{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::prod-app-data/*",
        "arn:aws:s3:::prod-app-data"
      ]
    }
  ]
}

import boto3

def create_iam_role_with_policy(role_name, policy_document):
    """
    Crear un rol IAM con política personalizada
    """
    iam = boto3.client('iam')
    
    # Crear el rol
    trust_policy = {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Service": "ec2.amazonaws.com"
                },
                "Action": "sts:AssumeRole"
            }
        ]
    }
    
    response = iam.create_role(
        RoleName=role_name,
        AssumeRolePolicyDocument=json.dumps(trust_policy),
        Description='Rol para aplicación DevOps',
        MaxSessionDuration=3600
    )
    
    # Adjuntar política
    iam.put_role_policy(
        RoleName=role_name,
        PolicyName=f"{role_name}-policy",
        PolicyDocument=json.dumps(policy_document)
    )
    
    return response['Role']['Arn']

# Script PowerShell para gestión de grupos en Azure AD
Connect-AzureAD

# Crear grupo de seguridad
$group = New-AzureADGroup -DisplayName "DevOps-Engineers" `
    -MailEnabled $false `
    -SecurityEnabled $true `
    -MailNickName "DevOpsEngineers"

# Asignar usuarios al grupo
$users = Get-AzureADUser -Filter "Department eq 'Engineering'"
foreach ($user in $users) {
    Add-AzureADGroupMember -ObjectId $group.ObjectId `
        -RefObjectId $user.ObjectId
}

# Asignar rol al grupo
$roleDefinition = Get-AzureADDirectoryRole | Where-Object {
    $_.DisplayName -eq "Application Administrator"
}

Add-AzureADDirectoryRoleMember -ObjectId $roleDefinition.ObjectId `
    -RefObjectId $group.ObjectId

# ClusterRole para desarrolladores
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: developer-role
rules:
- apiGroups: ["apps", "extensions"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch", "create", "update", "patch"]
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/log", "pods/exec"]
  verbs: ["get", "create"]

---
# RoleBinding para namespace específico
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developer-binding
  namespace: development
subjects:
- kind: Group
  name: developers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: developer-role
  apiGroup: rbac.authorization.k8s.io

import ldap3
from ldap3 import Server, Connection, ALL

class LDAPManager:
    def __init__(self, server_url, base_dn):
        self.server = Server(server_url, get_info=ALL)
        self.base_dn = base_dn
        
    def authenticate_user(self, username, password):
        """
        Autenticar usuario contra LDAP
        """
        user_dn = f"uid={username},ou=users,{self.base_dn}"
        try:
            conn = Connection(self.server, user_dn, password, auto_bind=True)
            return True
        except ldap3.core.exceptions.LDAPBindError:
            return False
    
    def get_user_groups(self, username):
        """
        Obtener grupos del usuario
        """
        conn = Connection(self.server, auto_bind=True)
        search_filter = f"(&(objectClass=groupOfNames)(member=uid={username},ou=users,{self.base_dn}))"
        
        conn.search(
            search_base=f"ou=groups,{self.base_dn}",
            search_filter=search_filter,
            attributes=['cn']
        )
        
        return [entry.cn.value for entry in conn.entries]
    
    def provision_user_access(self, username):
        """
        Provisionar accesos basado en grupos LDAP
        """
        groups = self.get_user_groups(username)
        permissions = []
        
        # Mapear grupos LDAP a permisos
        group_permission_map = {
            'developers': ['read-repos', 'deploy-dev'],
            'sre-team': ['read-metrics', 'manage-infra'],
            'security': ['audit-logs', 'manage-policies']
        }
        
        for group in groups:
            if group in group_permission_map:
                permissions.extend(group_permission_map[group])
        
        return permissions

# Configuración de Vault para credenciales dinámicas de base de datos
resource "vault_database_secret_backend_connection" "postgres" {
  backend       = vault_mount.database.path
  name          = "postgres"
  allowed_roles = ["dev", "prod"]

  postgresql {
    connection_url = "postgresql://{{username}}:{{password}}@postgres:5432/myapp"
    username       = var.db_admin_user
    password       = var.db_admin_password
  }

resource "vault_database_secret_backend_role" "dev" {
  backend               = vault_mount.database.path
  name                  = "dev"
  db_name              = vault_database_secret_backend_connection.postgres.name
  creation_statements  = [
    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
    "GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"
  ]
  default_ttl          = 3600
  max_ttl             = 86400
}

// Configuración de Auth0 con Node.js
const express = require('express');
const { auth, requiresAuth } = require('express-openid-connect');

const app = express();

const config = {
  authRequired: false,
  auth0Logout: true,
  secret: process.env.SESSION_SECRET,
  baseURL: 'https://app.company.com',
  clientID: process.env.AUTH0_CLIENT_ID,
  issuerBaseURL: 'https://company.auth0.com',
  authorizationParams: {
    response_type: 'code',
    scope: 'openid profile email groups'
  }
};

app.use(auth(config));

// Middleware para verificar permisos
const checkPermission = (permission) => {
  return (req, res, next) => {
    const userGroups = req.oidc.user?.groups || [];
    const hasPermission = userGroups.some(group => 
      groupPermissions[group]?.includes(permission)
    );
    
    if (hasPermission) {
      next();
    } else {
      res.status(403).json({ error: 'Insufficient permissions' });
    }
  };
};

