#!/usr/bin/env python3
"""AWS Macie data classification agent using boto3 for S3 sensitive data discovery."""

import argparse
import json
import logging
import os
import sys
from datetime import datetime
from typing import List

try:
    import boto3
    from botocore.exceptions import ClientError
except ImportError:
    sys.exit("boto3 required: pip install boto3")

logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
logger = logging.getLogger(__name__)


def get_macie_client(profile: str = "", region: str = "us-east-1"):
    """Create Macie2 client."""
    session = boto3.Session(profile_name=profile) if profile else boto3.Session()
    return session.client("macie2", region_name=region)


def enable_macie(client) -> dict:
    """Enable Macie in the account if not already enabled."""
    try:
        client.get_macie_session()
        return {"status": "already_enabled"}
    except ClientError:
        try:
            client.enable_macie(status="ENABLED")
            return {"status": "enabled"}
        except ClientError as exc:
            return {"error": str(exc)}


def list_s3_buckets_summary(client) -> List[dict]:
    """Get Macie's summary of S3 bucket inventory."""
    try:
        resp = client.describe_buckets(criteria={}, maxResults=50)
        buckets = []
        for b in resp.get("buckets", []):
            buckets.append({
                "name": b.get("bucketName", ""),
                "region": b.get("region", ""),
                "classifiable_objects": b.get("classifiableObjectCount", 0),
                "classifiable_size": b.get("classifiableSizeInBytes", 0),
                "encryption": b.get("serverSideEncryption", {}).get("type", "NONE"),
                "public_access": b.get("publicAccess", {}).get("effectivePermission", "NOT_PUBLIC"),
                "shared_access": b.get("sharedAccess", "NOT_SHARED"),
            })
        return buckets
    except ClientError as exc:
        logger.error("describe_buckets failed: %s", exc)
        return []


def create_classification_job(client, bucket_names: List[str], job_name: str) -> dict:
    """Create a one-time sensitive data discovery job for specified buckets."""
    try:
        resp = client.create_classification_job(
            jobType="ONE_TIME",
            name=job_name,
            s3JobDefinition={
                "bucketDefinitions": [{
                    "accountId": boto3.client("sts").get_caller_identity()["Account"],
                    "buckets": bucket_names,
                }]
            },
            description=f"Scan {len(bucket_names)} buckets for sensitive data",
        )
        return {"job_id": resp["jobId"], "job_arn": resp["jobArn"]}
    except ClientError as exc:
        return {"error": str(exc)}


def get_finding_statistics(client) -> dict:
    """Get statistics on Macie findings by severity and type."""
    try:
        by_severity = client.get_finding_statistics(
            groupBy="severity.description",
        )
        by_type = client.get_finding_statistics(
            groupBy="type",
        )
        return {
            "by_severity": by_severity.get("countsBySeverity", []),
            "by_type": by_type.get("countsByGroup", []),
        }
    except ClientError as exc:
        return {"error": str(exc)}


def list_findings(client, severity: str = "High", max_results: int = 50) -> List[dict]:
    """List recent Macie findings filtered by severity."""
    try:
        resp = client.list_findings(
            findingCriteria={
                "criterion": {
                    "severity.description": {"eq": [severity]}
                }
            },
            maxResults=max_results,
        )
        finding_ids = resp.get("findingIds", [])
        if not finding_ids:
            return []
        details = client.get_findings(findingIds=finding_ids[:20])
        return [{
            "id": f.get("id", ""),
            "type": f.get("type", ""),
            "severity": f.get("severity", {}).get("description", ""),
            "title": f.get("title", ""),
            "bucket": f.get("resourcesAffected", {}).get("s3Bucket", {}).get("name", ""),
            "count": f.get("count", 0),
            "created": f.get("createdAt", ""),
        } for f in details.get("findings", [])]
    except ClientError as exc:
        return [{"error": str(exc)}]


def generate_report(client) -> dict:
    """Generate Macie data classification report."""
    report = {"analysis_date": datetime.utcnow().isoformat()}
    report["macie_status"] = enable_macie(client)
    report["bucket_inventory"] = list_s3_buckets_summary(client)
    report["finding_statistics"] = get_finding_statistics(client)
    report["high_findings"] = list_findings(client, "High")
    report["critical_findings"] = list_findings(client, "Critical")
    public_buckets = [b for b in report["bucket_inventory"]
                      if b.get("public_access") != "NOT_PUBLIC"]
    report["public_buckets"] = public_buckets
    report["summary"] = {
        "total_buckets": len(report["bucket_inventory"]),
        "public_buckets": len(public_buckets),
        "high_findings": len(report["high_findings"]),
        "critical_findings": len(report["critical_findings"]),
    }
    return report


def main():
    parser = argparse.ArgumentParser(description="AWS Macie Data Classification Agent")
    parser.add_argument("--profile", default="", help="AWS CLI profile")
    parser.add_argument("--region", default="us-east-1")
    parser.add_argument("--output-dir", default=".")
    parser.add_argument("--output", default="macie_report.json")
    args = parser.parse_args()

    os.makedirs(args.output_dir, exist_ok=True)
    client = get_macie_client(args.profile, args.region)
    report = generate_report(client)
    out_path = os.path.join(args.output_dir, args.output)
    with open(out_path, "w") as f:
        json.dump(report, f, indent=2, default=str)
    logger.info("Report saved to %s", out_path)
    print(json.dumps(report["summary"], indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
AWS Macie Data Classification Management Script

