ic-code 1.5.2__tar.gz → 1.6.0__tar.gz

{ic_code-1.5.2/src/ic_code.egg-info → ic_code-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ic-code
-Version: 1.5.2
+Version: 1.6.0
 Summary: Infrastructure CLI tool for managing AWS, GCP, OCI, CloudFlare, SSH, and more
 Home-page: https://github.com/dgr009/ic
 Author: SangYun Kim
@@ -117,10 +117,12 @@ A comprehensive, production-grade Infrastructure Command Line Interface tool for
 ## ✨ Key Features
 
 - **🚀 Multi-Cloud Support**: AWS, Tencent Cloud, GCP, OCI, CloudFlare, and SSH server management
+- **🔄 Smart Auth & Profile Switcher**: One-touch atomic switching between personal SSO/STS sessions (`aws login`, `tccli auth login`) and service accounts with real-time session expiry tracking & automatic background refresh
+- **🛡️ IAM & CAM Security Auditing**: One-touch audit of console login types (User/Service/Collaborator), password age (color-coded warnings for 90+ days), last login, access key usage, and attached policies
 - **📊 Rich Progress Bars**: Real-time progress indicators for all long-running operations across accounts and regions
-- **🔒 Secure Configuration**: Modern YAML-based configuration (`~/.ic/config/`) and native credential files (`~/.aws/config`, `~/.tencent/credentials`)
+- **🔒 Secure Configuration**: Modern YAML-based configuration (`~/.ic/config/`) and native credential files (`~/.aws/config`, `~/.tencent/credentials`) with private role mapping
 - **🌍 Multi-Account / Multi-Region**: Concurrent querying across multiple cloud accounts and regions with STS / CAM AssumeRole support
-- **🎨 Beautiful Terminal UI**: Rich terminal output with tables, colors, JSON formatting, and tree diagrams
+- **🎨 Beautiful Terminal UI**: Rich terminal output with tables, colors, JSON formatting, and hierarchical tree diagrams
 - **⚡ High Performance**: Optimized async and concurrent execution for fast resource discovery
 - **🛡️ Security First**: Built-in credential masking, secret scanning, and pre-commit hook support
 
@@ -135,19 +137,49 @@ A comprehensive, production-grade Infrastructure Command Line Interface tool for
 ## 📦 Supported Platforms & Services
 
 ### 1. 🟧 AWS Services (Production Ready)
-- **Compute**: EC2 instances, ECS services/tasks, EKS clusters/nodes/pods, Fargate profiles
-- **Storage & DB**: S3 buckets (with tagging compliance checks), RDS instances & clusters
-- **Networking**: VPC, Subnets, Gateways, Load Balancers (ALB/NLB with listener rules, health check path & target health analysis), Security Groups (with Ingress & Egress rule analysis & tree view), VPN connections
-- **Health & Maintenance**: AWS Health Dashboard EC2 scheduled reboot maintenance check (`ic aws healthdashboard reboot`)
-- **Integrations**: CloudFront distributions, MSK Kafka brokers, CodePipeline build/deploy status, Profile management
+- **Authentication & Profile**:
+  - Seamless authentication switching between personal `aws login` STS session and service account static credentials (`ic aws profile switch [login|service]`)
+  - Real-time STS session lifetime tracking and profile overview (`ic aws profile info`)
+- **Security & IAM**:
+  - IAM user security auditing: console login status, password age with color-coded risk alerts (90+ days red, 60-89 yellow), last login date, last Access Key usage date, and attached managed/inline/group policies (`ic aws iam user`)
+- **Compute & Containers**:
+  - EC2 instances with state, type, IPs, VPC, and deep attribute inspection (`ic aws ec2 info`, `ic aws ec2 desc`)
+  - ECS clusters, services, and task inspection (`ic aws ecs info`, `ic aws ecs service`, `ic aws ecs task`)
+  - EKS Kubernetes clusters, node groups, pods, addons, and Fargate profiles (`ic aws eks info`, `ic aws eks nodes`, `ic aws eks pods`, `ic aws eks addons`, `ic aws eks fargate`)
+- **Storage & Databases**:
+  - EBS volumes inspection: size, state, volume type, IOPS, throughput, and attached instances (`ic aws ebs info`)
+  - S3 buckets inspection and tagging compliance checks (`ic aws s3 info`, `ic aws s3 tag_check`)
+  - RDS database instances and Aurora clusters (`ic aws rds info`)
+- **Networking & Content Delivery**:
+  - VPC, Subnets, NAT Gateways, and VPN connections (`ic aws vpc info`, `ic aws vpn info`)
+  - Load Balancers (ALB/NLB) with listener rules, health check paths, and target instance health analysis (`ic aws lb info`, `ic aws lb desc`)
+  - Security Groups with Ingress/Egress rule inspection and visual relation tree (`ic aws sg info`, `ic aws sg info -o tree`)
+  - CloudFront CDN distributions and origin configs (`ic aws cloudfront info`)
+- **Health & Maintenance**:
+  - AWS Health Dashboard EC2 scheduled reboot maintenance check across all accounts (`ic aws healthdashboard reboot`)
+- **Integrations**:
+  - MSK (Managed Streaming for Kafka) clusters and brokers (`ic aws msk info`, `ic aws msk broker`)
+  - CodePipeline build and deployment pipeline status (`ic aws codepipeline build`, `ic aws codepipeline deploy`)
 
