labagent 0.1.0__py3-none-any.whl

labagent/__init__.py

@@ -0,0 +1,3 @@
+"""labagent: provision, inventory and safely tear down ephemeral AWS workshop sandboxes."""
+
+__version__ = "0.1.0"

labagent/audit.py

@@ -0,0 +1,233 @@
+"""Full-account discovery by listing each service (not by tag), for cleaning up accounts that were never tagged.
+
+Read-only. Complements discovery.py, which finds tagged lab resources through the Tagging API.
+"""
+from __future__ import annotations
+
+import concurrent.futures as cf
+from typing import Callable, Dict, List, Optional
+
+from botocore.exceptions import ClientError, EndpointConnectionError
+
+from .context import Ctx
+from .discovery import Resource
+
+
+def synthetic_arn(service: str, rtype: str, region: str, rid: str) -> str:
+    return f"labagent:{service}/{rtype}/{region}/{rid}"
+
+
+def _tags(raw) -> Dict[str, str]:
+    if isinstance(raw, dict):
+        return {str(k): str(v) for k, v in raw.items()}
+    return {str(x.get("Key", x.get("key"))): str(x.get("Value", x.get("value"))) for x in (raw or [])}
+
+
+def _mk(service, rtype, region, rid, name=None, tags=None, **attrs) -> Resource:
+    return Resource(arn=synthetic_arn(service, rtype, region, rid), service=service, rtype=rtype, rid=rid,
+                    region=region, name=name or rid, tags=_tags(tags), attrs={k: v for k, v in attrs.items() if v is not None})
+
+
+def _regional(ctx: Ctx, region: str, out: List[Resource], errors: List[str]) -> None:
+    c = lambda s: ctx.client(s, region)
+
+    def lam():
+        for p in c("lambda").get_paginator("list_functions").paginate():
+            for f in p["Functions"]:
+                tg = c("lambda").list_tags(Resource=f["FunctionArn"]).get("Tags", {})
+                out.append(_mk("lambda", "function", region, f["FunctionName"], tags=tg, created=f["LastModified"]))
+
+    def apigw():
+        for p in c("apigateway").get_paginator("get_rest_apis").paginate():
+            for a in p["items"]:
+                out.append(_mk("apigateway", "restapi", region, a["id"], a.get("name"), a.get("tags"),
+                               created=str(a.get("createdDate"))))
+        for a in c("apigatewayv2").get_apis().get("Items", []):
+            out.append(_mk("apigateway", "httpapi", region, a["ApiId"], a.get("Name"), a.get("Tags"),
+                           created=str(a.get("CreatedDate"))))
+
+    def ddb():
+        for p in c("dynamodb").get_paginator("list_tables").paginate():
+            for t in p["TableNames"]:
+                arn = c("dynamodb").describe_table(TableName=t)["Table"]["TableArn"]
+                out.append(_mk("dynamodb", "table", region, t, tags=c("dynamodb").list_tags_of_resource(ResourceArn=arn).get("Tags")))
+
+    def ec2():
+        e = c("ec2")
+        for p in e.get_paginator("describe_instances").paginate():
+            for r in p["Reservations"]:
+                for i in r["Instances"]:
+                    if i["State"]["Name"] != "terminated":
+                        nm = next((x["Value"] for x in i.get("Tags", []) if x["Key"] == "Name"), None)
+                        out.append(_mk("ec2", "instance", region, i["InstanceId"], nm, i.get("Tags"),
+                                       state=i["State"]["Name"], created=str(i["LaunchTime"])))
+        for v in e.describe_volumes()["Volumes"]:
+            out.append(_mk("ec2", "volume", region, v["VolumeId"], tags=v.get("Tags"), attached=len(v["Attachments"]) > 0,
+                           created=str(v.get("CreateTime"))))
+        for a in e.describe_addresses()["Addresses"]:
+            out.append(_mk("ec2", "elastic-ip", region, a.get("AllocationId", a.get("PublicIp")), tags=a.get("Tags"),
+                           associated="AssociationId" in a))
+        for g in e.describe_security_groups()["SecurityGroups"]:
+            if g["GroupName"] != "default":
+                out.append(_mk("ec2", "security-group", region, g["GroupId"], g["GroupName"], g.get("Tags")))
+        for k in e.describe_key_pairs()["KeyPairs"]:
+            out.append(_mk("ec2", "key-pair", region, k["KeyName"], tags=k.get("Tags"), created=str(k.get("CreateTime"))))
+        for n in e.describe_nat_gateways()["NatGateways"]:
+            if n["State"] != "deleted":
