import boto3
import json
import logging
import asyncio
from datetime import datetime, timedelta
from typing import Dict, List, Optional, Any
from dataclasses import dataclass, asdict
from enum import Enum
import hashlib
import base64

class EncryptionType(Enum):
    AES256 = "AES256"
    KMS = "aws:kms"
    KMS_MANAGED = "aws:kms:managed"

class AccessLevel(Enum):
    READ_ONLY = "read_only"
    BACKUP_OPERATOR = "backup_operator"
    BACKUP_ADMIN = "backup_admin"
    FULL_ACCESS = "full_access"

@dataclass
class BackupSecurityPolicy:
    policy_id: str
    name: str
    encryption_type: EncryptionType
    kms_key_id: Optional[str]
    access_controls: List[Dict[str, Any]]
    audit_logging_enabled: bool
    integrity_checking_enabled: bool
    cross_region_replication_encrypted: bool
    retention_encryption_required: bool

@dataclass
class BackupSecurityEvent:
    event_id: str
    event_type: str
    resource_arn: str
    principal: str
    action: str
    timestamp: datetime
    source_ip: str
    user_agent: str
    success: bool
    error_message: Optional[str]

class BackupSecurityManager:
    """Comprehensive backup security and encryption management system"""
    
    def __init__(self, config: Dict[str, Any]):
        self.config = config
        
        # AWS clients
        self.kms = boto3.client('kms')
        self.iam = boto3.client('iam')
        self.s3 = boto3.client('s3')
        self.backup = boto3.client('backup')
        self.cloudtrail = boto3.client('cloudtrail')
        self.dynamodb = boto3.resource('dynamodb')
        self.sns = boto3.client('sns')
        self.cloudwatch = boto3.client('cloudwatch')
        
        # Storage
        self.security_policies_table = self.dynamodb.Table(config.get('security_policies_table', 'backup-security-policies'))
        self.security_events_table = self.dynamodb.Table(config.get('security_events_table', 'backup-security-events'))
        
        # Configuration
        self.default_kms_key_id = config.get('default_kms_key_id')
        self.audit_trail_name = config.get('audit_trail_name', 'backup-audit-trail')
        
    async def create_backup_encryption_keys(self, key_configs: List[Dict[str, Any]]) -> List[str]:
        """Create KMS keys for backup encryption"""
        try:
            created_keys = []
            
            for key_config in key_configs:
                # Create KMS key
                key_policy = self._generate_backup_key_policy(key_config)
                
                response = self.kms.create_key(
                    Policy=json.dumps(key_policy),
                    Description=key_config.get('description', 'Backup encryption key'),
                    Usage='ENCRYPT_DECRYPT',
                    KeySpec='SYMMETRIC_DEFAULT'
                )
                
                key_id = response['KeyMetadata']['KeyId']
                key_arn = response['KeyMetadata']['Arn']
                
                # Create key alias
                alias_name = f"alias/backup-{key_config['name']}"
                self.kms.create_alias(
                    AliasName=alias_name,
                    TargetKeyId=key_id
                )
                
                # Tag the key
                tags = [
                    {'TagKey': 'Purpose', 'TagValue': 'BackupEncryption'},
                    {'TagKey': 'Environment', 'TagValue': key_config.get('environment', 'production')},
                    {'TagKey': 'DataClassification', 'TagValue': key_config.get('data_classification', 'standard')}
                ]
                
                self.kms.tag_resource(KeyId=key_id, Tags=tags)
                
                created_keys.append(key_arn)
                logging.info(f"Created backup encryption key: {alias_name}")
            
            return created_keys
            
        except Exception as e:
            logging.error(f"Failed to create backup encryption keys: {str(e)}")
            raise
    
    def _generate_backup_key_policy(self, key_config: Dict[str, Any]) -> Dict[str, Any]:
        """Generate KMS key policy for backup encryption"""
        account_id = boto3.client('sts').get_caller_identity()['Account']
        
