#!/usr/bin/env python3
"""AWS Verified Access ZTNA configuration agent using boto3."""

import json
import sys
import argparse
from datetime import datetime

try:
    import boto3
except ImportError:
    print("Install: pip install boto3")
    sys.exit(1)


def list_verified_access_instances(session):
    """List all Verified Access instances."""
    ec2 = session.client("ec2")
    response = ec2.describe_verified_access_instances()
    instances = []
    for inst in response.get("VerifiedAccessInstances", []):
        instances.append({
            "id": inst["VerifiedAccessInstanceId"],
            "description": inst.get("Description", ""),
            "creation_time": str(inst.get("CreationTime", "")),
            "trust_providers": [tp["VerifiedAccessTrustProviderId"]
                                for tp in inst.get("VerifiedAccessTrustProviders", [])],
        })
    return instances


def list_verified_access_groups(session):
    """List Verified Access groups and their policies."""
    ec2 = session.client("ec2")
    response = ec2.describe_verified_access_groups()
    groups = []
    for grp in response.get("VerifiedAccessGroups", []):
        groups.append({
            "id": grp["VerifiedAccessGroupId"],
            "instance_id": grp.get("VerifiedAccessInstanceId", ""),
            "description": grp.get("Description", ""),
            "policy_enabled": grp.get("PolicyEnabled", False),
            "policy_document": grp.get("PolicyDocument", ""),
        })
    return groups


def list_verified_access_endpoints(session):
    """List Verified Access endpoints."""
    ec2 = session.client("ec2")
    response = ec2.describe_verified_access_endpoints()
    endpoints = []
    for ep in response.get("VerifiedAccessEndpoints", []):
        endpoints.append({
            "id": ep["VerifiedAccessEndpointId"],
            "group_id": ep.get("VerifiedAccessGroupId", ""),
            "type": ep.get("EndpointType", ""),
            "domain": ep.get("DomainCertificateArn", ""),
            "status": ep.get("Status", {}).get("Code", ""),
            "application_domain": ep.get("ApplicationDomain", ""),
        })
    return endpoints


def audit_trust_providers(session):
    """Audit Verified Access trust providers."""
    ec2 = session.client("ec2")
    response = ec2.describe_verified_access_trust_providers()
    providers = []
    for tp in response.get("VerifiedAccessTrustProviders", []):
        providers.append({
            "id": tp["VerifiedAccessTrustProviderId"],
            "type": tp.get("TrustProviderType", ""),
            "user_trust_type": tp.get("UserTrustProviderType", ""),
            "device_trust_type": tp.get("DeviceTrustProviderType", ""),
            "policy_reference": tp.get("PolicyReferenceName", ""),
        })
    return providers


def run_audit(profile=None, region="us-east-1"):
    """Execute AWS Verified Access audit."""
    session = boto3.Session(profile_name=profile, region_name=region)
    print(f"\n{'='*60}")
    print(f"  AWS VERIFIED ACCESS ZTNA AUDIT")
    print(f"  Region: {region}")
    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
    print(f"{'='*60}\n")

    instances = list_verified_access_instances(session)
    print(f"--- INSTANCES ({len(instances)}) ---")
    for i in instances:
        print(f"  {i['id']}: {i['description']} (providers: {len(i['trust_providers'])})")

    providers = audit_trust_providers(session)
    print(f"\n--- TRUST PROVIDERS ({len(providers)}) ---")
    for p in providers:
        print(f"  {p['id']}: type={p['type']} user={p['user_trust_type']} device={p['device_trust_type']}")

    groups = list_verified_access_groups(session)
    print(f"\n--- GROUPS ({len(groups)}) ---")
    for g in groups:
        status = "ENABLED" if g["policy_enabled"] else "DISABLED"
        print(f"  {g['id']}: policy={status}")

    endpoints = list_verified_access_endpoints(session)
    print(f"\n--- ENDPOINTS ({len(endpoints)}) ---")
    for e in endpoints:
        print(f"  {e['id']}: {e['application_domain']} ({e['status']})")

