seesec-dpdp-scanner 0.5.0

Seesec DPDP Act 2023 Compliance Scanner — audit AWS, code, and files for DPDP violations

Seesec DPDP Scanner

🛡️ India's first DPDP Act 2023 compliance scanner — audit AWS accounts, source code, and files for DPDP violations.

Built by Seesec Infotech Pvt. Ltd. 🇮🇳

---

⚡ Quick Start

# Install
pip install seesec-dpdp-scanner

# Scan your AWS account (scans ALL regions by default)
aws sso login --profile your-profile
dpdp aws --profile your-profile -o report.html

# Scan only a specific region
dpdp aws --profile your-profile --region ap-south-1

# Scan files for PII leakage (Aadhaar, PAN, credit cards...)
dpdp pii /path/to/logs -o pii-report.html

# Scan LIVE CloudWatch Logs for PII (last 1 hour, all regions)
dpdp logs --since 6h -o cw-pii.html

# Scan source code for hardcoded secrets & crypto misuse
dpdp code /path/to/repo -o code-report.html

# Encrypt sensitive data (DPDP-compliant AES-256-GCM)
dpdp crypto encrypt --data "1234-5678-9012" --key-id alias/my-kms-key

🔍 What It Scans — 59 AWS Checks

# See all checks
dpdp aws --list-checks

AWS Account (dpdp aws) — Scans ALL Regions by Default

Family	Checks	DPDP Section
🔐 Encryption (ENC)	S3, RDS, DynamoDB, EBS, SQS, SNS, KMS, Redshift, ElastiCache, S3 versioning, MFA Delete, Account S3 Block	Sec 8(5), Rule 6(1)(a)
👤 IAM (IAM)	Root MFA, password policy, user MFA, stale keys, wildcard policies, unused roles, RDS IAM auth	Sec 8(5), Rule 6(1)(b)
📋 Logging (LOG)	CloudTrail, CloudWatch, VPC Flow Logs, S3 access logs, API Gateway, SSM Session Manager	Sec 8(5), Rule 6(1)(c-d)
🌍 Data Residency (RES)	S3/RDS/Lambda in Indian regions	Sec 16
🚨 Breach Readiness (BRE)	GuardDuty, Security Hub, Macie, SNS incident alerting	Sec 8(6)
🔑 Secrets (SEC)	Lambda env secrets, Secrets Manager rotation, ECR image scanning, ECS task secrets, EC2 user data	Sec 8(5)
🌐 Network (NET)	Security group DB ports, ELB TLS 1.2+, CloudFront HTTPS, ACM cert expiry, WAF on ALBs, CloudFront WAF	Sec 8(5)
🗑️ Retention (RET)	S3 lifecycle, RDS backups, RDS deletion protection, RDS Multi-AZ, DynamoDB PITR, S3 Object Lock	Sec 8(7)
⚙️ Config (CFG)	AWS Config recording, IAM Access Analyzer, Organizations SCPs	Sec 8(5), Sec 16

Smart scanning: Global services (IAM, S3, CloudFront) are scanned once. Regional services are scanned per-region.

PII Scanner (dpdp pii)

Detects Indian PII with checksum validation to minimize false positives:

• Aadhaar (Verhoeff checksum) · PAN (4th-char type validation)
• Credit Cards (Luhn algorithm) · Indian Mobiles · Emails
• Passports · Voter ID · GSTIN · UPI IDs · DOB patterns

Code Scanner (dpdp code)

18 static analysis rules detecting:

• Hardcoded passwords, API keys, AWS keys, connection strings
• Crypto misuse (ECB mode, DES/RC4, MD5/SHA1, static IVs)
• PII in log statements, URL parameters, and exception messages
• Disabled SSL verification

CloudWatch Logs Scanner (dpdp logs)

Live PII detection in AWS CloudWatch Logs — the same Indian-PII patterns used by dpdp pii, applied to actual log events being written right now:

# Last hour, every region, every log group
dpdp logs

# Last week, only Lambda logs in Mumbai
dpdp logs --since 7d --region ap-south-1 --log-group /aws/lambda

# ISO 8601 window for an incident postmortem
dpdp logs --since 2026-06-20T00:00:00Z -o incident-pii.html

Cost guardrail: --max-events 10000 per log group by default.

