seesec-dpdp-scanner 0.3.0

Seesec DPDP Act 2023 Compliance Scanner — audit AWS, code, and files for DPDP violations

Seesec DPDP Scanner

🛡️ India's first DPDP Act 2023 compliance scanner — audit AWS accounts, source code, and files for DPDP violations.

Built by Seesec Infotech Pvt. Ltd. 🇮🇳

---

⚡ Quick Start

# Install
pip install seesec-dpdp-scanner

# Scan your AWS account (scans ALL regions by default)
aws sso login --profile your-profile
dpdp aws --profile your-profile -o report.html

# Scan only a specific region
dpdp aws --profile your-profile --region ap-south-1

# Scan files for PII leakage (Aadhaar, PAN, credit cards...)
dpdp pii /path/to/logs -o pii-report.html

# Scan source code for hardcoded secrets & crypto misuse
dpdp code /path/to/repo -o code-report.html

# Encrypt sensitive data (DPDP-compliant AES-256-GCM)
dpdp crypto encrypt --data "1234-5678-9012" --key-id alias/my-kms-key

🔍 What It Scans — 51 AWS Checks

# See all checks
dpdp aws --list-checks

AWS Account (dpdp aws) — Scans ALL Regions by Default

Family	Checks	DPDP Section
🔐 Encryption (ENC)	S3, RDS, DynamoDB, EBS, SQS, SNS, KMS, Redshift, ElastiCache, S3 versioning, MFA Delete, Account S3 Block	Sec 8(5), Rule 6(1)(a)
👤 IAM (IAM)	Root MFA, password policy, user MFA, stale keys, wildcard policies, unused roles	Sec 8(5), Rule 6(1)(b)
📋 Logging (LOG)	CloudTrail, CloudWatch, VPC Flow Logs, S3 access logs, API Gateway, SSM Session Manager	Sec 8(5), Rule 6(1)(c-d)
🌍 Data Residency (RES)	S3/RDS/Lambda in Indian regions	Sec 16
🚨 Breach Readiness (BRE)	GuardDuty, Security Hub	Sec 8(6)
🔑 Secrets (SEC)	Lambda env secrets, Secrets Manager rotation, ECR image scanning	Sec 8(5)
🌐 Network (NET)	Security group DB ports, ELB TLS 1.2+, CloudFront HTTPS, ACM cert expiry, WAF on ALBs	Sec 8(5)
🗑️ Retention (RET)	S3 lifecycle, RDS backups, RDS deletion protection, RDS Multi-AZ, DynamoDB PITR	Sec 8(7)
⚙️ Config (CFG)	AWS Config recording, IAM Access Analyzer	Sec 8(5)

Smart scanning: Global services (IAM, S3, CloudFront) are scanned once. Regional services are scanned per-region.

PII Scanner (dpdp pii)

Detects Indian PII with checksum validation to minimize false positives:

• Aadhaar (Verhoeff checksum) · PAN (4th-char type validation)
• Credit Cards (Luhn algorithm) · Indian Mobiles · Emails
• Passports · Voter ID · GSTIN · UPI IDs · DOB patterns

Code Scanner (dpdp code)

18 static analysis rules detecting:

• Hardcoded passwords, API keys, AWS keys, connection strings
• Crypto misuse (ECB mode, DES/RC4, MD5/SHA1, static IVs)
• PII in log statements, URL parameters, and exception messages
• Disabled SSL verification

Crypto Toolkit (dpdp crypto)

• Encrypt/Decrypt: AES-256-GCM with KMS Envelope Encryption
• Blind Indexing: HMAC-SHA256 for searching encrypted fields
• Format Validation: Verify DPDP ciphertext structure

📊 Output Formats

Format	Command	Use Case
Terminal	dpdp aws	Interactive use
HTML	dpdp aws -o report.html	Share with management
JSON	dpdp aws -o report.json	CI/CD pipelines
SARIF	dpdp aws -o report.sarif	GitHub Code Scanning
CSV	dpdp aws -o report.csv	Spreadsheets / Excel

🛡️ Authentication

The scanner uses boto3 and supports all standard AWS credential methods:

# Option 1: AWS SSO (recommended for enterprises)
aws sso login --profile my-profile
dpdp aws --profile my-profile

# Option 2: Environment Variables (for CI/CD)
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
dpdp aws

# Option 3: IAM Instance Roles (for EC2/ECS)
# No configuration needed — boto3 detects it automatically
dpdp aws

🔇 Suppressing False Positives

Create a .dpdpignore file in your project root:

# Ignore AWS-managed CloudFormation buckets
DPDP-ENC-001:cf-templates-*
DPDP-ENC-002:cf-templates-*

# Ignore a specific check entirely
DPDP-RES-001

# Ignore all checks for a test resource
*:my-test-bucket

🏗️ Multi-Region Scanning

# Default: scans ALL enabled AWS regions
dpdp aws

# Scan only Mumbai
dpdp aws --region ap-south-1

# Filter by check family
dpdp aws --checks ENC          # Only encryption checks
dpdp aws --checks IAM          # Only IAM checks
dpdp aws --severity critical   # Only critical findings

🚀 CI/CD Integration

GitHub Actions

- name: DPDP Compliance Scan
  run: |
    pip install seesec-dpdp-scanner
    dpdp aws -o dpdp-report.sarif
    
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: dpdp-report.sarif

Exit codes: 0 = no violations, 1 = violations found.

🧪 Development

git clone https://github.com/seesec-infotech/dpdp-scanner
cd dpdp-scanner
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest tests/ -v

📜 License

Apache 2.0 — see LICENSE

---

Made with ❤️ in India by Seesec Infotech