+                out.append(_mk("ec2", "nat-gateway", region, n["NatGatewayId"], tags=n.get("Tags"), state=n["State"]))
+        for v in e.describe_vpcs()["Vpcs"]:
+            nm = next((x["Value"] for x in v.get("Tags", []) if x["Key"] == "Name"), None)
+            # default VPCs are listed too (so they are visible) but only an explicit rule can remove them
+            out.append(_mk("ec2", "vpc", region, v["VpcId"], nm, v.get("Tags"), is_default=bool(v.get("IsDefault")),
+                           cidr=v.get("CidrBlock")))
+
+    def elb():
+        for lb in c("elbv2").describe_load_balancers()["LoadBalancers"]:
+            out.append(_mk("elbv2", "load-balancer", region, lb["LoadBalancerName"], created=str(lb["CreatedTime"])))
+
+    def logs():
+        for p in c("logs").get_paginator("describe_log_groups").paginate():
+            for g in p["logGroups"]:
+                out.append(_mk("logs", "log-group", region, g["logGroupName"], created=str(g.get("creationTime")),
+                               bytes=g.get("storedBytes", 0)))
+
+    def ecr():
+        for p in c("ecr").get_paginator("describe_repositories").paginate():
+            for r in p["repositories"]:
+                out.append(_mk("ecr", "repository", region, r["repositoryName"]))
+
+    def cfn():
+        for p in c("cloudformation").get_paginator("describe_stacks").paginate():
+            for s in p["Stacks"]:
+                out.append(_mk("cloudformation", "stack", region, s["StackName"], tags=s.get("Tags"),
+                               status=s["StackStatus"], created=str(s.get("CreationTime"))))
+
+    def rds():
+        for d in c("rds").describe_db_instances()["DBInstances"]:
+            out.append(_mk("rds", "db-instance", region, d["DBInstanceIdentifier"], status=d["DBInstanceStatus"]))
+
+    def eks():
+        for a in c("ecs").list_clusters()["clusterArns"]:
+            out.append(_mk("ecs", "cluster", region, a.split("/")[-1]))
+        for a in c("eks").list_clusters()["clusters"]:
+            out.append(_mk("eks", "cluster", region, a))
+
+    def sec():
+        for p in c("secretsmanager").get_paginator("list_secrets").paginate():
+            for s in p["SecretList"]:
+                out.append(_mk("secretsmanager", "secret", region, s["Name"], tags=s.get("Tags")))
+
+    def sns():
+        for p in c("sns").get_paginator("list_topics").paginate():
+            for t in p["Topics"]:
+                out.append(_mk("sns", "topic", region, t["TopicArn"].split(":")[-1]))
+        for q in c("sqs").list_queues().get("QueueUrls", []):
+            out.append(_mk("sqs", "queue", region, q.split("/")[-1]))
+
+    def layers():
+        for p in c("lambda").get_paginator("list_layers").paginate():
+            for l in p["Layers"]:
+                out.append(_mk("lambda", "layer", region, l["LayerName"], versions=l["LatestMatchingVersion"]["Version"],
+                               created=l["LatestMatchingVersion"].get("CreatedDate")))
+
+    def glue():
+        g = c("glue")
+        for p in g.get_paginator("get_databases").paginate():
+            for d in p["DatabaseList"]:
+                out.append(_mk("glue", "database", region, d["Name"], created=str(d.get("CreateTime"))))
+        for p in g.get_paginator("get_crawlers").paginate():
+            for d in p["Crawlers"]:
+                out.append(_mk("glue", "crawler", region, d["Name"], state=d.get("State")))
+        for p in g.get_paginator("get_jobs").paginate():
+            for d in p["Jobs"]:
+                out.append(_mk("glue", "job", region, d["Name"], created=str(d.get("CreatedOn"))))
+
+    def athena():
+        for w in c("athena").list_work_groups()["WorkGroups"]:
+            if w["Name"] != "primary":
+                out.append(_mk("athena", "workgroup", region, w["Name"], created=str(w.get("CreationTime"))))
+
+    def alarms():
+        for p in c("cloudwatch").get_paginator("describe_alarms").paginate():
+            for a in p["MetricAlarms"]:
+                out.append(_mk("cloudwatch", "alarm", region, a["AlarmName"], created=str(a.get("AlarmConfigurationUpdatedTimestamp"))))
+
+    for fn in (lam, apigw, ddb, ec2, elb, logs, ecr, cfn, rds, eks, sec, sns, layers, glue, athena, alarms):
+        try:
+            fn()
