import boto3
import hashlib
import json
from datetime import datetime, timedelta

class GDPRComplianceManager:
    """Implement GDPR compliance controls on AWS."""

    def __init__(self):
        self.s3 = boto3.client('s3')
        self.dynamodb = boto3.resource('dynamodb')
        self.kms = boto3.client('kms')

    def pseudonymize_data(self, record, key_id):
        """Replace direct identifiers with pseudonymous tokens (GDPR Article 4(5))."""
        sensitive_fields = ['email', 'phone', 'ssn', 'ip_address', 'date_of_birth']
        pseudonymized = record.copy()

        for field in sensitive_fields:
            if field in pseudonymized:
                hash_value = hashlib.sha256(
                    f"{pseudonymized[field]},{key_id}".encode()
                ).hexdigest()[:16]
                pseudonymized[f'{field}_hash'] = hash_value
                del pseudonymized[field]

        pseudonymized['_pseudonymized_at'] = datetime.utcnow().isoformat()
        pseudonymized['_retention_days'] = 730  # 2 years default
        return pseudonymized

    def enforce_retention_policy(self, bucket_name, retention_days):
        """Automatically delete data exceeding retention period (GDPR Article 5(1)(e))."""
        cutoff_date = datetime.utcnow() - timedelta(days=retention_days)
        deleted_count = 0

        paginator = self.s3.get_paginator('list_objects_v2')
        for page in paginator.paginate(Bucket=bucket_name):
            for obj in page.get('Contents', []):
                if obj['LastModified'].replace(tzinfo=None) < cutoff_date:
                    self.s3.delete_object(Bucket=bucket_name, Key=obj['Key'])
                    deleted_count += 1

        return {'deleted': deleted_count, 'cutoff': cutoff_date.isoformat()}

    def handle_deletion_request(self, user_id, data_stores):
        """Process GDPR right to erasure request (Article 17)."""
        deletion_log = {
            'user_id': user_id,
            'requested_at': datetime.utcnow().isoformat(),
            'deletions': []
        }

        for store_name in data_stores:
            table = self.dynamodb.Table(store_name)
            response = table.delete_item(
                Key={'user_id': user_id},
                ReturnValues='ALL_OLD'
            )
            if 'Attributes' in response:
                deletion_log['deletions'].append({
                    'store': store_name,
                    'deleted_at': datetime.utcnow().isoformat()
                })

        # Log deletion for audit trail
        self._log_audit_event('GDPR_DELETION', deletion_log)
        return deletion_log

    def export_user_data(self, user_id, data_stores):
        """Export all user data in machine-readable format (Article 20 - Portability)."""
        export_data = {
            'user_id': user_id,
            'export_date': datetime.utcnow().isoformat(),
            'format': 'JSON',
            'data': {}
        }

        for store_name in data_stores:
            table = self.dynamodb.Table(store_name)
            response = table.query(
                KeyConditionExpression=boto3.dynamodb.conditions.Key('user_id').eq(user_id)
            )
            export_data['data'][store_name] = response['Items']

        return export_data

    def _log_audit_event(self, event_type, details):
        """Log compliance events to CloudWatch."""
        cloudwatch = boto3.client('cloudwatch')
        cloudwatch.put_metric_data(
            Namespace='Compliance/GDPR',
            MetricData=[{
                'MetricName': event_type,
                'Value': 1,
                'Unit': 'Count',
                'Dimensions': [
                    {'Name': 'Environment', 'Value': 'Production'}
                ]
            }]
        )

import boto3
import json

class HIPAAComplianceManager:
    """Implement HIPAA compliance controls on AWS."""

    def __init__(self):
        self.s3 = boto3.client('s3')
        self.kms = boto3.client('kms')

    def create_hipaa_bucket(self, bucket_name):
        """Create S3 bucket with HIPAA-compliant settings."""
        # Enable versioning
        self.s3.put_bucket_versioning(
            Bucket=bucket_name,
            VersioningConfiguration={'Status': 'Enabled'}
        )

        # Default encryption with KMS
        self.s3.put_bucket_encryption(
            Bucket=bucket_name,
            ServerSideEncryptionConfiguration={
                'Rules': [{
                    'ApplyServerSideEncryptionByDefault': {
                        'SSEAlgorithm': 'aws:kms',
                        'KMSMasterKeyID': 'alias/hipaa-key'
                    },
                    'BucketKeyEnabled': True
                }]
            }
        )

