runbooks 1.0.0__py3-none-any.whl → 1.0.2__py3-none-any.whl

runbooks/remediation/multi_account.py

@@ -40,12 +40,9 @@ remediator = MultiAccountRemediator(
     max_workers=5
 )
 
-# Define target accounts
-accounts = [
-    AWSAccount("123456789012", "production"),
-    AWSAccount("987654321098", "staging"),
-    AWSAccount("456789012345", "development")
-]
+# Define target accounts using dynamic discovery
+# Example: Get accounts from AWS Organizations or environment configuration
+accounts = get_accounts_from_environment() or discover_organization_accounts()
 
 # Execute bulk S3 security remediation
 results = remediator.bulk_s3_security(
@@ -73,6 +70,8 @@ from loguru import logger
 
 from runbooks.inventory.models.account import AWSAccount
 from runbooks.remediation.base import BaseRemediation, RemediationContext, RemediationResult, RemediationStatus
+from runbooks.common.profile_utils import create_management_session
+from runbooks.remediation.universal_account_discovery import UniversalAccountDiscovery, AWSAccount as UniversalAWSAccount
 
 
 class MultiAccountRemediator:
@@ -167,7 +166,7 @@ class MultiAccountRemediator:
 
         try:
             # Create SSO OIDC client
-            sso_oidc = boto3.client("sso-oidc", region_name="us-east-1")
+            sso_oidc = boto3.client("sso-oidc", region_name=os.getenv("AWS_DEFAULT_REGION", "us-east-1"))
 
             # Register client
             client_creds = sso_oidc.register_client(clientName="CloudOpsRemediation", clientType="public")
@@ -567,3 +566,117 @@ class MultiAccountRemediator:
         compliance_summary["compliance_controls"] = list(compliance_summary["compliance_controls"])
 
         return compliance_summary
+
+
+# Dynamic account discovery functions for enterprise security operations
+def get_accounts_from_environment(profile: Optional[str] = None) -> Optional[List[AWSAccount]]:
+    """
+    Get AWS accounts using universal account discovery system.
+    
+    Uses enhanced discovery with support for:
+    - Environment variables (REMEDIATION_TARGET_ACCOUNTS)
+    - Configuration files (REMEDIATION_ACCOUNT_CONFIG)
+    - AWS Organizations API (automatic discovery)
+    - Current account fallback (single account mode)
+    
+    Args:
+        profile: AWS profile to use for discovery
+    
+    Returns:
+        List of AWSAccount objects or None if not configured
+    """
+    try:
+        # Use universal account discovery system
+        discovery = UniversalAccountDiscovery(profile=profile)
+        universal_accounts = discovery.discover_target_accounts()
+        
+        if not universal_accounts:
+            return None
+        
+        # Convert to legacy AWSAccount format for compatibility
+        legacy_accounts = []
+        for universal_account in universal_accounts:
+            legacy_account = AWSAccount(
+                universal_account.account_id,
+                universal_account.account_name or f"account-{universal_account.account_id}"
+            )
+            legacy_accounts.append(legacy_account)
+        
+        logger.info(f"Using {len(legacy_accounts)} accounts discovered via universal discovery system")
+        return legacy_accounts
+        
+    except Exception as e:
+        logger.warning(f"Failed to discover accounts using universal discovery: {e}")
+        return None
+
+
+def discover_organization_accounts(profile: Optional[str] = None) -> List[AWSAccount]:
+    """
+    Discover AWS accounts using universal discovery system.
+    
+    Enhanced to use the universal account discovery system which provides:
+    - Organizations API discovery (if available)
+    - Environment variable fallback
+    - Configuration file support
+    - Current account fallback
+    
+    Args:
+        profile: AWS profile for discovery (universal profile management)
+        
+    Returns:
+        List of discovered AWSAccount objects
+    """
+    try:
+        # Use universal account discovery system for Organizations discovery
+        discovery = UniversalAccountDiscovery(profile=profile)
+        universal_accounts = discovery._get_accounts_from_organizations()
+        
+        if not universal_accounts:
+            # Fallback to other discovery methods
+            logger.info("Organizations API not available, trying other discovery methods...")
+            universal_accounts = discovery.discover_target_accounts()
+        
+        # Convert to legacy AWSAccount format for compatibility
+        legacy_accounts = []
+        for universal_account in universal_accounts:
+            if universal_account.status == "ACTIVE":
+                legacy_account = AWSAccount(
+                    universal_account.account_id,
+                    universal_account.account_name or f"org-account-{universal_account.account_id}"
+                )
+                legacy_accounts.append(legacy_account)
+        
+        logger.info(f"Discovered {len(legacy_accounts)} active AWS accounts via universal discovery")
+        return legacy_accounts
+        
+    except Exception as e:
+        logger.warning(f"Failed to discover organization accounts: {e}")
+        # Universal discovery handles all fallback scenarios
+        return []
+
+
+def _determine_account_environment(account_name: str) -> str:
+    """
+    Determine account environment based on account name patterns.
+    
+    Args:
+        account_name: AWS account name
+        
+    Returns:
+        Environment classification
+    """
+    name_lower = account_name.lower()
+    
+    # Common environment patterns
+    if any(env in name_lower for env in ["prod", "production"]):
+        return "production"
+    elif any(env in name_lower for env in ["staging", "stage", "uat"]):
+        return "staging"  
+    elif any(env in name_lower for env in ["dev", "development"]):
+        return "development"
+    elif any(env in name_lower for env in ["test", "testing"]):
+        return "testing"
+    elif any(env in name_lower for env in ["sandbox", "sb"]):
+        return "sandbox"
+    else:
+        return "unknown"