#!/usr/bin/env python3
"""Privileged Account Access Review agent — audits privileged accounts for
compliance with least-privilege and periodic recertification requirements."""

import argparse
import csv
import json
from datetime import datetime, timedelta
from pathlib import Path


def load_accounts(csv_path: str) -> list[dict]:
    """Load privileged account inventory from CSV."""
    with open(csv_path, newline="", encoding="utf-8") as fh:
        reader = csv.DictReader(fh)
        return list(reader)


def check_stale_accounts(accounts: list[dict], max_days: int = 90) -> list[dict]:
    """Flag accounts not used within max_days."""
    findings = []
    cutoff = datetime.utcnow() - timedelta(days=max_days)
    for acct in accounts:
        last_used = acct.get("last_used", "")
        if not last_used:
            findings.append({"account": acct.get("username", ""), "issue": "no_last_used_date",
                             "severity": "high", "detail": "Account has no recorded last-used date"})
            continue
        try:
            used_dt = datetime.strptime(last_used, "%Y-%m-%d")
            if used_dt < cutoff:
                findings.append({"account": acct.get("username", ""),
                                 "issue": "stale_account", "severity": "high",
                                 "detail": f"Last used {last_used}, exceeds {max_days}-day threshold"})
        except ValueError:
            findings.append({"account": acct.get("username", ""), "issue": "invalid_date",
                             "severity": "medium", "detail": f"Cannot parse last_used: {last_used}"})
    return findings


def check_shared_accounts(accounts: list[dict]) -> list[dict]:
    """Detect shared/generic privileged accounts."""
    shared_patterns = ["admin", "root", "service", "svc_", "shared", "generic", "temp"]
    findings = []
    for acct in accounts:
        uname = acct.get("username", "").lower()
        owner = acct.get("owner", "").strip()
        for pat in shared_patterns:
            if pat in uname and not owner:
                findings.append({"account": acct.get("username", ""),
                                 "issue": "shared_account_no_owner", "severity": "critical",
                                 "detail": f"Appears shared (matches '{pat}') with no assigned owner"})
                break
    return findings


def check_excessive_privileges(accounts: list[dict]) -> list[dict]:
    """Flag accounts with overly broad privilege sets."""
    high_risk_roles = {"domain admin", "enterprise admin", "schema admin",
                       "global admin", "super admin", "root"}
    findings = []
    for acct in accounts:
        roles = {r.strip().lower() for r in acct.get("roles", "").split(";")}
        overlap = roles & high_risk_roles
        if overlap:
            findings.append({"account": acct.get("username", ""),
                             "issue": "excessive_privilege", "severity": "critical",
                             "detail": f"Holds high-risk roles: {', '.join(sorted(overlap))}"})
    return findings


def check_recertification(accounts: list[dict], cert_interval_days: int = 180) -> list[dict]:
    """Flag accounts overdue for recertification."""
    cutoff = datetime.utcnow() - timedelta(days=cert_interval_days)
    findings = []
    for acct in accounts:
        cert_date = acct.get("last_certified", "")
        if not cert_date:
            findings.append({"account": acct.get("username", ""),
                             "issue": "never_certified", "severity": "critical",
                             "detail": "Account has never been certified"})
            continue
        try:
            cert_dt = datetime.strptime(cert_date, "%Y-%m-%d")
            if cert_dt < cutoff:
                findings.append({"account": acct.get("username", ""),
                                 "issue": "overdue_recertification", "severity": "high",
                                 "detail": f"Last certified {cert_date}, exceeds {cert_interval_days}-day cycle"})
        except ValueError:
            pass
    return findings


def generate_report(accounts: list[dict], stale_days: int, cert_days: int) -> dict:
    """Run all checks and produce a consolidated JSON report."""
    findings = []
    findings.extend(check_stale_accounts(accounts, stale_days))
    findings.extend(check_shared_accounts(accounts))
    findings.extend(check_excessive_privileges(accounts))
    findings.extend(check_recertification(accounts, cert_days))

