# Path: libcloudforensics/providers/aws/internal/common.py
# EC2_SERVICE = 'ec2'
# ACCOUNT_SERVICE = 'sts'
# KMS_SERVICE = 'kms'
# CLOUDTRAIL_SERVICE = 'cloudtrail'
# S3_SERVICE = 's3'
# IAM_SERVICE = 'iam'
# INSTANCE = 'instance'
# VOLUME = 'volume'
# SNAPSHOT = 'snapshot'
# UBUNTU_1804_FILTER = 'ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-20200611'  # pylint: disable=line-too-long
# ALINUX2_BASE_FILTER = 'amzn2-ami-hvm-2*-x86_64-gp2'
# def CreateTags(resource: str, tags: Dict[str, str]) -> Dict[str, Any]:
# def GetInstanceTypeByCPU(cpu_cores: int) -> str:
# def ExecuteRequest(client: 'botocore.client.EC2',
#                    func: str,
#                    kwargs: Dict[str, Any]) -> List[Dict[str, Any]]:


from typing import TYPE_CHECKING, Dict, List, Optional, Any
from libcloudforensics.providers.aws.internal import common
  from libcloudforensics.providers.aws.internal import account  # pylint: disable=cyclic-import
  from datetime import datetime
      # qfilter = 'key,value'
      # starttime = datetime(2020,5,5,17,33,00)
      # LookupEvents(qfilter=qfilter, starttime=starttime)
      # Check documentation for qfilter details
      # https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudtrail.html#CloudTrail.Client.lookup_events

    Args:
      qfilter (string): Optional. Filter for the query including 1 key and value.
      starttime (datetime): Optional. Start datetime to add to query filter.
      endtime (datetime): Optional. End datetime to add to query filter.

    Returns:
      List[Dict]: A list of events. E.g. [{'EventId': 'id', ...},
          {'EventId': ...}]
    """

    events = []

    client = self.aws_account.ClientApi(common.CLOUDTRAIL_SERVICE)

    params = {}  # type: Dict[str, Any]
    if qfilter:
      k, v = qfilter.split(',')
      filters = [{'AttributeKey': k, 'AttributeValue': v}]
      params = {'LookupAttributes': filters}
    if starttime:
      params['StartTime'] = starttime
    if endtime:
      params['EndTime'] = endtime


# Path: libcloudforensics/providers/aws/internal/common.py
# EC2_SERVICE = 'ec2'
# ACCOUNT_SERVICE = 'sts'
# KMS_SERVICE = 'kms'
# CLOUDTRAIL_SERVICE = 'cloudtrail'
# S3_SERVICE = 's3'
# IAM_SERVICE = 'iam'
# INSTANCE = 'instance'
# VOLUME = 'volume'
# SNAPSHOT = 'snapshot'
# UBUNTU_1804_FILTER = 'ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-20200611'  # pylint: disable=line-too-long
# ALINUX2_BASE_FILTER = 'amzn2-ami-hvm-2*-x86_64-gp2'
# def CreateTags(resource: str, tags: Dict[str, str]) -> Dict[str, Any]:
# def GetInstanceTypeByCPU(cpu_cores: int) -> str:
# def ExecuteRequest(client: 'botocore.client.EC2',
#                    func: str,
#                    kwargs: Dict[str, Any]) -> List[Dict[str, Any]]:


# Path: libcloudforensics/providers/aws/internal/log.py
from typing import TYPE_CHECKING, Dict, List, Optional, Any
from libcloudforensics.providers.aws.internal import common
  from libcloudforensics.providers.aws.internal import account  # pylint: disable=cyclic-import
  from datetime import datetime

      # qfilter = 'key,value'
      # starttime = datetime(2020,5,5,17,33,00)
      # LookupEvents(qfilter=qfilter, starttime=starttime)
      # Check documentation for qfilter details
      # https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudtrail.html#CloudTrail.Client.lookup_events

    Args:
      qfilter (string): Optional. Filter for the query including 1 key and value.
      starttime (datetime): Optional. Start datetime to add to query filter.
      endtime (datetime): Optional. End datetime to add to query filter.

    Returns:
      List[Dict]: A list of events. E.g. [{'EventId': 'id', ...},
          {'EventId': ...}]
    """

    events = []

    client = self.aws_account.ClientApi(common.CLOUDTRAIL_SERVICE)

    params = {}  # type: Dict[str, Any]
    if qfilter:
      k, v = qfilter.split(',')
      filters = [{'AttributeKey': k, 'AttributeValue': v}]
      params = {'LookupAttributes': filters}
    if starttime:
      params['StartTime'] = starttime
    if endtime:
      params['EndTime'] = endtime


    responses = common.ExecuteRequest(client, 'lookup_events', params)