 ### 2. 🟦 Tencent Cloud Services (Production Ready)
-- **Compute**: CVM instances (with CPU, Mem, Disk, IP, SGs), Lighthouse lightweight application servers
-- **Containers**: TKE (Tencent Kubernetes Engine) clusters & node details
-- **Networking**: VPC, Subnets, NAT Gateways, CLB (Load Balancers - listener rules, health check, target health analysis & network traffic bandwidth statistics), Security Groups (with Ingress/Egress rules & tree view)
-- **Authentication**: Multi-account STS AssumeRole support, Profile management (`ic tencent profile info` via `~/.tencent/credentials`)
-
-### 3. 🟩 GCP Services (Production Ready - v1.5.2)
+- **Authentication & Profile**:
+  - Seamless dual-mode authentication switching between personal account (`tccli auth login` STS) and service account (`~/.tencent/credentials`) with real-time session tracking (`ic tencent profile switch [tccli|service]`)
+  - Cross-account dynamic AssumeRole support with credentials inspection (`ic tencent profile info`)
+- **Security & CAM**:
+  - CAM sub-account and collaborator (협력자/외부계정) security auditing: login type (User/Service/Collaborator), password age, last login timestamp, SecretId key usage date, and policy details (`ic tencent cam user`)
+- **Compute & Containers**:
+  - CVM instances with CPU, Memory, Disk, Zone, IPs, attached SGs, and deep attribute inspection (`ic tencent cvm info`, `ic tencent cvm desc`)
+  - Lighthouse lightweight application servers (`ic tencent lighthouse info`, `ic tencent lighthouse info -p`) and dedicated instance firewall rules inspection (`ic tencent lighthouse firewall`, `ic tencent lighthouse firewall -o tree`)
+  - TKE (Tencent Kubernetes Engine) clusters and node details (`ic tencent tke info`)
+- **Storage & Databases**:
+  - CBS (Cloud Block Storage) disk inspection: volume size, disk type, status, and attached CVM instances (`ic tencent cbs info`, `ic tencent disk info`)
+- **Networking**:
+  - VPC, Subnets, and NAT Gateways (`ic tencent vpc info`, `ic tencent nat info`)
+  - CLB (Cloud Load Balancer): listeners, rules, health check path, and target instance health status (`ic tencent clb info`, `ic tencent clb desc`)
+  - CLB Traffic & Bandwidth: In/Out bandwidth (Avg/Max in Mbps) and total data transfer over 7 or 30 days (`ic tencent clb traffic`)
+  - Security Groups with Ingress/Egress rule analysis and visual hierarchy tree (`ic tencent sg info`, `ic tencent sg info -o tree`)
+
+### 3. 🟩 GCP Services (Production Ready - v1.5.3)
 - **Compute Engine**: VM instances with status, zone, machine type (custom parsing), vCPU, memory, disks, IPs, tags, and verbose 15-column output (`ic gcp compute info -v`)
 - **Compute Detailed Inspection (`desc`)**: Full attribute discovery, dot-notation key filtering (`-k / --keys`), schema discovery (`-l / --list-keys`) for instances
 - **Load Balancing (LB)**: Forwarding rules, Target proxies, URL maps, Backend services, Health checks, and SSL certificates (`ic gcp lb info`)
@@ -244,6 +276,18 @@ aws:
     - "ap-northeast-2"
     - "us-east-1"
 