        policy = {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "Enable IAM User Permissions",
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": f"arn:aws:iam::{account_id}:root"
                    },
                    "Action": "kms:*",
                    "Resource": "*"
                },
                {
                    "Sid": "Allow AWS Backup Service",
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "backup.amazonaws.com"
                    },
                    "Action": [
                        "kms:Decrypt",
                        "kms:GenerateDataKey",
                        "kms:ReEncrypt*",
                        "kms:CreateGrant",
                        "kms:DescribeKey"
                    ],
                    "Resource": "*",
                    "Condition": {
                        "StringEquals": {
                            "kms:ViaService": [
                                f"s3.{boto3.Session().region_name}.amazonaws.com",
                                f"dynamodb.{boto3.Session().region_name}.amazonaws.com",
                                f"rds.{boto3.Session().region_name}.amazonaws.com"
                            ]
                        }
                    }
                },
                {
                    "Sid": "Allow Backup Administrators",
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": key_config.get('backup_admin_roles', [])
                    },
                    "Action": [
                        "kms:Decrypt",
                        "kms:GenerateDataKey",
                        "kms:ReEncrypt*",
                        "kms:DescribeKey"
                    ],
                    "Resource": "*"
                }
            ]
        }
        
        return policy
    
    async def configure_s3_backup_encryption(self, bucket_name: str, kms_key_id: str) -> bool:
        """Configure S3 bucket encryption for backups"""
        try:
            # Configure bucket encryption
            encryption_config = {
                'Rules': [
                    {
                        'ApplyServerSideEncryptionByDefault': {
                            'SSEAlgorithm': 'aws:kms',
                            'KMSMasterKeyID': kms_key_id
                        },
                        'BucketKeyEnabled': True
                    }
                ]
            }
            
            self.s3.put_bucket_encryption(
                Bucket=bucket_name,
                ServerSideEncryptionConfiguration=encryption_config
            )
            
            # Configure bucket policy for secure access
            bucket_policy = self._generate_backup_bucket_policy(bucket_name, kms_key_id)
            
            self.s3.put_bucket_policy(
                Bucket=bucket_name,
                Policy=json.dumps(bucket_policy)
            )
            
            # Enable bucket versioning for backup integrity
            self.s3.put_bucket_versioning(
                Bucket=bucket_name,
                VersioningConfiguration={'Status': 'Enabled'}
            )
            
            # Configure bucket logging
            logging_config = {
                'LoggingEnabled': {
                    'TargetBucket': f"{bucket_name}-access-logs",
                    'TargetPrefix': 'access-logs/'
                }
            }
            
            self.s3.put_bucket_logging(
                Bucket=bucket_name,
                BucketLoggingStatus=logging_config
            )
            
            logging.info(f"Configured S3 backup encryption for bucket: {bucket_name}")
            return True
            
        except Exception as e:
            logging.error(f"Failed to configure S3 backup encryption: {str(e)}")
            return False
    
    def _generate_backup_bucket_policy(self, bucket_name: str, kms_key_id: str) -> Dict[str, Any]:
        """Generate S3 bucket policy for backup security"""
        account_id = boto3.client('sts').get_caller_identity()['Account']
        
        policy = {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "DenyUnencryptedObjectUploads",
                    "Effect": "Deny",
                    "Principal": "*",
                    "Action": "s3:PutObject",
                    "Resource": f"arn:aws:s3:::{bucket_name}/*",
                    "Condition": {
                        "StringNotEquals": {
                            "s3:x-amz-server-side-encryption": "aws:kms"
                        }
                    }
                },
                {
                    "Sid": "DenyInsecureConnections",
                    "Effect": "Deny",
                    "Principal": "*",
                    "Action": "s3:*",
                    "Resource": [
                        f"arn:aws:s3:::{bucket_name}",
                        f"arn:aws:s3:::{bucket_name}/*"
                    ],
                    "Condition": {
                        "Bool": {
                            "aws:SecureTransport": "false"
                        }
                    }
                },
                {
                    "Sid": "AllowBackupServiceAccess",
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "backup.amazonaws.com"
                    },
                    "Action": [
                        "s3:GetObject",
                        "s3:PutObject",
                        "s3:DeleteObject",
                        "s3:GetObjectVersion",
                        "s3:ListBucket"
                    ],
                    "Resource": [
                        f"arn:aws:s3:::{bucket_name}",
                        f"arn:aws:s3:::{bucket_name}/*"
                    ]
                }
            ]
        }
        