+        except (ClientError, EndpointConnectionError) as e:
+            code = getattr(e, "response", {}).get("Error", {}).get("Code", type(e).__name__)
+            errors.append(f"{region}:{fn.__name__}:{code}")
+
+
+def _global(ctx: Ctx, out: List[Resource], errors: List[str]) -> None:
+    def s3():
+        c = ctx.client("s3")
+        for b in c.list_buckets()["Buckets"]:
+            try:
+                tg = c.get_bucket_tagging(Bucket=b["Name"])["TagSet"]
+            except ClientError:
+                tg = []
+            try:
+                loc = c.get_bucket_location(Bucket=b["Name"])["LocationConstraint"] or "us-east-1"
+            except ClientError:
+                loc = ctx.cfg.region
+            out.append(_mk("s3", "bucket", loc, b["Name"], tags=tg, created=str(b["CreationDate"])))
+
+    def cloudfront():
+        c = ctx.client("cloudfront", "us-east-1")
+        for p in c.get_paginator("list_distributions").paginate():
+            for d in (p.get("DistributionList", {}).get("Items") or []):
+                tg = c.list_tags_for_resource(Resource=d["ARN"])["Tags"]["Items"]
+                out.append(_mk("cloudfront", "distribution", "us-east-1", d["Id"], d["DomainName"], tg,
+                               enabled=d["Enabled"], status=d["Status"], created=str(d.get("LastModifiedTime")), aliases=len(d.get("Aliases", {}).get("Items", []) or []),
+                               comment=d.get("Comment", "")))
+
+    def iam():
+        c = ctx.client("iam")
+        for p in c.get_paginator("list_users").paginate():
+            for u in p["Users"]:
+                out.append(_mk("iam", "user", "global", u["UserName"], tags=c.list_user_tags(UserName=u["UserName"]).get("Tags"),
+                               created=str(u["CreateDate"]), last_used=str(u["PasswordLastUsed"]) if u.get("PasswordLastUsed") else None))
+        for p in c.get_paginator("list_roles").paginate():
+            for r in p["Roles"]:
+                if not r["Path"].startswith("/aws-service-role/"):
+                    out.append(_mk("iam", "role", "global", r["RoleName"], tags=r.get("Tags"), created=str(r["CreateDate"]),
+                                   last_used=str(r.get("RoleLastUsed", {}).get("LastUsedDate")) if r.get("RoleLastUsed", {}).get("LastUsedDate") else None))
+        for p in c.get_paginator("list_groups").paginate():
+            for g in p["Groups"]:
+                out.append(_mk("iam", "group", "global", g["GroupName"], created=str(g["CreateDate"])))
+        for p in c.get_paginator("list_policies").paginate(Scope="Local"):
+            for g in p["Policies"]:
+                r = _mk("iam", "policy", "global", g["PolicyName"], created=str(g["CreateDate"]), attachments=g["AttachmentCount"])
+                r.arn = g["Arn"]
+                out.append(r)
+
+    def dashboards():
+        # CloudWatch dashboards are account-wide: list once, always through us-east-1
+        cw = ctx.client("cloudwatch", "us-east-1")
+        for p in cw.get_paginator("list_dashboards").paginate():
+            for d in p["DashboardEntries"]:
+                out.append(_mk("cloudwatch", "dashboard", "us-east-1", d["DashboardName"], created=str(d.get("LastModified"))))
+
+    for fn in (s3, cloudfront, iam, dashboards):
+        try:
+            fn()
+        except (ClientError, EndpointConnectionError) as e:
+            code = getattr(e, "response", {}).get("Error", {}).get("Code", type(e).__name__)
+            errors.append(f"global:{fn.__name__}:{code}")
+
+
+def discover_all(ctx: Ctx, regions: Optional[List[str]] = None, workers: int = 12) -> "tuple[List[Resource], List[str]]":
+    """Returns (resources, errors). `regions` defaults to config.regions; pass ['*'] for every enabled region."""
+    regs = regions or ctx.cfg.regions
+    if regs == ["*"]:
+        regs = [r["RegionName"] for r in ctx.client("ec2").describe_regions()["Regions"]]
+    out: List[Resource] = []
+    errors: List[str] = []
+    with cf.ThreadPoolExecutor(workers) as ex:
+        futs = [ex.submit(_regional, ctx, r, out, errors) for r in regs]
+        futs.append(ex.submit(_global, ctx, out, errors))
+        for f in futs:
+            f.result()
+    return sorted(out, key=lambda r: (r.service, r.rtype, r.region, r.rid)), sorted(errors)

