Compliance automation that engineers love

from calethia import policy, Severity
from calethia.aws import iam
from calethia.frameworks import SOC2, CIS_AWS

@policy(
    id="aws.iam.mfa_required",
    name="IAM Users Have MFA",
    severity=Severity.HIGH,
    frameworks=[SOC2("CC6.1"), CIS_AWS("1.10")],
)
def check_mfa(ctx: iam.Context) -> iam.Result:
    """Ensure all IAM users with
    console access have MFA enabled."""
    for user in ctx.list_users():
        if user.has_console_access and not user.mfa_enabled:
            ctx.fail(user.to_resource(), "User has no MFA")
        else:
            ctx.pass_(user.to_resource(), "User has MFA")
    return ctx.result()

from calethia import policy, Severity
from calethia.endpoint import presence
from calethia.frameworks import InternalPolicy

@policy(
    id="company.rto.minimum_office_days",
    name="RTO Compliance - 3 Days In Office",
    severity=Severity.MEDIUM,
    frameworks=[InternalPolicy("HR-001")],
)
def check_rto_compliance(ctx: presence.Context) -> presence.Result:
    """Verify employees meet 3-day
    return-to-office requirement."""
    for employee in ctx.list_employees():
        office_days = ctx.get_office_days(
            employee, period="week", detect_by="ip_address"
        )
        if office_days >= 3:
            ctx.pass_(employee.to_resource(), f"{office_days} days")
        else:
            ctx.fail(employee.to_resource(), f"Only {office_days} days")
    return ctx.result()