A compliance platform with no ceiling

from calethia import ResourceTypes, Result, Severity, policy
from calethia.aws import sns
from calethia.frameworks import SOC2

@policy(
    id="aws.sns.topic_encryption",
    name="SNS Topics Must Have Encryption Enabled",
    severity=Severity.MEDIUM,
    resource_types=[ResourceTypes.AWS.SNS_TOPIC],
    frameworks=[SOC2("CC6.1"), SOC2("CC6.7")],
)
def check_topic_encryption(ctx: sns.Context) -> Result:
    """Ensure SNS topics are encrypted at rest with KMS."""
    for topic in ctx.list_topics():
        if topic.encryption_enabled and topic.kms_master_key_id:
            ctx.pass_(topic.to_resource(), "Encrypted with KMS")
        else:
            ctx.fail(topic.to_resource(), "No encryption enabled")
    return ctx.result()

from calethia import ResourceTypes, Result, Severity, policy
from calethia.ccf import CCF
from calethia.github import organization

@policy(
    id="github.org.admin_mfa_required",
    name="Organization Admins Have MFA Enabled",
    severity=Severity.CRITICAL,
    resource_types=[ResourceTypes.GitHub.ORGS_MEMBER],
    frameworks=[CCF("access-mfa")],
)
def check_admin_mfa(ctx: organization.Context) -> Result:
    """Verify every org admin has 2FA enabled."""
    for member in ctx.list_members():
        if not member.is_admin:
            continue
        if member.two_factor_enabled:
            ctx.pass_(member.to_resource(), "MFA enabled")
        else:
            ctx.fail(member.to_resource(), "No MFA")
    return ctx.result()