        # Block all public access
        self.s3.put_public_access_block(
            Bucket=bucket_name,
            PublicAccessBlockConfiguration={
                'BlockPublicAcls': True,
                'IgnorePublicAcls': True,
                'BlockPublicPolicy': True,
                'RestrictPublicBuckets': True
            }
        )

        # Enable access logging
        self.s3.put_bucket_logging(
            Bucket=bucket_name,
            BucketLoggingStatus={
                'LoggingEnabled': {
                    'TargetBucket': 'hipaa-access-logs',
                    'TargetPrefix': f'{bucket_name}/'
                }
            }
        )

        # Object Lock for WORM compliance
        self.s3.put_object_lock_configuration(
            Bucket=bucket_name,
            ObjectLockConfiguration={
                'ObjectLockEnabled': 'Enabled',
                'Rule': {
                    'DefaultRetention': {
                        'Mode': 'GOVERNANCE',
                        'Days': 2555  # ~7 years for HIPAA
                    }
                }
            }
        )

        return {'status': 'created', 'bucket': bucket_name, 'compliance': 'HIPAA'}

import boto3
import json
from datetime import datetime

class ComplianceAutomationPipeline:
    """Automated compliance monitoring and enforcement."""

    def __init__(self, region='us-east-1'):
        self.config = boto3.client('config', region_name=region)
        self.securityhub = boto3.client('securityhub', region_name=region)
        self.sns = boto3.client('sns', region_name=region)

    def create_config_rules(self):
        """Create AWS Config rules for compliance enforcement."""
        rules = [
            {'ConfigRuleName': 'encrypted-volumes', 'Source': {'Owner': 'AWS', 'SourceIdentifier': 'ENCRYPTED_VOLUMES'}},
            {'ConfigRuleName': 's3-bucket-public-read-prohibited', 'Source': {'Owner': 'AWS', 'SourceIdentifier': 'S3_BUCKET_PUBLIC_READ_PROHIBITED'}},
            {'ConfigRuleName': 'rds-storage-encrypted', 'Source': {'Owner': 'AWS', 'SourceIdentifier': 'RDS_STORAGE_ENCRYPTED'}},
            {'ConfigRuleName': 'kms-cmk-not-scheduled-for-deletion', 'Source': {'Owner': 'AWS', 'SourceIdentifier': 'KMS_CMK_NOT_SCHEDULED_FOR_DELETION'}},
            {'ConfigRuleName': 'iam-user-unused-credentials-check', 'Source': {'Owner': 'AWS', 'SourceIdentifier': 'IAM_USER_UNUSED_CREDENTIALS_CHECK'}},
            {'ConfigRuleName': 'cloudtrail-enabled', 'Source': {'Owner': 'AWS', 'SourceIdentifier': 'CLOUD_TRAIL_ENABLED'}},
        ]

        for rule in rules:
            self.config.put_config_rule(ConfigRule=rule)
        return rules

    def check_compliance(self):
        """Evaluate current compliance posture."""
        paginator = self.config.get_paginator('describe_compliance_by_config_rule')
        non_compliant = []

        for page in paginator.paginate():
            for rule in page['ComplianceByConfigRules']:
                if rule['Compliance']['ComplianceType'] == 'NON_COMPLIANT':
                    non_compliant.append({
                        'rule': rule['ConfigRuleName'],
                        'status': 'NON_COMPLIANT'
                    })

        return {
            'timestamp': datetime.utcnow().isoformat(),
            'non_compliant_count': len(non_compliant),
            'non_compliant_rules': non_compliant
        }

    def send_compliance_alert(self, findings):
        """Send SNS notification for compliance violations."""
        if findings['non_compliant_count'] > 0:
            message = f"Compliance Alert: {findings['non_compliant_count']} violations\n\n"
            for finding in findings['non_compliant_rules']:
                message += f"- {finding['rule']}: {finding['status']}\n"

            self.sns.publish(
                TopicArn='arn:aws:sns:us-east-1:123456789012:compliance-alerts',
                Subject='AWS Compliance Violation Alert',
                Message=message
            )
            return True
        return False

    def generate_report(self):
        """Generate compliance report for audit."""
        return {
            'report_date': datetime.utcnow().isoformat(),
            'frameworks': ['HIPAA', 'GDPR', 'SOC2'],
            'compliance_status': self.check_compliance(),
            'remediation_required': True
        }