        return policy
    
    async def create_backup_access_roles(self, role_configs: List[Dict[str, Any]]) -> List[str]:
        """Create IAM roles for backup access with appropriate permissions"""
        try:
            created_roles = []
            
            for role_config in role_configs:
                role_name = role_config['role_name']
                access_level = AccessLevel(role_config['access_level'])
                
                # Create trust policy
                trust_policy = {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "AWS": role_config.get('trusted_principals', [])
                            },
                            "Action": "sts:AssumeRole",
                            "Condition": {
                                "Bool": {
                                    "aws:MultiFactorAuthPresent": "true"
                                }
                            }
                        }
                    ]
                }
                
                # Create role
                role_response = self.iam.create_role(
                    RoleName=role_name,
                    AssumeRolePolicyDocument=json.dumps(trust_policy),
                    Description=f"Backup access role with {access_level.value} permissions",
                    Tags=[
                        {'Key': 'Purpose', 'Value': 'BackupAccess'},
                        {'Key': 'AccessLevel', 'Value': access_level.value}
                    ]
                )
                
                role_arn = role_response['Role']['Arn']
                
                # Create and attach policy based on access level
                policy_document = self._generate_backup_access_policy(access_level, role_config)
                policy_name = f"{role_name}-policy"
                
                policy_response = self.iam.create_policy(
                    PolicyName=policy_name,
                    PolicyDocument=json.dumps(policy_document),
                    Description=f"Backup access policy for {access_level.value}"
                )
                
                # Attach policy to role
                self.iam.attach_role_policy(
                    RoleName=role_name,
                    PolicyArn=policy_response['Policy']['Arn']
                )
                
                created_roles.append(role_arn)
                logging.info(f"Created backup access role: {role_name}")
            
            return created_roles
            
        except Exception as e:
            logging.error(f"Failed to create backup access roles: {str(e)}")
            raise
    
    def _generate_backup_access_policy(self, access_level: AccessLevel, 
                                     role_config: Dict[str, Any]) -> Dict[str, Any]:
        """Generate IAM policy based on access level"""
        base_policy = {
            "Version": "2012-10-17",
            "Statement": []
        }
        
        if access_level == AccessLevel.READ_ONLY:
            base_policy["Statement"].extend([
                {
                    "Effect": "Allow",
                    "Action": [
                        "backup:DescribeBackupJob",
                        "backup:DescribeBackupVault",
                        "backup:GetBackupPlan",
                        "backup:GetBackupSelection",
                        "backup:ListBackupJobs",
                        "backup:ListBackupPlans",
                        "backup:ListBackupSelections",
                        "backup:ListBackupVaults",
                        "backup:ListRecoveryPoints"
                    ],
                    "Resource": "*"
                }
            ])
        
        elif access_level == AccessLevel.BACKUP_OPERATOR:
            base_policy["Statement"].extend([
                {
                    "Effect": "Allow",
                    "Action": [
                        "backup:StartBackupJob",
                        "backup:StopBackupJob",
                        "backup:StartRestoreJob",
                        "backup:DescribeBackupJob",
                        "backup:DescribeRestoreJob",
                        "backup:ListBackupJobs",
                        "backup:ListRestoreJobs"
                    ],
                    "Resource": "*"
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "kms:Decrypt",
                        "kms:GenerateDataKey"
                    ],
                    "Resource": role_config.get('allowed_kms_keys', [])
                }
            ])
        
