import boto3
import json
from typing import Dict, List

class LakeFormationGovernor:
    """Production Lake Formation governance manager."""

    def __init__(self, region: str = 'us-east-1'):
        self.lf = boto3.client('lakeformation', region_name=region)
        self.glue = boto3.client('glue', region_name=region)
        self.s3 = boto3.client('s3', region_name=region)

    def setup_classification_tags(self) -> Dict[str, str]:
        """Create data classification tags for governance."""
        tags = {
            'DataClassification': ['Public', 'Internal', 'Confidential', 'Restricted'],
            'DataDomain': ['Finance', 'HR', 'Marketing', 'Engineering'],
            'ComplianceScope': ['GDPR', 'HIPAA', 'PCI', 'SOC2'],
            'RetentionPeriod': ['30d', '90d', '1y', '7y', 'indefinite']
        }

        created_tags = {}
        for tag_key, tag_values in tags.items():
            try:
                self.lf.create_lf_tag(
                    TagKey=tag_key,
                    TagValues=tag_values
                )
                created_tags[tag_key] = tag_values
                print(f"Created tag: {tag_key}")
            except self.lf.exceptions.EntityNotFoundException:
                print(f"Tag {tag_key} already exists")
            except Exception as e:
                print(f"Error creating tag {tag_key}: {e}")
                raise

        return created_tags

    def register_data_location(self, bucket_arn: str, role_arn: str) -> bool:
        """Register an S3 location with Lake Formation."""
        try:
            self.lf.register_resource(
                ResourceArn=bucket_arn,
                RoleArn=role_arn,
                UseServiceLinkedRole=False
            )
            print(f"Registered location: {bucket_arn}")
            return True
        except Exception as e:
            print(f"Error registering location: {e}")
            return False

    def grant_column_access(
        self,
        principal_arn: str,
        database: str,
        table: str,
        columns: List[str],
        permissions: List[str] = None
    ) -> bool:
        """Grant column-level access to specific columns."""
        if permissions is None:
            permissions = ['SELECT']

        try:
            self.lf.grant_permissions(
                Principal={
                    'DataLakePrincipalIdentifier': principal_arn
                },
                Resource={
                    'TableWithColumnsResource': {
                        'DatabaseName': database,
                        'TableName': table,
                        'ColumnNames': columns
                    }
                },
                Permissions=permissions,
                GrantOption=False
            )
            print(f"Granted column access to {principal_arn}")
            return True
        except Exception as e:
            print(f"Error granting access: {e}")
            return False

    def grant_tag_based_access(
        self,
        principal_arn: str,
        database: str,
        table: str,
        tag_key: str,
        tag_values: List[str]
    ) -> bool:
        """Grant access based on resource tags."""
        try:
            self.lf.grant_permissions(
                Principal={
                    'DataLakePrincipalIdentifier': principal_arn
                },
                Resource={
                    'TableResource': {
                        'DatabaseName': database,
                        'TableName': table
                    }
                },
                Permissions=['SELECT', 'DESCRIBE'],
                Conditions=[
                    {
                        'StringEquals': {
                            'Expression': f"lf:tag/{tag_key}",
                            'Values': tag_values
                        }
                    }
                ]
            )
            print(f"Granted tag-based access to {principal_arn}")
            return True
        except Exception as e:
            print(f"Error granting tag-based access: {e}")
            return False

    def audit_permissions(self, database: str, table: str) -> List[Dict]:
        """Audit all permissions on a table."""
        try:
            response = self.lf.get_data_cells_filter(
                DatabaseName=database,
                TableName=table
            )
            return response.get('DataCellsFilters', [])
        except Exception as e:
            print(f"Error auditing permissions: {e}")
            return []


# Usage
if __name__ == '__main__':
    governor = LakeFormationGovernor()

    # Setup classification tags
    tags = governor.setup_classification_tags()

    # Register data location
    governor.register_data_location(
        bucket_arn='arn:aws:s3:::my-data-lake/prod/',
        role_arn='arn:aws:iam::123456789012:role/LF-RegistrationRole'
    )

