Skyveda Scan

Read-only command-line scanner that checks a cloud environment against a catalogue of best-practice checks and produces a scored HTML report with prioritised findings, estimated monthly waste in ₹ (INR) and fix guidance.

• Read-only. Only read/list/get APIs. On Azure it works with the built-in Reader role (plus Cost Management Reader for cost checks).
• Local only. No telemetry; nothing leaves your machine except the output files you write.
• Checks are data. Each check is one YAML file.

Status: early development (v0.3: 60 Azure checks, billed cost). Azure first; AWS and GCP later.

Install

From PyPI (Python 3.12+):

pip install "skyveda[azure]"

Or:

• Azure Cloud Shell (recommended for customers): build the bundle with uv run python packaging/build_cloudshell_bundle.py, upload dist/skyveda-cloudshell-<version>.zip to Cloud Shell, then run unzip -o skyveda-cloudshell-*.zip && bash skyveda-cloudshell/install.sh. See packaging/cloudshell/README.txt.
• From the wheel: pip install "skyveda-<version>-py3-none-any.whl[azure]" (Python 3.12+).

On an Azure VM, the default credential uses the VM's managed identity before az login; pass --auth cli to scan as your az login account, and --tenant <id> to refuse any other tenant.

Usage

az login                                   # or service principal env vars / managed identity
skyveda scopes                              # which subscriptions can I read?
skyveda scan --provider azure --subscription <id> --out ./out
skyveda scan --offline tests/fixtures/azure # run on recorded data, no cloud access
skyveda list-checks                         # the check catalogue
skyveda validate-checks                     # check YAML files are valid

Options: --subscription (repeat or comma-separate), --management-group, --tenant, --label (a line under the report title), --waivers, --pdf (also write report.pdf).

Config file

Save options in a skyveda.toml and pass --config skyveda.toml to scan or scopes. Options typed on the command line override the file. Paths in the file are relative to the file. Never put credentials in it: sign-in uses az login, managed identity or environment variables as usual.

schema_version = 1

[scan]
subscriptions = ["<subscription-id>"]
tenant = "<tenant-id>"
auth = "cli"
out = "skyveda-out"
fail_on = "high"
label = "Prepared for cust-001"
waivers = "waivers.yaml"
pdf = true

Waivers

A waivers.yaml takes accepted risks and wrong findings out of the findings, the ₹ total and the scores. The report lists every waiver in Appendix D, so nothing disappears silently.

schema_version: 1
waivers:
  - check: AZ-NET-001
    resource: /subscriptions/<id>/resourceGroups/<rg>/providers/Microsoft.Network/networkSecurityGroups/<nsg>
    kind: accepted_risk        # or false_positive
    reason: Vendor access, limited by the upstream firewall
    approver: Head of Platform
    expires: 2027-03-31        # applies up to and including this date

Omit resource to waive every resource the check flags. Expired waivers, and waivers that match nothing, are not applied and are listed as warnings. To apply waivers to a findings.json someone sent you, use skyveda report findings.json --waivers waivers.yaml --out <new dir>; the original file is never changed.

Exit codes: 0 ran fine · 2 findings at or above --fail-on (default critical) · 1 error.

Development

Requires uv. Python 3.12 is installed automatically.

uv sync --all-extras
uv run ruff check && uv run ruff format --check
uv run mypy
uv run pytest            # sockets are disabled: tests can never reach the cloud

Contributing and security

See CONTRIBUTING.md; every commit needs a git commit -s sign-off. Report vulnerabilities by email, not in an issue: see SECURITY.md.

Licence

Apache-2.0. See LICENSE and NOTICE. The Skyveda™ name is not licensed with the code: see TRADEMARKS.md.

Microsoft and Azure are trademarks of the Microsoft group of companies. Skyveda is not affiliated with or endorsed by Microsoft.