// Rutas protegidas
app.get('/api/deployments', 
  requiresAuth(), 
  checkPermission('view-deployments'),
  (req, res) => {
    res.json({ deployments: getDeployments() });
  }
);

import time
import hashlib
from datetime import datetime, timedelta

class PAMSystem:
    def __init__(self):
        self.sessions = {}
        self.audit_log = []
    
    def request_privileged_access(self, user_id, resource, reason, duration_hours=1):
        """
        Solicitar acceso privilegiado temporal
        """
        request_id = hashlib.sha256(
            f"{user_id}{resource}{time.time()}".encode()
        ).hexdigest()[:8]
        
        request = {
            'id': request_id,
            'user_id': user_id,
            'resource': resource,
            'reason': reason,
            'requested_at': datetime.now(),
            'expires_at': datetime.now() + timedelta(hours=duration_hours),
            'status': 'pending',
            'approver': None
        }
        
        # Enviar notificación para aprobación
        self._notify_approvers(request)
        
        return request_id
    
    def approve_access(self, request_id, approver_id):
        """
        Aprobar solicitud de acceso
        """
        if request_id not in self.sessions:
            return False
        
        session = self.sessions[request_id]
        session['status'] = 'approved'
        session['approver'] = approver_id
        session['approved_at'] = datetime.now()
        
        # Generar credenciales temporales
        temp_credentials = self._generate_temp_credentials(
            session['user_id'],
            session['resource'],
            session['expires_at']
        )
        
        # Registrar en audit log
        self.audit_log.append({
            'action': 'access_granted',
            'user': session['user_id'],
            'resource': session['resource'],
            'approver': approver_id,
            'timestamp': datetime.now()
        })
        
        return temp_credentials
    
    def _generate_temp_credentials(self, user_id, resource, expiry):
        """
        Generar credenciales temporales
        """
        # Implementación específica según el recurso
        if resource.startswith('database:'):
            return self._create_db_user(user_id, expiry)
        elif resource.startswith('server:'):
            return self._create_ssh_key(user_id, expiry)
        elif resource.startswith('cloud:'):
            return self._create_cloud_token(user_id, expiry)

class ZeroTrustGateway:
    def verify_access(self, user, resource, context):
        """
        Verificación continua de acceso Zero Trust
        """
        checks = [
            self.verify_identity(user),
            self.verify_device(context['device_id']),
            self.verify_location(context['ip_address']),
            self.verify_behavior(user, resource),
            self.verify_risk_score(user, context)
        ]
        
        return all(checks)

#!/bin/bash
# Script para rotación automática de credenciales

rotate_service_account_keys() {
    local service_account=$1
    
    # Crear nueva clave
    gcloud iam service-accounts keys create new-key.json \
        --iam-account="${service_account}"
    
    # Actualizar en Vault
    vault kv put secret/service-accounts/${service_account} \
        key=@new-key.json
    
    # Eliminar clave antigua después de período de gracia
    sleep 3600
    old_key_id=$(gcloud iam service-accounts keys list \
        --iam-account="${service_account}" \
        --filter="created<-P7D" \
        --format="value(name)")
    
    if [ ! -z "$old_key_id" ]; then
        gcloud iam service-accounts keys delete "$old_key_id" \
            --iam-account="${service_account}" --quiet
    fi
}

# Terraform workspace para segregación
terraform {
  backend "s3" {
    bucket = "terraform-state"
    key    = "iam/${terraform.workspace}/state.tfstate"
    region = "us-east-1"
  }

locals {
  environment = terraform.workspace
  
  # Políticas específicas por ambiente
  policies = {
    dev = {
      max_session_duration = 12
      mfa_required = false
      ip_restrictions = []
    }
    staging = {
      max_session_duration = 8
      mfa_required = true
      ip_restrictions = ["10.0.0.0/8"]
    }
    prod = {
      max_session_duration = 4
      mfa_required = true
      ip_restrictions = ["10.0.0.0/8", "172.16.0.0/12"]
    }
  }
}

class MultiCloudIdentityBroker:
    def __init__(self):
        self.providers = {
            'aws': AWSIdentityProvider(),
            'azure': AzureIdentityProvider(),
            'gcp': GCPIdentityProvider()
        }
    
    def federate_identity(self, corporate_identity, target_clouds):
        """
        Federar identidad corporativa a múltiples clouds
        """
        federated_identities = {}
        
        for cloud in target_clouds:
            provider = self.providers[cloud]
            
            # Mapear roles corporativos a roles cloud
            cloud_roles = self.map_corporate_to_cloud_roles(
                corporate_identity.roles,
                cloud
            )
            
            # Crear identidad federada
            federated_id = provider.create_federated_identity(
                corporate_identity.email,
                cloud_roles,
                corporate_identity.attributes
            )
            
            federated_identities[cloud] = federated_id
        
        return federated_identities

class JITAccessManager:
    def grant_temporary_access(self, request):
        """
        Otorgar acceso temporal Just-In-Time
        """
        # Validar solicitud
        if not self.validate_request(request):
            raise ValueError("Invalid access request")
        
        # Crear acceso temporal
        access_token = {
            'user': request.user,
            'resource': request.resource,
            'permissions': request.permissions,
            'granted_at': datetime.now(),
            'expires_at': datetime.now() + timedelta(minutes=request.duration),
            'session_id': generate_session_id()
        }
        
        # Provisionar acceso
        self.provision_access(access_token)
        
        # Programar revocación automática
        schedule_task(
            self.revoke_access,
            access_token,
            delay=request.duration * 60
        )
        
        return access_token