<commit_before># Copyright 2017-2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"). You may
# not use this file except in compliance with the License. A copy of the License is located at
#
#        http://aws.amazon.com/apache2.0/
#
# or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for
# the specific language governing permissions and limitations under the License.
"""
Rule Name:
  SHIELD_DRT_ACCESS

Description:
  Verify that DRT can access the AWS account

Trigger:
  Periodic

Reports on:
  AWS::::Account

Scenarios:
 Scenario: 1
    Given: AWS Shield Advanced is not enabled
    Then: Return NOT_APPLICABLE
  Scenario: 2
    Given: AWS Shield Advanced is enabled
    And: Role for DRT access is not configured
    Then: Return NON_COMPLIANT with annotation "DRT team does not have access to account."
  Scenario: 3
    Given: AWS Shield Advanced is enabled
    And: Role for DRT access is configured
    Then: Return COMPLIANT
"""

import json
import sys
import datetime
import boto3
import botocore

try:
    import liblogging
except ImportError:
    pass

##############
# Parameters #
##############

# Define the default resource to report to Config Rules
DEFAULT_RESOURCE_TYPE = 'AWS::::Account'

# Set to True to get the lambda to assume the Role attached on the Config Service (useful for cross-account).
ASSUME_ROLE_MODE = False

# Other parameters (no change needed)
CONFIG_ROLE_TIMEOUT_SECONDS = 900

#############
# Main Code #
#############
def drt_access_check(client):
    try:
        return client.describe_drt_access()
    except botocore.exceptions.ClientError as error:
        return error.response['Error']['Code']

def evaluate_compliance(event, configuration_item, valid_rule_parameters):
    drt_access_enabled = drt_access_check(get_client('shield', event))
    if drt_access_enabled == 'ResourceNotFoundException':
        return build_evaluation(event['accountId'],
                                'NOT_APPLICABLE',
                                event,
                                annotation='AWS Shield Advanced is not enabled.')
    if 'RoleArn' in drt_access_enabled:
        return build_evaluation(event['accountId'],
                                'COMPLIANT',
                                event)
    return build_evaluation(event['accountId'],
                            'NON_COMPLIANT',
                            event,annotation='DRT team does not have access to account.')

def evaluate_parameters(rule_parameters):
    
    valid_rule_parameters = rule_parameters
    return valid_rule_parameters

####################
# Helper Functions #
####################

# Build an error to be displayed in the logs when the parameter is invalid.<commit_msg>Update SHIELD_DRT_ACCESS.py<commit_after># Copyright 2017-2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"). You may
# not use this file except in compliance with the License. A copy of the License is located at
#
#        http://aws.amazon.com/apache2.0/
#
# or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for
# the specific language governing permissions and limitations under the License.
"""
Rule Name:
  SHIELD_DRT_ACCESS

Description:
  Verify that DRT can access the AWS account

Trigger:
  Periodic

Reports on:
  AWS::::Account

Scenarios:
 Scenario: 1
    Given: AWS Shield Advanced is not enabled
    Then: Return NOT_APPLICABLE
  Scenario: 2
    Given: AWS Shield Advanced is enabled
    And: Role for DRT access is not configured
    Then: Return NON_COMPLIANT with annotation "DRT team does not have access to account."
  Scenario: 3
    Given: AWS Shield Advanced is enabled
    And: Role for DRT access is configured
    Then: Return COMPLIANT
"""

import json
import sys
import datetime
import boto3
import botocore

try:
    import liblogging
except ImportError:
    pass

##############
# Parameters #
##############

# Define the default resource to report to Config Rules
DEFAULT_RESOURCE_TYPE = 'AWS::::Account'

# Set to True to get the lambda to assume the Role attached on the Config Service (useful for cross-account).
ASSUME_ROLE_MODE = False

# Other parameters (no change needed)
CONFIG_ROLE_TIMEOUT_SECONDS = 900

#############
# Main Code #
#############
def drt_access_check(client):
    try:
        return client.describe_drt_access()
    except botocore.exceptions.ClientError as error:
        return error.response['Error']['Code']

def evaluate_compliance(event, configuration_item, valid_rule_parameters):
    drt_access_enabled = drt_access_check(get_client('shield', event))
    if drt_access_enabled == 'ResourceNotFoundException':
        return build_evaluation(event['accountId'],
                                'NOT_APPLICABLE',
                                event,
                                annotation='AWS Shield Advanced is not enabled.')
    if 'RoleArn' in drt_access_enabled:
        return build_evaluation(event['accountId'],
                                'COMPLIANT',
                                event)
    return build_evaluation(event['accountId'],
                            'NON_COMPLIANT',
                            event, annotation='DRT team does not have access to account.')

def evaluate_parameters(rule_parameters):
    
    valid_rule_parameters = rule_parameters
    return valid_rule_parameters

####################
# Helper Functions #
####################

# Build an error to be displayed in the logs when the parameter is invalid.
{'fraction_non_alphanumeric': 0.09531116794543905, 'fraction_numerical': 0.006479113384484228, 'mean_word_length': 3.11938202247191, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '519512', 'n_tokens_mistral': 1607, 'n_tokens_neox': 1543, 'n_words': 581}