    severity_counts = {}
    for f in findings:
        severity_counts[f["severity"]] = severity_counts.get(f["severity"], 0) + 1

    return {
        "report": "privileged_account_access_review",
        "generated_at": datetime.utcnow().isoformat() + "Z",
        "total_accounts": len(accounts),
        "total_findings": len(findings),
        "severity_summary": severity_counts,
        "findings": findings,
    }


def main():
    parser = argparse.ArgumentParser(description="Privileged Account Access Review Agent")
    parser.add_argument("--input", required=True, help="CSV file with privileged account inventory")
    parser.add_argument("--stale-days", type=int, default=90, help="Max days of inactivity (default: 90)")
    parser.add_argument("--cert-days", type=int, default=180, help="Recertification interval in days (default: 180)")
    parser.add_argument("--output", help="Output JSON file path")
    args = parser.parse_args()

    accounts = load_accounts(args.input)
    report = generate_report(accounts, args.stale_days, args.cert_days)

    output = json.dumps(report, indent=2)
    if args.output:
        Path(args.output).write_text(output, encoding="utf-8")
        print(f"Report written to {args.output}")
    else:
        print(output)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Privileged Account Access Review Automation

Discovers privileged accounts from Active Directory, AWS IAM, and Azure AD,
generates review campaigns, and tracks certification decisions.

Requirements:
    pip install ldap3 boto3 msal requests pandas openpyxl
"""

import json
import csv
import sys
from datetime import datetime, timedelta, timezone
from pathlib import Path

try:
    import ldap3
    HAS_LDAP = True
except ImportError:
    HAS_LDAP = False

try:
    import boto3
    HAS_BOTO = True
except ImportError:
    HAS_BOTO = False


class PrivilegedAccountDiscovery:
    """Discovers privileged accounts across multiple platforms."""

    def __init__(self):
        self.accounts = []

    def discover_ad_privileged_accounts(self, server_address, domain_dn,
                                         bind_user, bind_password):
        """Enumerate privileged accounts from Active Directory."""
        if not HAS_LDAP:
            print("[WARN] ldap3 not installed, skipping AD discovery")
            return []

        server = ldap3.Server(server_address, use_ssl=True, get_info=ldap3.ALL)
        conn = ldap3.Connection(server, user=bind_user, password=bind_password,
                                auto_bind=True)

        privileged_groups = [
            "Domain Admins",
            "Enterprise Admins",
            "Schema Admins",
            "Administrators",
            "Account Operators",
            "Backup Operators",
            "Server Operators",
            "Print Operators",
        ]

        discovered = []

        for group_name in privileged_groups:
            search_filter = f"(&(objectClass=group)(cn={group_name}))"
            conn.search(domain_dn, search_filter,
                        attributes=["member", "distinguishedName"])

            for entry in conn.entries:
                members = entry.member.values if hasattr(entry.member, "values") else []
                for member_dn in members:
                    conn.search(member_dn, "(objectClass=user)",
                                attributes=["sAMAccountName", "displayName",
                                             "mail", "lastLogonTimestamp",
                                             "whenCreated", "userAccountControl",
                                             "adminCount", "servicePrincipalName"])
                    for user_entry in conn.entries:
                        uac = int(str(user_entry.userAccountControl)) if user_entry.userAccountControl else 0
                        is_disabled = bool(uac & 0x0002)
                        is_service = bool(user_entry.servicePrincipalName)