    return {"instances": instances, "providers": providers, "groups": groups, "endpoints": endpoints}


def main():
    parser = argparse.ArgumentParser(description="AWS Verified Access ZTNA Agent")
    parser.add_argument("--profile", help="AWS CLI profile")
    parser.add_argument("--region", default="us-east-1", help="AWS region")
    parser.add_argument("--audit", action="store_true", help="Run full audit")
    parser.add_argument("--output", help="Save report to JSON file")
    args = parser.parse_args()

    if args.audit:
        report = run_audit(args.profile, args.region)
        if args.output:
            with open(args.output, "w") as f:
                json.dump(report, f, indent=2, default=str)
            print(f"\n[+] Report saved to {args.output}")
    else:
        parser.print_help()


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
AWS Verified Access ZTNA Configuration and Policy Management.

Generates Cedar access policies, validates configurations,
and monitors Verified Access deployments.
"""

import json
import datetime
from dataclasses import dataclass, field
from pathlib import Path


@dataclass
class TrustProvider:
    name: str
    provider_type: str  # "user" or "device"
    reference_name: str
    config: dict = field(default_factory=dict)


@dataclass
class AccessGroup:
    name: str
    description: str
    policy: str
    endpoints: list = field(default_factory=list)


@dataclass
class AccessEndpoint:
    name: str
    application_domain: str
    endpoint_type: str  # "load-balancer" or "network-interface"
    port: int = 443
    policy: str = ""
    alb_arn: str = ""


class CedarPolicyGenerator:
    """Generate Cedar access policies for AWS Verified Access."""

    def __init__(self, identity_ref: str = "okta", device_ref: str = "crowdstrike"):
        self.identity_ref = identity_ref
        self.device_ref = device_ref

    def permit_group_with_device_trust(self, group: str, min_score: int = 50) -> str:
        return f'''permit(principal, action, resource)
when {{
    context.{self.identity_ref}.groups.contains("{group}") &&
    context.{self.device_ref}.assessment.overall > {min_score}
}};'''

    def permit_group_read_only(self, group: str, min_score: int = 30) -> str:
        return f'''permit(principal, action, resource)
when {{
    context.{self.identity_ref}.groups.contains("{group}") &&
    context.{self.device_ref}.assessment.overall > {min_score} &&
    context.http_request.http_method == "GET"
}};'''

    def forbid_unmanaged_devices(self) -> str:
        return f'''forbid(principal, action, resource)
when {{
    !context.{self.device_ref}.assessment.sensor_config.status == "active"
}};'''

    def permit_admin_high_trust(self, admin_group: str, min_score: int = 90) -> str:
        return f'''permit(principal, action, resource)
when {{
    context.{self.identity_ref}.groups.contains("{admin_group}") &&
    context.{self.device_ref}.assessment.overall > {min_score} &&
    context.{self.identity_ref}.email.endsWith("@company.com")
}};'''

    def combine_policies(self, policies: list) -> str:
        return "\n\n".join(policies)


class VerifiedAccessConfigGenerator:
    """Generate Terraform configuration for AWS Verified Access."""

    def __init__(self):
        self.trust_providers: list[TrustProvider] = []
        self.groups: list[AccessGroup] = []
        self.endpoints: list[AccessEndpoint] = []

    def add_trust_provider(self, name: str, provider_type: str,
                           reference_name: str, config: dict = None):
        self.trust_providers.append(TrustProvider(
            name=name, provider_type=provider_type,
            reference_name=reference_name, config=config or {}
        ))

    def add_group(self, name: str, description: str, policy: str):
        self.groups.append(AccessGroup(name=name, description=description, policy=policy))

    def add_endpoint(self, group_name: str, name: str, domain: str,
                     port: int = 443, policy: str = "", alb_arn: str = ""):
        endpoint = AccessEndpoint(
            name=name, application_domain=domain,
            endpoint_type="load-balancer", port=port,
            policy=policy, alb_arn=alb_arn
        )
        for group in self.groups:
            if group.name == group_name:
                group.endpoints.append(endpoint)
        self.endpoints.append(endpoint)