+# Tencent Cloud Configuration (Dynamic AssumeRole & Profile Switching)
+tencent:
+  root_account: "main"                     # Source profile for AssumeRole
+  root_account_id: "123456789012"          # Source root account UIN
+  tccli_role: "OrganizationAccountAccessRole"  # Role for personal tccli session AssumeRole
+  service_role: "ServiceAdminRole"         # Role for service account static key AssumeRole
+  isolated_accounts:                       # Sub-accounts that keep dedicated direct credentials
+    - "china-mainland-account"
+  regions:
+    - "ap-seoul"
+    - "ap-guangzhou"
+
 # GCP Configuration
 gcp:
   project_id: "my-gcp-project-id"
@@ -288,55 +332,157 @@ ic config validate
 ### AWS Commands
 
 ```bash
-# List EC2 instances across configured regions
+# --- Authentication & Profile Switching ---
+# View current authentication mode (login vs service) and STS session validity
+ic aws profile switch
+
+# Switch between personal SSO/STS mode (aws login) and service account (static credentials)
+ic aws profile switch login
+ic aws profile switch service
+
+# Inspect all configured profiles and active credential status
+ic aws profile info
+
+# --- IAM User Security & Password Audit ---
+# Audit all IAM users: console login type, password age, last login, last key used, policies
+ic aws iam user
+
+# Filter warning users with password older than 90 days
+ic aws iam user -w
+ic aws iam user -a prod-account -w
+
+# Filter by login type (user or service)
+ic aws iam user -t user
+ic aws iam user -t service
+
+# Verbose output (including User ID and Access Key ID list) or copyable text for spreadsheets
+ic aws iam user -v
+ic aws iam user -p
+
+# --- Health & Maintenance ---
+# Check EC2 scheduled reboot maintenance across all accounts
+ic aws healthdashboard reboot
+ic aws healthdashboard reboot -A
+ic aws healthdashboard reboot -a prod-account --all-status
+
+# --- Compute & Containers ---
+# List EC2 instances across regions
 ic aws ec2 info
 
-# Security Group Info (Shows Ingress & Egress rules by default)
-ic aws sg info
+# Detailed EC2 instance inspection with key filtering
+ic aws ec2 desc -l                                       # Discover available keys
+ic aws ec2 desc -k InstanceId,State.Name,PrivateIpAddress
 
-# Filter Security Groups for Ingress or Egress rules only
+# EKS cluster, node groups, and pod status
+ic aws eks info
+ic aws eks nodes
+ic aws eks pods
+
+# ECS clusters, services, and tasks
+ic aws ecs info
+ic aws ecs service
+ic aws ecs task
+
+# --- Storage & Databases ---
+# Inspect EBS volumes (size, status, volume type, IOPS, attached instances)
+ic aws ebs info
+
+# S3 bucket listing and tagging compliance checks
+ic aws s3 info
+ic aws s3 tag_check
+
+# RDS instances and Aurora clusters
+ic aws rds info
+
+# --- Networking & Security ---
+# Security Group info (Ingress & Egress rules)
+ic aws sg info
 ic aws sg info --ingress    # Show Ingress rules only
 ic aws sg info --egress     # Show Egress rules only
 
-# Render Security Groups in visual tree structure with direction arrows (← Ingress, → Egress)
+# Render Security Groups in visual hierarchical tree (← Ingress, → Egress)
 ic aws sg info -o tree
 
-# S3 Bucket details and tag validation
-ic aws s3 info
-ic aws s3 tag_check
+# Load Balancers (ALB / NLB) and deep hierarchy inspection
+ic aws lb info
+ic aws lb desc -l
 
-# EKS & ECS Cluster info
-ic aws eks info
-ic aws ecs info
+# VPC & NAT Gateway
+ic aws vpc info
 ```
 