                        account = {
                            "platform": "Active Directory",
                            "username": str(user_entry.sAMAccountName),
                            "display_name": str(user_entry.displayName) if user_entry.displayName else "",
                            "email": str(user_entry.mail) if user_entry.mail else "",
                            "privileged_group": group_name,
                            "account_type": "service" if is_service else "user",
                            "is_disabled": is_disabled,
                            "created_date": str(user_entry.whenCreated) if user_entry.whenCreated else "",
                            "last_logon": str(user_entry.lastLogonTimestamp) if user_entry.lastLogonTimestamp else "Never",
                            "admin_count": str(user_entry.adminCount) if user_entry.adminCount else "0",
                            "risk_level": "Critical" if group_name in ["Domain Admins", "Enterprise Admins"] else "High",
                        }
                        discovered.append(account)

        conn.unbind()
        self.accounts.extend(discovered)
        return discovered

    def discover_aws_privileged_accounts(self, profile_name=None):
        """Enumerate privileged IAM users and roles in AWS."""
        if not HAS_BOTO:
            print("[WARN] boto3 not installed, skipping AWS discovery")
            return []

        session = boto3.Session(profile_name=profile_name)
        iam = session.client("iam")
        discovered = []

        admin_policies = [
            "arn:aws:iam::aws:policy/AdministratorAccess",
            "arn:aws:iam::aws:policy/IAMFullAccess",
            "arn:aws:iam::aws:policy/PowerUserAccess",
        ]

        paginator = iam.get_paginator("list_users")
        for page in paginator.paginate():
            for user in page["Users"]:
                username = user["UserName"]
                create_date = user["CreateDate"]

                attached_policies = iam.list_attached_user_policies(UserName=username)
                user_policies = [p["PolicyArn"] for p in attached_policies["AttachedPolicies"]]

                is_admin = any(p in admin_policies for p in user_policies)

                user_groups = iam.list_groups_for_user(UserName=username)
                for group in user_groups["Groups"]:
                    group_policies = iam.list_attached_group_policies(GroupName=group["GroupName"])
                    for gp in group_policies["AttachedPolicies"]:
                        if gp["PolicyArn"] in admin_policies:
                            is_admin = True

                if is_admin:
                    try:
                        last_used = iam.get_user(UserName=username)
                        password_last_used = user.get("PasswordLastUsed", "Never")
                    except Exception:
                        password_last_used = "Unknown"

                    mfa_devices = iam.list_mfa_devices(UserName=username)
                    has_mfa = len(mfa_devices["MFADevices"]) > 0

                    access_keys = iam.list_access_keys(UserName=username)
                    active_keys = [k for k in access_keys["AccessKeyMetadata"]
                                   if k["Status"] == "Active"]

                    account = {
                        "platform": "AWS IAM",
                        "username": username,
                        "display_name": username,
                        "email": "",
                        "privileged_group": ", ".join(user_policies),
                        "account_type": "user",
                        "is_disabled": False,
                        "created_date": create_date.isoformat(),
                        "last_logon": str(password_last_used),
                        "admin_count": str(len(active_keys)),
                        "risk_level": "Critical",
                        "mfa_enabled": has_mfa,
                        "active_access_keys": len(active_keys),
                    }
                    discovered.append(account)

        self.accounts.extend(discovered)
        return discovered

    def generate_review_report(self, output_path):
        """Generate CSV report of all discovered privileged accounts for review."""
        if not self.accounts:
            print("[INFO] No accounts discovered. Run discovery methods first.")
            return

        fieldnames = [
            "platform", "username", "display_name", "email",
            "privileged_group", "account_type", "is_disabled",
            "created_date", "last_logon", "risk_level",
            "reviewer", "decision", "justification", "review_date"
        ]

        with open(output_path, "w", newline="", encoding="utf-8") as f:
            writer = csv.DictWriter(f, fieldnames=fieldnames, extrasaction="ignore")
            writer.writeheader()
            for account in self.accounts:
                account.setdefault("reviewer", "")
                account.setdefault("decision", "")
                account.setdefault("justification", "")
                account.setdefault("review_date", "")
                writer.writerow(account)

        print(f"[OK] Review report generated: {output_path}")
        print(f"[OK] Total privileged accounts: {len(self.accounts)}")

        critical = sum(1 for a in self.accounts if a["risk_level"] == "Critical")
        high = sum(1 for a in self.accounts if a["risk_level"] == "High")
        disabled = sum(1 for a in self.accounts if a.get("is_disabled"))

        print(f"     Critical: {critical} | High: {high} | Disabled: {disabled}")


class AccessReviewTracker:
    """Tracks review campaign progress and generates compliance reports."""

