calethia 0.2.1

Calethia SDK for writing compliance policies as code

Calethia SDK

Python SDK for writing compliance policies as code.

Installation

pip install calethia

Quick Start

from calethia import policy, Severity
from calethia.aws import iam
from calethia.frameworks import SOC2, CIS_AWS

@policy(
    id="aws.iam.mfa_required",
    name="IAM Users Have MFA",
    severity=Severity.HIGH,
    frameworks=[SOC2("CC6.1"), CIS_AWS("1.10")],
)
def check_mfa(ctx: iam.Context) -> iam.Result:
    """Ensure all IAM users with console access have MFA enabled."""
    users = ctx.list_users()

    for user in users:
        if user.has_console_access and not user.mfa_enabled:
            ctx.fail(user.to_resource(), "User has console access but no MFA")
        else:
            ctx.pass_(user.to_resource())

    return ctx.result()

Features

• Decorator-based policy definition
• Type-safe framework control mappings
• AWS context with managed boto3 clients
• Full IDE autocomplete support

License

Source-available under the Functional Source License 1.1 with an Apache 2.0 Future License (FSL-1.1-ALv2). Copyright 2026 Calethia.

In short:

• You may read, run, modify, and redistribute this SDK for any purpose except a Competing Use — reselling it, or shipping it inside a commercial product or service that substitutes for Calethia. Internal use at your company, non-commercial education, and non-commercial research are all expressly permitted.
• Your policies are yours. FSL carries no copyleft or share-alike obligation. Importing calethia does not encumber the policy code you write against it — keep it, relicense it, or take it elsewhere.
• Every version becomes Apache-2.0 on the second anniversary of its release, so you can keep running your compliance checks indefinitely, with or without an account.

FSL is source-available, not an OSI-approved open source license. The SDK is provided as is, without warranties, and Calethia's liability is limited — see the Disclaimer section of LICENSE.md. It assists with compliance verification; it does not guarantee a passing audit. Third-party dependency licenses are inventoried in NOTICE.md.