    # Grant column-level access
    governor.grant_column_access(
        principal_arn='arn:aws:iam::123456789012:role/AnalystRole',
        database='analytics',
        table='customer_orders',
        columns=['order_id', 'customer_name', 'order_date', 'amount']
    )

    # Grant tag-based access
    governor.grant_tag_based_access(
        principal_arn='arn:aws:iam::123456789012:role/RestrictedAnalyst',
        database='analytics',
        table='customer_orders',
        tag_key='DataClassification',
        tag_values=['Internal', 'Confidential']
    )

import boto3
import json
from datetime import datetime

class ComplianceAutomation:
    """Automated compliance monitoring and remediation."""

    def __init__(self, region: str = 'us-east-1'):
        self.config = boto3.client('config', region_name=region)
        self.lambda_client = boto3.client('lambda', region_name=region)
        self.sns = boto3.client('sns', region_name=region)

    def deploy_s3_encryption_rule(self) -> bool:
        """Deploy Config rule requiring S3 encryption."""
        try:
            self.config.put_config_rule(
                ConfigRule={
                    'ConfigRuleName': 's3-encryption-required',
                    'Description': 'Ensures all S3 buckets have encryption enabled',
                    'Source': {
                        'Owner': 'AWS',
                        'SourceIdentifier': 'S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED'
                    },
                    'Scope': {
                        'ComplianceResourceTypes': ['AWS::S3::Bucket']
                    }
                }
            )
            print("Deployed S3 encryption rule")
            return True
        except Exception as e:
            print(f"Error deploying rule: {e}")
            return False

    def deploy_classification_tag_rule(self, lambda_arn: str) -> bool:
        """Deploy Config rule requiring classification tags."""
        try:
            self.config.put_config_rule(
                ConfigRule={
                    'ConfigRuleName': 'data-classification-tag-required',
                    'Description': 'All S3 buckets must have DataClassification tag',
                    'Source': {
                        'Owner': 'CUSTOM_LAMBDA',
                        'SourceIdentifier': lambda_arn,
                        'SourceDetails': [
                            {
                                'EventSource': 'aws.config',
                                'MessageType': 'ConfigurationItemChangeNotification'
                            }
                        ]
                    },
                    'Scope': {
                        'ComplianceResourceTypes': ['AWS::S3::Bucket']
                    },
                    'InputParameters': json.dumps({
                        'RequiredTags': ['DataClassification', 'DataOwner', 'RetentionPeriod']
                    })
                }
            )
            print("Deployed classification tag rule")
            return True
        except Exception as e:
            print(f"Error deploying rule: {e}")
            return False

    def get_compliance_status(self, rule_name: str) -> Dict:
        """Get compliance status for a Config rule."""
        try:
            response = self.config.get_compliance_details_by_config_rule(
                ConfigRuleName=rule_name,
                ComplianceTypes=['COMPLIANT', 'NON_COMPLIANT']
            )

            results = {
                'compliant': [],
                'non_compliant': [],
                'total': 0
            }

            for item in response.get('EvaluationResults', []):
                compliance = item['ComplianceResult']['ComplianceType']
                resource_id = item['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceId']
                results['total'] += 1

                if compliance == 'COMPLIANT':
                    results['compliant'].append(resource_id)
                else:
                    results['non_compliant'].append(resource_id)

            return results
        except Exception as e:
            print(f"Error getting compliance status: {e}")
            return {'compliant': [], 'non_compliant': [], 'total': 0}

    def generate_compliance_report(self) -> Dict:
        """Generate a comprehensive compliance report."""
        rules = [
            's3-encryption-required',
            'data-classification-tag-required',
            'macie-classification-enabled'
        ]

        report = {
            'generated_at': datetime.utcnow().isoformat(),
            'rules': {}
        }

        for rule in rules:
            status = self.get_compliance_status(rule)
            report['rules'][rule] = {
                'total_resources': status['total'],
                'compliant': len(status['compliant']),
                'non_compliant': len(status['non_compliant']),
                'compliance_rate': (
                    len(status['compliant']) / status['total'] * 100
                    if status['total'] > 0 else 0
                )
            }

        return report