        elif access_level == AccessLevel.BACKUP_ADMIN:
            base_policy["Statement"].extend([
                {
                    "Effect": "Allow",
                    "Action": [
                        "backup:*"
                    ],
                    "Resource": "*"
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "kms:*"
                    ],
                    "Resource": role_config.get('allowed_kms_keys', [])
                }
            ])
        
        return base_policy
    
    async def setup_backup_audit_logging(self) -> bool:
        """Set up comprehensive audit logging for backup operations"""
        try:
            # Create CloudTrail for backup API logging
            trail_config = {
                'Name': self.audit_trail_name,
                'S3BucketName': f"{self.audit_trail_name}-logs",
                'IncludeGlobalServiceEvents': True,
                'IsMultiRegionTrail': True,
                'EnableLogFileValidation': True,
                'EventSelectors': [
                    {
                        'ReadWriteType': 'All',
                        'IncludeManagementEvents': True,
                        'DataResources': [
                            {
                                'Type': 'AWS::Backup::BackupVault',
                                'Values': ['arn:aws:backup:*:*:backup-vault/*']
                            },
                            {
                                'Type': 'AWS::S3::Object',
                                'Values': ['arn:aws:s3:::*backup*/*']
                            }
                        ]
                    }
                ]
            }
            
            self.cloudtrail.create_trail(**trail_config)
            self.cloudtrail.start_logging(Name=self.audit_trail_name)
            
            # Set up CloudWatch log group for backup events
            log_group_name = '/aws/backup/audit'
            
            # Create custom metrics for backup security events
            await self._create_backup_security_metrics()
            
            logging.info("Set up backup audit logging successfully")
            return True
            
        except Exception as e:
            logging.error(f"Failed to set up backup audit logging: {str(e)}")
            return False
    
    async def _create_backup_security_metrics(self):
        """Create CloudWatch metrics for backup security monitoring"""
        try:
            # Create metric filters for security events
            security_metrics = [
                {
                    'metric_name': 'UnauthorizedBackupAccess',
                    'filter_pattern': '[timestamp, request_id, event_name="AssumeRole", error_code="AccessDenied"]'
                },
                {
                    'metric_name': 'BackupEncryptionFailures',
                    'filter_pattern': '[timestamp, request_id, event_name="StartBackupJob", error_code="KMSKeyNotFound"]'
                },
                {
                    'metric_name': 'BackupIntegrityFailures',
                    'filter_pattern': '[timestamp, request_id, event_name="DescribeBackupJob", backup_status="FAILED"]'
                }
            ]
            
            for metric in security_metrics:
                self.cloudwatch.put_metric_data(
                    Namespace='BackupSecurity',
                    MetricData=[
                        {
                            'MetricName': metric['metric_name'],
                            'Value': 0,
                            'Unit': 'Count'
                        }
                    ]
                )
            
        except Exception as e:
            logging.error(f"Failed to create backup security metrics: {str(e)}")
    
    async def validate_backup_integrity(self, backup_arn: str) -> Dict[str, Any]:
        """Validate backup integrity and encryption"""
        try:
            # Get backup details
            backup_details = self.backup.describe_recovery_point(
                BackupVaultName=backup_arn.split('/')[-2],
                RecoveryPointArn=backup_arn
            )
            
            validation_results = {
                'backup_arn': backup_arn,
                'validation_time': datetime.utcnow().isoformat(),
                'encryption_validated': False,
                'integrity_validated': False,
                'access_controls_validated': False,
                'issues': []
            }
            
            # Validate encryption
            if backup_details.get('EncryptionKeyArn'):
                validation_results['encryption_validated'] = True
            else:
                validation_results['issues'].append('Backup is not encrypted')
            
            # Validate backup status
            if backup_details.get('Status') == 'COMPLETED':
                validation_results['integrity_validated'] = True
            else:
                validation_results['issues'].append(f"Backup status is {backup_details.get('Status')}")
            