Crypto Toolkit (dpdp crypto)

• Encrypt/Decrypt: AES-256-GCM with KMS Envelope Encryption
• Blind Indexing: HMAC-SHA256 for searching encrypted fields
• Format Validation: Verify DPDP ciphertext structure

📊 Output Formats

Format	Command	Use Case
Terminal	dpdp aws	Interactive use
HTML	dpdp aws -o report.html	Share with management
JSON	dpdp aws -o report.json	CI/CD pipelines
SARIF	dpdp aws -o report.sarif	GitHub Code Scanning
CSV	dpdp aws -o report.csv	Spreadsheets / Excel

🛡️ Authentication

The scanner uses boto3 and supports all standard AWS credential methods:

# Option 1: AWS SSO (recommended for enterprises)
aws sso login --profile my-profile
dpdp aws --profile my-profile

# Option 2: Environment Variables (for CI/CD)
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
dpdp aws

# Option 3: IAM Instance Roles (for EC2/ECS)
# No configuration needed — boto3 detects it automatically
dpdp aws

🔇 Suppressing False Positives

Create a .dpdpignore file in your project root:

# Ignore AWS-managed CloudFormation buckets
DPDP-ENC-001:cf-templates-*
DPDP-ENC-002:cf-templates-*

# Ignore a specific check entirely
DPDP-RES-001

# Ignore all checks for a test resource
*:my-test-bucket

🏗️ Multi-Region Scanning

# Default: scans ALL enabled AWS regions, in parallel
dpdp aws

# Scan only Mumbai
dpdp aws --region ap-south-1

# Multi-family filter (Prowler-style)
dpdp aws --checks ENC,IAM,LOG

# Severity filter
dpdp aws --severity critical,high

# Crank parallelism for big accounts
dpdp aws --workers 16

# Quiet mode for CI (one-line summary)
dpdp aws --quiet -o report.sarif

📊 Track Remediation Progress (Baseline Diff)

# First scan — save as baseline
dpdp aws --save-baseline baseline.json

# Future scans — only show NEW findings vs baseline
dpdp aws --baseline baseline.json

📦 Export Multiple Formats At Once

# Dump JSON, HTML, SARIF, CSV in one go
dpdp aws --output-dir ./reports

🚀 CI/CD Integration

GitHub Actions

- name: DPDP Compliance Scan
  run: |
    pip install seesec-dpdp-scanner
    dpdp aws -o dpdp-report.sarif
    
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: dpdp-report.sarif

Exit codes: 0 = no violations, 1 = violations found.

🧪 Development

git clone https://github.com/seesec-infotech/dpdp-scanner
cd dpdp-scanner
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest tests/ -v

⚖️ Scope: What This Tool Does (and Does Not) Check

The DPDP Scanner is a technical posture tool. It checks AWS infrastructure, source code, and files. It cannot evaluate organisational, legal, or runtime obligations on its own. Use it alongside the manual checklist below.

Covered ✅	Manual / Out of Scope ❌
Sec 8(5) Security safeguards (encryption, IAM, network, secrets)	Sec 5 Privacy notice content (legal review)
Sec 16 Data residency (region, SCPs)	Sec 6, 7 Consent UX (granular, withdrawable, recorded)
Sec 8(6) Breach detection readiness (GuardDuty, Macie, SNS)	Sec 8(2) Written processor agreements with vendors
Sec 8(7) Erasure capability (S3 lifecycle, RDS backups)	Sec 8(6) The 72-hr breach notification process
PII leakage in logs and source code	Sec 8(9) Grievance officer published on website
DPDP-compliant crypto helpers	Sec 9 Verifiable parental consent for children
	Sec 10 DPIA, audit, DPO (Significant Data Fiduciaries)
	Sec 11–13 DSAR SLAs (access / correction / erasure)

If you're a Significant Data Fiduciary under Sec 10, you'll also need governance documentation, a DPIA, and a DPO — those live outside this tool.

📜 License

Apache 2.0 — see LICENSE

---

Made with ❤️ in India by Seesec Infotech