配好了安全服务不等于安全，得有人看告警并处置

"""GuardDuty 检测到凭证异常使用时的自动响应。

处置顺序很重要：
    1. 先给凭证附加拒绝一切的策略（立即止血，比删除快且可回溯）
    2. 快照当前会话信息用于取证
    3. 通知安全团队与凭证所属人
    4. 不自动删除任何东西——取证需要现场
"""

from __future__ import annotations

import json
import os
from datetime import datetime, timezone

import boto3

iam = boto3.client("iam")
sts = boto3.client("sts")
sns = boto3.client("sns")
ddb = boto3.resource("dynamodb")

QUARANTINE_POLICY_ARN = os.environ["QUARANTINE_POLICY_ARN"]
ALERT_TOPIC_ARN = os.environ["ALERT_TOPIC_ARN"]
FORENSICS_TABLE = os.environ["FORENSICS_TABLE"]

HIGH_SEVERITY = 7.0


def quarantine_user(user_name: str) -> dict:
    """附加拒绝策略并禁用所有 Access Key。"""
    actions = []

    iam.attach_user_policy(UserName=user_name, PolicyArn=QUARANTINE_POLICY_ARN)
    actions.append("attached-quarantine-policy")

    keys = iam.list_access_keys(UserName=user_name)["AccessKeyMetadata"]
    for key in keys:
        if key["Status"] == "Active":
            iam.update_access_key(
                UserName=user_name,
                AccessKeyId=key["AccessKeyId"],
                Status="Inactive",
            )
            actions.append(f"deactivated-key-{key['AccessKeyId'][-4:]}")

    return {"user": user_name, "actions": actions}


def quarantine_role(role_name: str) -> dict:
    """角色无法禁用，改为收紧信任策略并附加拒绝策略。"""
    iam.attach_role_policy(RoleName=role_name, PolicyArn=QUARANTINE_POLICY_ARN)
    return {"role": role_name, "actions": ["attached-quarantine-policy"]}


def record_forensics(finding: dict, response: dict) -> None:
    ddb.Table(FORENSICS_TABLE).put_item(Item={
        "finding_id": finding["id"],
        "detected_at": finding.get("updatedAt","),
        "responded_at": datetime.now(timezone.utc).isoformat(),
        "severity": str(finding.get("severity",")),
        "type": finding.get("type","),
        "account": finding.get("accountId","),
        "region": finding.get("region","),
        "raw_finding": json.dumps(finding, default=str)[:380000],
        "response": json.dumps(response),
    })


def lambda_handler(event, context):  # noqa: ARG001
    finding = event["detail"]
    severity = float(finding.get("severity", 0))
    ftype = finding.get("type",")

    if severity < HIGH_SEVERITY or "Credential" not in ftype:
        return {"action": "logged-only", "severity": severity}

    resource = finding.get("resource", {})
    access_key_detail = resource.get("accessKeyDetails", {})
    principal_type = access_key_detail.get("userType",")
    principal_name = access_key_detail.get("userName",")

    response: dict = {"principal": principal_name, "type": principal_type}
    try:
        if principal_type == "IAMUser":
            response.update(quarantine_user(principal_name))
        elif principal_type == "AssumedRole":
            role = principal_name.split("/")[0] if "/" in principal_name else principal_name
            response.update(quarantine_role(role))
        else:
            response["actions"] = ["manual-review-required"]
    except iam.exceptions.NoSuchEntityException:
        response["actions"] = ["principal-not-found"]

    record_forensics(finding, response)

    sns.publish(
        TopicArn=ALERT_TOPIC_ARN,
        Subject=f"[P1] 凭证异常已自动隔离：{principal_name}",
        Message=json.dumps({
            "finding_type": ftype,
            "severity": severity,
            "account": finding.get("accountId"),
            "region": finding.get("region"),
            "principal": principal_name,
            "actions_taken": response.get("actions", []),
            "next_steps": [
                "确认该凭证的合法用途与最近使用记录",
                "检查该凭证在事发期间的全部 API 调用",
                "确认无横向移动后，轮换凭证并解除隔离",
            ],
        }, ensure_ascii=False, indent=2),
    )

    return response