labagent/cleanup.py

@@ -0,0 +1,67 @@
+"""Ruleset-driven audit and cleanup of an existing account. Plan, then apply the plan with sweep_apply."""
+from __future__ import annotations
+
+from collections import Counter
+from typing import Any, Dict, Optional
+
+from .audit import discover_all
+from .context import Ctx, log
+from .deleters import REGISTRY, cleanup_types
+from .envelope import Envelope
+from .plan import build_plan
+from .rules import RulesetError, decide, validate
+
+
+def _decide_all(ctx: Ctx, ruleset: Dict[str, Any], regions=None):
+    validate(ruleset)
+    resources, errors = discover_all(ctx, regions)
+    supported = set(cleanup_types())
+    rows = []
+    for r in resources:
+        d = decide(r, ruleset, ctx.cfg)
+        action, reason = d.action, d.reason
+        if action == "delete" and (r.service, r.rtype) not in supported:
+            action, reason = "review", f"matched rule {d.rule} but labagent has no deleter for {r.service}/{r.rtype}"
+        rows.append({"arn": r.arn, "service": r.service, "type": r.rtype, "id": r.rid, "region": r.region,
+                     "name": r.name, "user": None, "action": action, "rule": d.rule, "reason": reason,
+                     "state": "planned"})
+    return rows, errors
+
+
+def _summary(rows) -> Dict[str, Any]:
+    by_action = Counter(r["action"] for r in rows)
+    by_type: Dict[str, Dict[str, int]] = {}
+    for r in rows:
+        by_type.setdefault(f"{r['service']}/{r['type']}", Counter())[r["action"]] += 1
+    return {"total": len(rows), "by_action": dict(by_action), "by_type": {k: dict(v) for k, v in sorted(by_type.items())}}
+
+
+def audit(ctx: Ctx, ruleset: Optional[Dict[str, Any]], regions=None, run_id: Optional[str] = None) -> Envelope:
+    """Read-only. Lists everything and what the ruleset would do with it. No plan is created."""
+    env = Envelope(command="audit", mode="read", run_id=run_id, cohort=(ruleset or {}).get("name"))
+    try:
+        rows, errors = _decide_all(ctx, ruleset or {"version": 1, "rules": []}, regions)
+    except RulesetError as e:
+        return env.fail(f"ruleset invalid: {e}")
+    env.items, env.warnings = rows, [f"discovery error: {e}" for e in errors]
+    for i in env.items:
+        i["state"] = "listed"
+    env.summary = _summary(rows)
+    log(f"audit: {len(rows)} resources, {env.summary['by_action']}")
+    return env.finalize()
+
+
+def cleanup_plan(ctx: Ctx, ruleset: Dict[str, Any], regions=None, run_id: Optional[str] = None) -> Envelope:
+    ctx.guard_account()
+    name = ruleset.get("name", "cleanup")
+    env = Envelope(command="cleanup", mode="plan", run_id=run_id, cohort=f"cleanup:{name}")
+    try:
+        rows, errors = _decide_all(ctx, ruleset, regions)
+    except RulesetError as e:
+        return env.fail(f"ruleset invalid: {e}")
+    env.items = rows
+    env.warnings = [f"discovery error: {e}" for e in errors]
+    env.plan = build_plan(env.cohort, ctx.account_id, rows, ctx.clock())
+    env.summary = _summary(rows)
+    log(f"cleanup plan {env.plan['id']}: {env.summary['by_action']}")
+    return env

