IAM and permission management

import json
from dataclasses import dataclass, field
from typing import List, Dict

# ─── Data Classes ──────────────────────────────────────────
@dataclass
class IAMPolicy:
    name:      str
    effect:    str          # "Allow" أو "Deny"
    actions:   List[str]
    resources: List[str]

    def to_document(self) -> dict:
        return {
            "Version": "2012-10-17",
            "Statement": [{
                "Effect":   self.effect,
                "Action":   self.actions,
                "Resource": self.resources,
            }]
        }

@dataclass
class IAMUser:
    username: str
    groups:   List[str] = field(default_factory=list)
    policies: List[str] = field(default_factory=list)

    def attach_policy(self, name: str):
        self.policies.append(name)

@dataclass
class IAMRole:
    name:            str
    trusted_service: str
    policies:        List[str] = field(default_factory=list)

    def get_trust_policy(self) -> dict:
        return {
            "Version": "2012-10-17",
            "Statement": [{
                "Effect":    "Allow",
                "Principal": {"Service": self.trusted_service},
                "Action":    "sts:AssumeRole",
            }]
        }

# ─── IAM Manager ───────────────────────────────────────────
class IAMManager:
    def __init__(self):
        self.policies: Dict[str, IAMPolicy] = {}
        self.users:    Dict[str, IAMUser]   = {}
        self.roles:    Dict[str, IAMRole]   = {}

    def create_policy(self, name, effect, actions, resources) -> IAMPolicy:
        p = IAMPolicy(name, effect, actions, resources)
        self.policies[name] = p
        print(f"  📋 Policy: {name}")
        return p

    def create_user(self, username) -> IAMUser:
        u = IAMUser(username)
        self.users[username] = u
        print(f"  👤 User  : {username}")
        return u

    def create_role(self, name, trusted_service) -> IAMRole:
        r = IAMRole(name, trusted_service)
        self.roles[name] = r
        print(f"  🎭 Role  : {name} ← {trusted_service}")
        return r

    def audit_report(self):
        print(f"\n📊 تقرير IAM:")
        print(f"   Policies : {len(self.policies)}")
        print(f"   Users    : {len(self.users)}")
        print(f"   Roles    : {len(self.roles)}")
        print(f"\n👥 المستخدمون:")
        for name, u in self.users.items():
            print(f"   • {name}: {len(u.policies)} policies")
        print(f"\n🎭 الأدوار:")
        for name, r in self.roles.items():
            print(f"   • {name} ← {r.trusted_service}")

# ─── تهيئة IAM ─────────────────────────────────────────────
iam = IAMManager()
print("🔐 إنشاء موارد IAM:")

# Policies
iam.create_policy(
    "BedrockInvoke", "Allow",
    ["bedrock:InvokeModel", "bedrock:ListFoundationModels"],
    ["arn:aws:bedrock:*::foundation-model/*"],
)
iam.create_policy(
    "S3MLData", "Allow",
    ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
    ["arn:aws:s3:::ml-data-*", "arn:aws:s3:::ml-data-*/*"],
)
iam.create_policy(
    "CloudWatchLogs", "Allow",
    ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
    ["arn:aws:logs:*:*:*"],
)

# User للمطوّر
dev = iam.create_user("ai-developer")
dev.attach_policy("BedrockInvoke")
dev.attach_policy("S3MLData")

# Role للـ Lambda
lambda_role = iam.create_role("LambdaAIRole", "lambda.amazonaws.com")
lambda_role.policies = ["BedrockInvoke", "S3MLData", "CloudWatchLogs"]

# Trust Policy
print(f"\n🔐 Trust Policy لـ Lambda Role:")
print(json.dumps(lambda_role.get_trust_policy(), indent=2, ensure_ascii=False))

# تقرير
iam.audit_report()

# نصائح الأمان
print(f"\n📌 مبادئ IAM الأساسية:")
tips = [
    "استخدم Roles للـ Services — مفاتيح مؤقتة أكثر أماناً",
    "لا تستخدم Root Account للبرمجة أبداً",
    "فعّل MFA لجميع المستخدمين",
    "راجع الصلاحيات كل 90 يوماً",
    "استخدم IAM Access Analyzer للكشف عن الثغرات",
]
for t in tips:
    print(f"  ✅ {t}")