 ### Tencent Cloud Commands
 
 ```bash
+# --- Authentication & Profile Switching ---
+# View current authentication mode (tccli vs service) and STS token validity
+ic tencent profile switch
+
+# Switch between personal account (tccli STS token) and service account (~/.tencent/credentials)
+ic tencent profile switch tccli
+ic tencent profile switch service
+
+# Inspect registered accounts, active authentication mode, and dynamic AssumeRole mapping
+ic tencent profile info
+
+# --- CAM User Security & Password Audit ---
+# Audit CAM users & collaborators: console login type, password age, last login, last key used
+ic tencent cam user
+
+# Filter users with password older than 90 days
+ic tencent cam user -w
+
+# Filter by login type (user, service, or collaborator)
+ic tencent cam user -t user
+ic tencent cam user -t collaborator
+
+# --- Compute & Containers ---
 # List CVM instances across accounts and regions
 ic tencent cvm info
-ic tencent cvm info -a my-account
+ic tencent cvm info -a prod-account
+
+# Deep CVM instance inspection with dot-notation key filtering
+ic tencent cvm desc -l                                   # Discover available keys
+ic tencent cvm desc -k InstanceId,InstanceState,PrivateIpAddresses.0
 
-# List Lighthouse lightweight instances
+# Lightweight application servers (Lighthouse)
 ic tencent lighthouse info
+ic tencent lighthouse info -n "web,db"                           # Multi-pattern search with comma
+ic tencent lighthouse info -p                                    # Spreadsheet copyable comma-separated format
 
-# Security Group Info (Tables and Tree view)
-ic tencent sg info
-ic tencent sg info -o tree
+# Lighthouse Firewall Rules (Instance inbound firewall rules)
+ic tencent lighthouse firewall                              # Table view across instances
+ic tencent lighthouse firewall -o tree                      # Hierarchical tree view (Account > Region > Instance > Rules)
+ic tencent lighthouse firewall -p                           # Spreadsheet copyable comma-separated format
+ic tencent lighthouse firewall --port 22 --action ACCEPT    # Filter by port and action
+
+# TKE Kubernetes clusters & node details
+ic tencent tke info
 
-# Load Balancer (CLB) with listeners, health check path & target health
+# --- Storage ---
+# Inspect Cloud Block Storage (CBS / Disk) volumes
+ic tencent cbs info
+ic tencent disk info
+
+# --- Networking & Load Balancing ---
+# Cloud Load Balancer (CLB) with listeners, rules, and target health
 ic tencent clb info
+ic tencent clb desc -l
+
+# CLB Network bandwidth statistics (Avg/Max Mbps) and data transfer (default 7 days, or 30 days)
+ic tencent clb traffic
+ic tencent clb traffic -d 30
 
-# VPC, Subnets, NAT Gateways & TKE Clusters
+# Security Groups with Ingress/Egress rules and tree view
+ic tencent sg info
+ic tencent sg info -o tree
+
+# VPC, Subnets, and NAT Gateways
 ic tencent vpc info
 ic tencent nat info
-ic tencent tke info
-
-# Check credentials and profiles (~/.tencent/credentials)
-ic tencent profile info
 ```
 
-### GCP Commands (v1.5.2)
+### GCP Commands (v1.5.3)
 
 ```bash
 # Compute Engine VM instances (summary & verbose 15-column output)