labagent/cli.py

@@ -0,0 +1,63 @@
+"""labagent command line. stdout is silent unless --output - is given; logs go to stderr (ids and counts only)."""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+import boto3
+
+from . import __version__
+from .config import STATE_BACKEND_DIR, load_config
+from .context import Ctx, GuardError
+from .envelope import Envelope
+from .run import COMMANDS, run_job
+
+
+def _emit(env: Envelope, output: str) -> None:
+    text = json.dumps(env.to_dict(), indent=2)
+    if output == "-":
+        print(text)
+    else:
+        Path(output).write_text(text)
+        Path(output).chmod(0o600)
+
+
+def main(argv=None) -> int:
+    p = argparse.ArgumentParser(prog="labagent", description=__doc__)
+    p.add_argument("--version", action="version", version=__version__)
+    p.add_argument("--config", help="JSON config file (or LABAGENT_CONFIG)")
+    p.add_argument("--profile", help="AWS profile for local use. CI uses OIDC environment credentials.")
+    sub = p.add_subparsers(dest="cmd", required=True)
+    r = sub.add_parser("run", help="Execute a job document: the CI entry point")
+    r.add_argument("--job", required=True, help="Path to job JSON (contains roster: keep it out of git and logs)")
+    r.add_argument("--output", default="result.json", help="Result envelope path, or - for stdout")
+    r.add_argument("--ruleset", help="Path to a ruleset JSON for audit/cleanup (merged into the job)")
+    sub.add_parser("bootstrap-path", help="Print the path of the packaged Terraform state-backend module")
+    sub.add_parser("commands", help="List supported job commands")
+    args = p.parse_args(argv)
+
+    if args.cmd == "bootstrap-path":
+        print(STATE_BACKEND_DIR)
+        return 0
+    if args.cmd == "commands":
+        print("\n".join(sorted(COMMANDS)))
+        return 0
+    try:
+        cfg = load_config(args.config)
+        job = json.loads(Path(args.job).read_text())
+        session = boto3.Session(profile_name=args.profile, region_name=cfg.region)
+        if getattr(args, "ruleset", None) and "ruleset" not in job:
+            job["ruleset"] = json.loads(Path(args.ruleset).read_text())
+        env = run_job(Ctx(cfg, session), job)
+    except GuardError as e:
+        env = Envelope(command="guard").fail(str(e))
+    except Exception as e:
+        env = Envelope(command="startup").fail(f"{type(e).__name__}: {str(e)[:200]}")
+    _emit(env, args.output)
+    return env.exit_code
+
+
+if __name__ == "__main__":
+    sys.exit(main())