Automates Macie configuration, job creation, and findings analysis.
"""

import boto3
import json
import sys
from datetime import datetime


def enable_macie(session):
    """Enable Macie in the current account."""
    client = session.client('macie2')
    try:
        client.enable_macie(status='ENABLED')
        print("[+] Macie enabled successfully")
    except client.exceptions.ConflictException:
        print("[*] Macie is already enabled")

    # Enable automated discovery
    try:
        client.update_automated_discovery_configuration(status='ENABLED')
        print("[+] Automated discovery enabled")
    except Exception as e:
        print(f"[!] Could not enable automated discovery: {e}")


def create_classification_job(session, bucket_names, account_id, job_name=None):
    """Create a one-time classification job for specified buckets."""
    client = session.client('macie2')

    if not job_name:
        job_name = f"scan-{datetime.now().strftime('%Y%m%d-%H%M%S')}"

    response = client.create_classification_job(
        jobType='ONE_TIME',
        name=job_name,
        s3JobDefinition={
            'bucketDefinitions': [{
                'accountId': account_id,
                'buckets': bucket_names
            }]
        },
        managedDataIdentifierSelector='ALL'
    )

    job_id = response['jobId']
    print(f"[+] Classification job created: {job_id}")
    return job_id


def list_findings(session, severity=None, max_results=25):
    """List Macie findings with optional severity filter."""
    client = session.client('macie2')

    criteria = {}
    if severity:
        criteria['severity.description'] = {'eq': [severity]}

    response = client.list_findings(
        findingCriteria={'criterion': criteria} if criteria else {},
        sortCriteria={'attributeName': 'updatedAt', 'orderBy': 'DESC'},
        maxResults=max_results
    )

    finding_ids = response.get('findingIds', [])
    print(f"[+] Found {len(finding_ids)} findings")

    if finding_ids:
        details = client.get_findings(findingIds=finding_ids[:20])
        for finding in details.get('findings', []):
            severity_desc = finding['severity']['description']
            category = finding.get('category', 'N/A')
            title = finding.get('title', 'N/A')
            bucket = finding.get('resourcesAffected', {}).get('s3Bucket', {}).get('name', 'N/A')
            print(f"  [{severity_desc}] {title}")
            print(f"    Bucket: {bucket} | Category: {category}")

    return finding_ids


def get_bucket_statistics(session):
    """Get Macie statistics for all monitored S3 buckets."""
    client = session.client('macie2')

    response = client.describe_buckets(
        criteria={},
        maxResults=50
    )

    buckets = response.get('buckets', [])
    print(f"\n[+] Monitoring {len(buckets)} S3 buckets:")
    print(f"{'Bucket':<40} {'Encryption':<15} {'Public':<10} {'Shared':<10} {'Objects':<10}")
    print("-" * 85)

    for bucket in buckets:
        name = bucket.get('bucketName', 'N/A')
        encryption = bucket.get('serverSideEncryption', {}).get('type', 'NONE')
        public_access = bucket.get('publicAccess', {}).get('effectivePermission', 'NOT_PUBLIC')
        shared = bucket.get('sharedAccess', 'NOT_SHARED')
        obj_count = bucket.get('objectCount', 0)

        public_flag = "YES" if public_access == "PUBLIC" else "NO"
        shared_flag = "YES" if shared != "NOT_SHARED" else "NO"

        print(f"{name:<40} {encryption:<15} {public_flag:<10} {shared_flag:<10} {obj_count:<10}")

    return buckets


def get_usage_stats(session):
    """Get Macie usage statistics."""
    client = session.client('macie2')

    response = client.get_usage_totals()
    usage = response.get('usageTotals', [])

    print("\n[+] Macie Usage Statistics:")
    for item in usage:
        usage_type = item.get('type', 'N/A')
        amount = item.get('estimatedCost', 0)
        currency = item.get('currency', 'USD')
        print(f"  {usage_type}: ${amount:.2f} {currency}")


if __name__ == "__main__":
    import argparse

    parser = argparse.ArgumentParser(description="AWS Macie Management")
    parser.add_argument("--enable", action="store_true", help="Enable Macie")
    parser.add_argument("--scan", nargs="+", help="Create scan job for buckets")
    parser.add_argument("--account-id", type=str, help="AWS account ID for scan")
    parser.add_argument("--findings", action="store_true", help="List findings")
    parser.add_argument("--severity", type=str, choices=["Low", "Medium", "High"], help="Filter by severity")
    parser.add_argument("--buckets", action="store_true", help="Show bucket statistics")
    parser.add_argument("--usage", action="store_true", help="Show usage statistics")
    parser.add_argument("--region", type=str, default="us-east-1", help="AWS region")
    parser.add_argument("--profile", type=str, help="AWS profile name")

    args = parser.parse_args()

    session_kwargs = {"region_name": args.region}
    if args.profile:
        session_kwargs["profile_name"] = args.profile
    session = boto3.Session(**session_kwargs)

    if args.enable:
        enable_macie(session)
    if args.scan:
        if not args.account_id:
            sts = session.client('sts')
            args.account_id = sts.get_caller_identity()['Account']
        create_classification_job(session, args.scan, args.account_id)
    if args.findings:
        list_findings(session, severity=args.severity)
    if args.buckets:
        get_bucket_statistics(session)
    if args.usage:
        get_usage_stats(session)