/fastapi_app
```

---

## Python API

`pysecuredeploy` can be integrated directly into Python scripts or automation workflows:

```python
from securedeploy import Deployer

# Initialize orchestrator with database, cache, and WAF defense
deployer = Deployer(
    framework="fastapi",
    cloud="aws",
    region="us-east-1",
    secure=True,
    database="postgres",
    cache="redis",
    enable_waf=True,
    waf_rate_limit=100,
    custom_domain="api.example.com"
)

# Inspect application
spec = deployer.inspect_app("./examples/fastapi_app")
print(f"Detected {spec.framework} on port {spec.port}")

# Execute atomic deployment
result = deployer.deploy("./examples/fastapi_app")
print(f"Status: {result.status}")
print(f"Live URL: {result.endpoint_url}")
print(f"Database URL: {result.database_url}")
print(f"Metrics: {result.metrics_url}")
```

---

## Security & Compliance Model

| Security Pillar | Standard Cloud Deployments | `pysecuredeploy` Enforcement |
| :--- | :--- | :--- |
| **Identity & Access** | Broad wildcard IAM (`*`) | Micro-scoped ARN policies generated per app |
| **Secrets Management** | Plaintext environment variables | KMS Encrypted Cloud Vaults (`Secrets Manager`, `Key Vault`) |
| **Container Hardening** | Runs as `root` with default capabilities | Unprivileged user `UID 10001`, dropped Linux capabilities, read-only root |
| **Network Isolation** | Public IPs directly on containers | Private Subnets only; traffic ingress via hardened ALB |
| **Database Security** | Public database endpoints | Zero-trust private VPC peering; high-entropy KMS credentials |
| **Application Firewall**| No WAF or manual configuration | Managed OWASP Top 10 rules + IP rate limiting attached to ALB |
| **Transport Layer** | Manual SSL configuration | TLS 1.3/1.2 only, automated certificates, enforced HSTS |
| **Failure Recovery** | Broken revisions remain live | Synthetic health verification with auto-rollback |

---

## Development & Testing

Run test suite:

```bash
pytest -v
```

Format code:

```bash
make format
```

Run linter:

```bash
make lint
```

---

## License

This project is licensed under the MIT License. See [LICENSE](LICENSE) for details.