labagent/config.py

@@ -0,0 +1,82 @@
+"""Configuration. No organization-specific value is hard-coded in the engine."""
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import dataclass, field, fields
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+MODULE_DIR = Path(__file__).parent / "terraform" / "cohort_iam"
+STATE_BACKEND_DIR = Path(__file__).parent / "terraform" / "state_backend"
+
+
+def getenv(name: str) -> Optional[str]:
+    """LABAGENT_<name>, falling back to the legacy LABCTL_<name> used before the rename."""
+    return os.environ.get(f"LABAGENT_{name}") or os.environ.get(f"LABCTL_{name}") or None
+# Keys from the earlier boto3-only design: accepted and ignored so old config files keep loading.
+LEGACY_KEYS = {"group_name", "policy_name", "lambda_role_name", "policy_file"}
+
+
+@dataclass
+class Config:
+    region: str = "us-east-1"
+    # Regions scanned for regional resources. CloudFront (global) is always read via us-east-1.
+    regions: List[str] = field(default_factory=lambda: ["us-east-1"])
+    # Tag keys
+    workshop_tag: str = "workshop"
+    autodelete_tag: str = "autodelete"
+    cohort_tag: str = "cohort"
+    date_tag: str = "date"
+    owner_tag_keys: Tuple[str, ...] = ("owner", "student", "learner_id")
+    # The workshop tag VALUE that marks lab resources, e.g. "full-stack"
+    workshop: str = "full-stack"
+    # IAM naming: each cohort gets <name_prefix>-<cohort>-students / -sandbox / -lambda-exec
+    name_prefix: str = "labs"
+    student_domain: str = "example.com"
+    # Initial console passwords: force a change at first sign-in? Set false when the LMS is the
+    # place learners read their password, so the stored value stays valid.
+    password_reset_required: bool = True
+    # Terraform: binary (terraform or tofu) and the S3 backend. Values come from config/env, never from the repo.
+    terraform_bin: Optional[str] = None
+    backend: Dict[str, Any] = field(default_factory=dict)  # bucket, region, kms_key_id, use_lockfile, key_template
+    # Safety
+    allowed_account_ids: List[str] = field(default_factory=list)
+    protected_name_prefixes: Tuple[str, ...] = (
+        "aws-cloudtrail-logs-", "aws-config-", "cf-templates-", "elasticbeanstalk-",
+        "amplify-", "cdk-", "codepipeline-", "do-not-delete-",
+    )
+    plan_max_age_s: int = 6 * 3600
+    apply_time_budget_s: int = 1500
+    password_length: int = 20
+
+    def backend_settings(self) -> Dict[str, Any]:
+        """Backend config with env overrides (so a private runner can set values as CI variables)."""
+        b = {"key_template": "cohorts/{cohort}/terraform.tfstate", "use_lockfile": True, **self.backend}
+        for env, key in (("TF_BACKEND_BUCKET", "bucket"), ("TF_BACKEND_REGION", "region"),
+                         ("TF_BACKEND_KMS_KEY_ID", "kms_key_id")):
+            if getenv(env):
+                b[key] = getenv(env)
+        return b
+
+
+def load_config(path: Optional[str] = None) -> Config:
+    """Load JSON config. Path from argument or LABAGENT_CONFIG; env LABAGENT_ALLOWED_ACCOUNTS overrides the allow-list."""
+    path = path or getenv("CONFIG")
+    raw = {}
+    if path:
+        raw = json.loads(Path(path).read_text())
+    known = {f.name for f in fields(Config)}
+    for k in LEGACY_KEYS & set(raw):
+        raw.pop(k)
+    unknown = set(raw) - known
+    if unknown:
+        raise ValueError(f"unknown config keys: {sorted(unknown)}")
+    for k in ("protected_name_prefixes", "owner_tag_keys"):
+        if k in raw:
+            raw[k] = tuple(raw[k])
+    cfg = Config(**raw)
+    env_accounts = getenv("ALLOWED_ACCOUNTS")
+    if env_accounts:
+        cfg.allowed_account_ids = [a.strip() for a in env_accounts.split(",") if a.strip()]
+    return cfg

labagent/context.py

@@ -0,0 +1,51 @@
+"""Execution context: AWS session, config, account guard, injectable sleep."""
+from __future__ import annotations
+
+import sys
+import time
+from typing import Any, Callable, Dict, Optional, Tuple
+
+import boto3
+
+from .config import Config
+
+
+class GuardError(Exception):
+    pass
+
+
+def log(msg: str) -> None:
+    """Logs go to stderr and must never contain names or emails: ids and counts only."""
+    print(msg, file=sys.stderr, flush=True)
+
+
+class Ctx:
+    def __init__(self, cfg: Config, session: Optional[boto3.Session] = None,
+                 sleep: Callable[[float], None] = time.sleep,
+                 clock: Callable[[], float] = time.time):
+        self.cfg = cfg
+        self.session = session or boto3.Session(region_name=cfg.region)
+        self.sleep = sleep
+        self.clock = clock
+        self._clients: Dict[Tuple[str, str], Any] = {}
+        self._account: Optional[str] = None
+
+    def client(self, service: str, region: Optional[str] = None):
+        key = (service, region or self.cfg.region)
+        if key not in self._clients:
+            self._clients[key] = self.session.client(service, region_name=key[1])
+        return self._clients[key]
+
+    @property
+    def account_id(self) -> str:
+        if self._account is None:
+            self._account = self.client("sts").get_caller_identity()["Account"]
+        return self._account
+
+    def guard_account(self) -> None:
+        """Refuse to run against any account that is not explicitly allowed."""
+        allowed = self.cfg.allowed_account_ids
+        if not allowed:
+            raise GuardError("allowed_account_ids is empty: refusing to run. Set it in config or LABAGENT_ALLOWED_ACCOUNTS.")
+        if self.account_id not in allowed:
+            raise GuardError("current AWS account is not in allowed_account_ids: refusing to run.")