    def __init__(self, review_file):
        self.review_file = Path(review_file)
        self.accounts = []
        if self.review_file.exists():
            self._load_reviews()

    def _load_reviews(self):
        with open(self.review_file, "r", encoding="utf-8") as f:
            reader = csv.DictReader(f)
            self.accounts = list(reader)

    def get_review_status(self):
        """Calculate review campaign metrics."""
        total = len(self.accounts)
        reviewed = sum(1 for a in self.accounts if a.get("decision"))
        approved = sum(1 for a in self.accounts if a.get("decision") == "Approve")
        revoked = sum(1 for a in self.accounts if a.get("decision") == "Revoke")
        flagged = sum(1 for a in self.accounts if a.get("decision") == "Flag")
        pending = total - reviewed

        return {
            "total_accounts": total,
            "reviewed": reviewed,
            "pending": pending,
            "approved": approved,
            "revoked": revoked,
            "flagged": flagged,
            "completion_rate": f"{(reviewed/total*100):.1f}%" if total else "0%",
        }

    def identify_dormant_accounts(self, days_threshold=90):
        """Find accounts not used within the threshold period."""
        cutoff = datetime.now(timezone.utc) - timedelta(days=days_threshold)
        dormant = []

        for account in self.accounts:
            last_logon = account.get("last_logon", "")
            if last_logon in ("Never", "", "Unknown"):
                dormant.append(account)
                continue
            try:
                logon_date = datetime.fromisoformat(last_logon.replace("Z", "+00:00"))
                if logon_date < cutoff:
                    dormant.append(account)
            except (ValueError, TypeError):
                continue

        return dormant

    def generate_compliance_report(self, output_path):
        """Generate compliance-ready review summary."""
        status = self.get_review_status()
        dormant = self.identify_dormant_accounts()

        report = {
            "report_title": "Privileged Account Access Review - Compliance Report",
            "generated_date": datetime.now(timezone.utc).isoformat(),
            "review_period": "Quarterly",
            "metrics": status,
            "dormant_accounts": len(dormant),
            "dormant_account_list": [
                {"username": a["username"], "platform": a["platform"],
                 "last_logon": a.get("last_logon", "Unknown")}
                for a in dormant
            ],
            "findings": [],
        }

        if status["pending"] > 0:
            report["findings"].append({
                "finding": f"{status['pending']} accounts have not been reviewed",
                "severity": "High",
                "recommendation": "Complete reviews within SLA or auto-revoke"
            })

        if dormant:
            report["findings"].append({
                "finding": f"{len(dormant)} dormant privileged accounts detected",
                "severity": "Critical",
                "recommendation": "Disable dormant accounts and rotate credentials"
            })

        with open(output_path, "w", encoding="utf-8") as f:
            json.dump(report, f, indent=2)

        print(f"[OK] Compliance report generated: {output_path}")
        return report


if __name__ == "__main__":
    discovery = PrivilegedAccountDiscovery()

    print("=" * 60)
    print("Privileged Account Access Review Tool")
    print("=" * 60)
    print()
    print("Usage:")
    print("  1. Run discovery against your environment")
    print("  2. Generate review CSV for reviewer certification")
    print("  3. Track review progress and generate compliance report")
    print()
    print("Example:")
    print("  discovery = PrivilegedAccountDiscovery()")
    print("  discovery.discover_ad_privileged_accounts(server, dn, user, pw)")
    print("  discovery.discover_aws_privileged_accounts(profile='prod')")
    print("  discovery.generate_review_report('review_campaign.csv')")
    print()
    print("  tracker = AccessReviewTracker('review_campaign.csv')")
    print("  print(tracker.get_review_status())")
    print("  tracker.generate_compliance_report('compliance_report.json')")