import boto3
import json
from typing import Optional

class KMSEncryptionManager:
    """Production KMS encryption manager."""

    def __init__(self, region: str = 'us-east-1'):
        self.kms = boto3.client('kms', region_name=region)
        self.s3 = boto3.client('s3', region_name=region)

    def create_data_key(self, key_id: str) -> Optional[Dict]:
        """Generate a data encryption key for envelope encryption."""
        try:
            response = self.kms.generate_data_key(
                KeyId=key_id,
                KeySpec='AES_256'
            )
            return {
                'plaintext_key': response['Plaintext'],
                'encrypted_key': response['CiphertextBlob']
            }
        except Exception as e:
            print(f"Error generating data key: {e}")
            return None

    def enable_s3_encryption(self, bucket_name: str, key_arn: str) -> bool:
        """Enable SSE-KMS encryption on an S3 bucket."""
        try:
            self.s3.put_bucket_encryption(
                Bucket=bucket_name,
                ServerSideEncryptionConfiguration={
                    'Rules': [
                        {
                            'ApplyServerSideEncryptionByDefault': {
                                'SSEAlgorithm': 'aws:kms',
                                'KMSMasterKeyID': key_arn
                            },
                            'BucketKeyEnabled': True
                        }
                    ]
                }
            )
            print(f"Enabled SSE-KMS on {bucket_name}")
            return True
        except Exception as e:
            print(f"Error enabling encryption: {e}")
            return False

    def enforce_tls_policy(self, bucket_name: str) -> bool:
        """Enforce TLS-only access via bucket policy."""
        policy = {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "DenyInsecureTransport",
                    "Effect": "Deny",
                    "Principal": "*",
                    "Action": "s3:*",
                    "Resource": [
                        f"arn:aws:s3:::{bucket_name}",
                        f"arn:aws:s3:::{bucket_name}/*"
                    ],
                    "Condition": {
                        "Bool": {
                            "aws:SecureTransport": "false"
                        }
                    }
                }
            ]
        }

        try:
            self.s3.put_bucket_policy(
                Bucket=bucket_name,
                Policy=json.dumps(policy)
            )
            print(f"Enforced TLS on {bucket_name}")
            return True
        except Exception as e:
            print(f"Error enforcing TLS: {e}")
            return False

    def create_kms_key(self, description: str) -> Optional[str]:
        """Create a new KMS key with best practices."""
        try:
            response = self.kms.create_key(
                Description=description,
                KeyUsage='ENCRYPT_DECRYPT',
                KeySpec='SYMMETRIC_DEFAULT',
                Tags=[
                    {'TagKey': 'Purpose', 'TagValue': 'DataEncryption'},
                    {'TagKey': 'ManagedBy', 'TagValue': 'DataEngineering'}
                ]
            )

            key_arn = response['KeyMetadata']['Arn']

            # Enable automatic rotation
            self.kms.enable_key_rotation(KeyId=key_arn)

            # Create alias for easy reference
            alias_name = f"alias/data-eng-{key_arn.split('/')[-1][:8]}"
            self.kms.create_alias(
                AliasName=alias_name,
                TargetKeyId=key_arn
            )

            print(f"Created KMS key: {key_arn}")
            return key_arn
        except Exception as e:
            print(f"Error creating KMS key: {e}")
            return None


# Usage
if __name__ == '__main__':
    manager = KMSEncryptionManager()

    # Create a KMS key
    key_arn = manager.create_kms_key('Data encryption key for analytics')

    # Enable encryption on S3 bucket
    manager.enable_s3_encryption('my-secure-data-lake', key_arn)

    # Enforce TLS
    manager.enforce_tls_policy('my-secure-data-lake')

import boto3
from typing import List, Dict

class VPCSecurityManager:
    """Production VPC security manager for data pipelines."""

    def __init__(self, region: str = 'us-east-1'):
        self.ec2 = boto3.client('ec2', region_name=region)

    def create_security_group(
        self,
        name: str,
        vpc_id: str,
        description: str,
        ingress_rules: List[Dict]
    ) -> str:
        """Create a security group with specific ingress rules."""
        try:
            response = self.ec2.create_security_group(
                GroupName=name,
                Description=description,
                VpcId=vpc_id
            )
            sg_id = response['GroupId']

            # Add ingress rules
            self.ec2.authorize_security_group_ingress(
                GroupId=sg_id,
                IpPermissions=ingress_rules
            )

            print(f"Created security group: {sg_id}")
            return sg_id
        except Exception as e:
            print(f"Error creating security group: {e}")
            return None

    def enable_flow_logs(
        self,
        vpc_id: str,
        s3_bucket_arn: str
    ) -> bool:
        """Enable VPC Flow Logs to S3."""
        try:
            self.ec2.create_flow_logs(
                ResourceIds=[vpc_id],
                ResourceType='VPC',
                LogDestinationType='s3',
                LogDestination=s3_bucket_arn,
                TrafficType='ALL',
                MaxAggregationInterval=60
            )
            print(f"Enabled flow logs for VPC: {vpc_id}")
            return True
        except Exception as e:
            print(f"Error enabling flow logs: {e}")
            return False

    def create_vpc_endpoint(
        self,
        vpc_id: str,
        service_name: str,
        route_table_ids: List[str] = None
    ) -> str:
        """Create a VPC Gateway Endpoint for S3/DynamoDB."""
        try:
            params = {
                'VpcId': vpc_id,
                'ServiceName': service_name,
                'VpcEndpointType': 'Gateway'
            }

            if route_table_ids:
                params['RouteTableIds'] = route_table_ids

            response = self.ec2.create_vpc_endpoint(**params)
            endpoint_id = response['VpcEndpoint']['VpcEndpointId']
            print(f"Created VPC endpoint: {endpoint_id}")
            return endpoint_id
        except Exception as e:
            print(f"Error creating VPC endpoint: {e}")
            return None


# Usage
if __name__ == '__main__':
    vpc_manager = VPCSecurityManager()

    # Create security group for Glue
    glue_rules = [
        {
            'IpProtocol': 'tcp',
            'FromPort': 443,
            'ToPort': 443,
            'UserIdGroupPairs': [{'GroupId': 'sg-lambda-id'}]
        }
    ]

    sg_id = vpc_manager.create_security_group(
        name='glue-security-group',
        vpc_id='vpc-12345678',
        description='Security group for Glue crawlers',
        ingress_rules=glue_rules
    )

    # Enable flow logs
    vpc_manager.enable_flow_logs(
        vpc_id='vpc-12345678',
        s3_bucket_arn='arn:aws:s3:::flow-logs-bucket'
    )

    # Create VPC endpoint for S3
    vpc_manager.create_vpc_endpoint(
        vpc_id='vpc-12345678',
        service_name='com.amazonaws.us-east-1.s3',
        route_table_ids=['rtb-12345678']
    )