            # Store validation results
            await self._store_validation_results(validation_results)
            
            return validation_results
            
        except Exception as e:
            logging.error(f"Failed to validate backup integrity: {str(e)}")
            return {'error': str(e)}
    
    async def _store_validation_results(self, results: Dict[str, Any]):
        """Store backup validation results"""
        try:
            self.security_events_table.put_item(Item=results)
        except Exception as e:
            logging.error(f"Failed to store validation results: {str(e)}")
    
    async def monitor_backup_security_events(self) -> List[BackupSecurityEvent]:
        """Monitor and analyze backup security events"""
        try:
            # Query recent security events
            end_time = datetime.utcnow()
            start_time = end_time - timedelta(hours=24)
            
            # This would typically query CloudTrail logs
            # For now, we'll return a placeholder
            events = []
            
            # Analyze events for security issues
            security_issues = []
            
            for event in events:
                if self._is_security_event(event):
                    security_issues.append(event)
            
            # Send alerts for critical security events
            if security_issues:
                await self._send_security_alerts(security_issues)
            
            return events
            
        except Exception as e:
            logging.error(f"Failed to monitor backup security events: {str(e)}")
            return []
    
    def _is_security_event(self, event: Dict[str, Any]) -> bool:
        """Determine if an event is a security concern"""
        security_indicators = [
            'AccessDenied',
            'UnauthorizedOperation',
            'KMSKeyNotFound',
            'EncryptionFailure'
        ]
        
        return any(indicator in str(event) for indicator in security_indicators)
    
    async def _send_security_alerts(self, security_events: List[Dict[str, Any]]):
        """Send security alerts for backup issues"""
        try:
            alert_message = {
                'alert_type': 'backup_security_issue',
                'timestamp': datetime.utcnow().isoformat(),
                'event_count': len(security_events),
                'events': security_events[:5]  # Include first 5 events
            }
            
            topic_arn = self.config.get('security_alert_topic_arn')
            if topic_arn:
                self.sns.publish(
                    TopicArn=topic_arn,
                    Message=json.dumps(alert_message, indent=2),
                    Subject='Backup Security Alert'
                )
            
        except Exception as e:
            logging.error(f"Failed to send security alerts: {str(e)}")

# Usage example
async def main():
    config = {
        'security_policies_table': 'backup-security-policies',
        'security_events_table': 'backup-security-events',
        'default_kms_key_id': 'alias/backup-encryption-key',
        'audit_trail_name': 'backup-audit-trail',
        'security_alert_topic_arn': 'arn:aws:sns:us-east-1:123456789012:backup-security-alerts'
    }
    
    # Initialize backup security manager
    security_manager = BackupSecurityManager(config)
    
    # Create encryption keys
    key_configs = [
        {
            'name': 'critical-data',
            'description': 'Encryption key for critical data backups',
            'environment': 'production',
            'data_classification': 'critical',
            'backup_admin_roles': ['arn:aws:iam::123456789012:role/BackupAdmin']
        }
    ]
    
    encryption_keys = await security_manager.create_backup_encryption_keys(key_configs)
    print(f"Created {len(encryption_keys)} encryption keys")
    
    # Configure S3 backup encryption
    bucket_name = 'my-backup-bucket'
    encryption_configured = await security_manager.configure_s3_backup_encryption(
        bucket_name, 
        encryption_keys[0]
    )
    print(f"S3 encryption configured: {encryption_configured}")
    
    # Create backup access roles
    role_configs = [
        {
            'role_name': 'BackupOperator',
            'access_level': 'backup_operator',
            'trusted_principals': ['arn:aws:iam::123456789012:user/backup-user'],
            'allowed_kms_keys': encryption_keys
        }
    ]
    
    access_roles = await security_manager.create_backup_access_roles(role_configs)
    print(f"Created {len(access_roles)} access roles")
    
    # Set up audit logging
    audit_configured = await security_manager.setup_backup_audit_logging()
    print(f"Audit logging configured: {audit_configured}")

if __name__ == "__main__":
    import asyncio
    asyncio.run(main())