Metadata-Version: 2.4
Name: iac-scanner
Version: 0.3.2
Summary: CLI to scan and fix Terraform and CDK IaC with LangChain-orchestrated agents
Author-email: Bishwas Jha <jha.bishwas@gmail.com>
Project-URL: Homepage, https://github.com/bishwasjha/iac-scanner
Project-URL: Repository, https://github.com/bishwasjha/iac-scanner
Project-URL: Documentation, https://bishwasjha.github.io/iac-scanner/
Project-URL: Issues, https://github.com/bishwasjha/iac-scanner/issues
Keywords: terraform,cdk,aws,aws-cdk,aws-cdk-lib,aws-cdk-lib-constructs,constructs,azure,azure-cdk,azure-cdk-lib,azure-cdk-lib-constructs,google,google-cdk,google-cdk-lib,google-cdk-lib-constructs,iac,iac-scanner,iac-scanner-cli,iac-scanner-langchain,iac-scanner-langchain-orchestrated,iac-scanner-langchain-orchestrated-agents,iac-scanner-langchain-orchestrated-agents-terraform,iac-scanner-langchain-orchestrated-agents-cdk,iac-scanner-langchain-orchestrated-agents-terraform-cdk,iac-scanner-langchain-orchestrated-agents-terraform-cdk-langchain,infrastructure-as-code,security,langchain,cli
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: Other/Proprietary License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: click>=8.1.0
Requires-Dist: langchain>=0.3.0
Requires-Dist: langchain-openai>=0.2.0
Requires-Dist: langchain-anthropic>=0.2.0
Requires-Dist: langchain-community>=0.3.0
Requires-Dist: langchain-core>=0.3.0
Requires-Dist: pydantic>=2.0.0
Provides-Extra: dev
Requires-Dist: pytest>=7.0.0; extra == "dev"
Requires-Dist: ruff>=0.4.0; extra == "dev"
Requires-Dist: build>=1.0.0; extra == "dev"
Requires-Dist: pre-commit>=3.0.0; extra == "dev"
Dynamic: license-file

# IaC Scanner

[![PyPI version](https://img.shields.io/pypi/v/iac-scanner)](https://pypi.org/project/iac-scanner/)
[![CI](https://github.com/bishwasjha/iac-scanner/actions/workflows/ci.yml/badge.svg)](https://github.com/bishwasjha/iac-scanner/actions/workflows/ci.yml)

Python CLI that scans Terraform and AWS CDK Infrastructure-as-Code, then produces a **report** and **fixed code**. Built with a **factory pattern** (scanner per IaC type) and **LangChain** orchestration where **each task uses a different AI** (analysis vs code generation).

**License:** [Personal Use License](LICENSE) — personal use permitted; redistribution (including publishing or selling) requires permission. Contributing back via pull request is welcome.

## Quickstart (30 seconds, no API key)

```bash
pip install iac-scanner
iac-scan scan ./samples/tf -o ./out --scan-only
```

Example output:

```
Detected: terraform (entry: .../samples/tf/main.tf)
Scan-only: writing report (no AI).
Output written to: ./out
  - ./out/scan-report.json
```

Open `./out/scan-report.json` for `iac_type`, `metadata.files`, and `findings`. To get **findings and fixed code**, set `OPENAI_API_KEY` (or `ANTHROPIC_API_KEY`) and run without `--scan-only`:

```bash
export OPENAI_API_KEY=sk-...
iac-scan scan ./samples/tf -o ./out
```

## Input (CLI)

- **Terraform**: path to a directory containing `main.tf`, or path to `main.tf` itself.
- **CDK**: path to a directory containing `index.ts` or `index.js`, or path to that file.

## Process

1. **Factory** creates the right scanner (`TerraformScanner` or `CdkScanner`) from the given path.
2. **Scan**: load entry file(s) and gather content.
3. **Analysis task** (LangChain + **analysis AI**): security and best-practice findings.
4. **Fix task** (LangChain + **fix AI**): generate corrected code from findings.
5. **Output**: report (JSON) and fixed TF/CDK code under an output directory.

## Output

- **Report**: `scan-report.json` with `iac_type`, `entry_path`, `findings`, and metadata.
- **Fixed code**: under `fixed/` (same structure as detected files when the model returns multi-file blocks).

## Install

```bash
cd iac-scanner
pip install -e .
# or
pip install -r requirements.txt
```

## Usage

```bash
# Scan Terraform (directory with main.tf or path to main.tf)
iac-scan scan ./my-tf-dir
iac-scan scan ./my-tf-dir/main.tf

# Scan CDK (directory with index.ts or path to index.ts)
iac-scan scan ./my-cdk-app
iac-scan scan ./my-cdk-app/index.ts

# Custom output directory and report name
iac-scan scan ./my-tf-dir -o ./reports --report-name report.json

# Only report, no fix step
iac-scan scan ./my-tf-dir --no-fix

# Scan only (no AI), for testing without API keys
iac-scan scan ./my-tf-dir --scan-only

# Choose AI per task (analysis vs fix)
iac-scan scan ./my-tf-dir --analysis-ai openai --fix-ai anthropic
```

## Environment (different AI per task)

- **Analysis task**: `IAC_ANALYSIS_AI=openai` (default) or `anthropic`; `IAC_ANALYSIS_MODEL` for model name. Uses `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`.
- **Fix task**: `IAC_FIX_AI=openai` (default) or `anthropic`; `IAC_FIX_MODEL` for model name.

Example:

```bash
export OPENAI_API_KEY=sk-...
export ANTHROPIC_API_KEY=sk-ant-...
iac-scan scan ./tf -o ./out
```

## Blog and tutorial

Articles and a step-by-step tutorial are published on **GitHub Pages**. Enable in the repo under **Settings → Pages** (source: branch **main**, folder **/docs**). The site will be at `https://<owner>.github.io/iac-scanner/`.

## Contributing

Contribution guidelines, development setup, and release process are in **[CONTRIBUTING.md](CONTRIBUTING.md)** (in the source repository). If you installed from PyPI, open the project repo to see that file.

## Project layout (factory + orchestration)

```
src/iac_scanner/
  cli.py              # CLI entry (click)
  factory.py          # create_scanner(path) -> TerraformScanner | CdkScanner
  scanners/
    base.py           # IacScanner (abstract), ScanResult
    terraform.py      # TerraformScanner (main.tf)
    cdk.py            # CdkScanner (index.ts / index.js)
  orchestration/
    tasks.py          # analysis_chain() / fix_chain() — different LLM per task
    runner.py         # run_pipeline(scanner) -> PipelineResult
  output/
    report.py         # write_report_and_fixes()
```