    def generate_terraform(self) -> str:
        sections = [self._provider_block()]

        sections.append('\n# Verified Access Instance')
        sections.append('''resource "aws_verifiedaccess_instance" "main" {
  description = "Production Zero Trust Access"
  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}''')

        for tp in self.trust_providers:
            sections.append(self._trust_provider_block(tp))

        for group in self.groups:
            sections.append(self._group_block(group))

        for endpoint in self.endpoints:
            sections.append(self._endpoint_block(endpoint))

        return "\n\n".join(sections)

    def _provider_block(self) -> str:
        return '''terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}'''

    def _trust_provider_block(self, tp: TrustProvider) -> str:
        resource_name = tp.name.replace("-", "_")
        return f'''resource "aws_verifiedaccess_trust_provider" "{resource_name}" {{
  policy_reference_name = "{tp.reference_name}"
  trust_provider_type   = "{tp.provider_type}"
  description           = "{tp.name} trust provider"
}}

resource "aws_verifiedaccess_instance_trust_provider_attachment" "{resource_name}" {{
  verifiedaccess_instance_id       = aws_verifiedaccess_instance.main.id
  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.{resource_name}.id
}}'''

    def _group_block(self, group: AccessGroup) -> str:
        resource_name = group.name.replace("-", "_")
        return f'''resource "aws_verifiedaccess_group" "{resource_name}" {{
  verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id
  description                = "{group.description}"

  policy_document = <<-CEDAR
    {group.policy}
  CEDAR
}}'''

    def _endpoint_block(self, endpoint: AccessEndpoint) -> str:
        resource_name = endpoint.name.replace("-", "_").replace(".", "_")
        policy_block = ""
        if endpoint.policy:
            policy_block = f'''

  policy_document = <<-CEDAR
    {endpoint.policy}
  CEDAR'''

        return f'''resource "aws_verifiedaccess_endpoint" "{resource_name}" {{
  verified_access_group_id = aws_verifiedaccess_group.web_apps.id
  endpoint_type            = "load-balancer"
  attachment_type          = "vpc"
  application_domain       = "{endpoint.application_domain}"
  description              = "{endpoint.name}"{policy_block}
}}'''

    def export_terraform(self, output_path: str):
        config = self.generate_terraform()
        path = Path(output_path)
        path.parent.mkdir(parents=True, exist_ok=True)
        with open(path, "w") as f:
            f.write(config)
        return config


def main():
    """Generate example AWS Verified Access configuration."""
    # Generate Cedar policies
    cedar = CedarPolicyGenerator(identity_ref="okta", device_ref="crowdstrike")

    group_policy = cedar.combine_policies([
        cedar.permit_group_with_device_trust("production-access", 50),
        cedar.forbid_unmanaged_devices(),
    ])

    admin_policy = cedar.permit_admin_high_trust("platform-admins", 90)
    readonly_policy = cedar.permit_group_read_only("read-only-users", 30)

    print("Generated Cedar Policies:")
    print("=" * 60)
    print("\nGroup Policy (production access):")
    print(group_policy)
    print(f"\nAdmin Policy:")
    print(admin_policy)
    print(f"\nRead-Only Policy:")
    print(readonly_policy)

    # Generate Terraform config
    gen = VerifiedAccessConfigGenerator()
    gen.add_trust_provider("okta-identity", "user", "okta")
    gen.add_trust_provider("crowdstrike-device", "device", "crowdstrike")
    gen.add_group("web-apps", "Production Web Applications", group_policy)
    gen.add_endpoint("web-apps", "internal-app", "app.internal.company.com", 443)
    gen.add_endpoint("web-apps", "admin-portal", "admin.internal.company.com", 443,
                     policy=admin_policy)

    config = gen.export_terraform("verified_access.tf")
    print("\n" + "=" * 60)
    print("Generated Terraform Configuration:")
    print("=" * 60)
    print(config[:3000])


if __name__ == "__main__":
    main()