The Fine Print

from crewai import Agent, Task, Crew
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(model="gpt-4-turbo", temperature=0)
analyzer_agent = Agent(
    role='CloudTrail Log Analyzer',
    goal='Determine exactly which API calls a specific IAM role has made in the last 90 days.',
    backstory='Data-driven analyst who maps usage to precise API endpoints.',
    verbose=True,
    llm=llm
)
architect_agent = Agent(
    role='IAM Policy Architect',
    goal='Write a strict AWS IAM JSON policy granting ONLY the actions identified by the analyzer.',
    backstory='Security purist who enforces strict least privilege.',
    verbose=True,
    llm=llm
)
assessor_agent = Agent(
    role='Risk and Impact Assessor',
    goal='Review the newly proposed IAM policy and verify it does not inadvertently block core services.',
    backstory='Cautious release manager who prevents production outages.',
    verbose=True,
    llm=llm
)
cloudtrail_summary = """
Role: Dev-Backend-App
Current Policy: AdministratorAccess (Full Access)
Observed Usage (90 days): s3:GetObject, s3:ListBucket on arn:aws:s3:::app-data-bucket, dynamodb:PutItem on arn:aws:dynamodb:us-east-1:123456789012:table/AppTable
"""
analyze_task = Task(
    description=f'Extract the exact AWS service actions and resources used from this summary: {cloudtrail_summary}',
    expected_output='List of AWS actions and specific resource ARNs.',
    agent=analyzer_agent
)
policy_task = Task(
    description='Generate a valid AWS IAM JSON policy based ONLY on the actions and resources provided by the analyzer. Deny everything else by default.',
    expected_output='AWS IAM Policy in JSON format.',
    agent=architect_agent,
    context=[analyze_task]
)
assess_task = Task(
    description='Review the JSON policy. Ensure there are no wildcards in the Action or Resource fields, and output a final Go/No-Go decision for deployment.',
    expected_output='Final JSON policy with a deployment risk assessment.',
    agent=assessor_agent,
    context=[policy_task]
)
iam_swarm = Crew(
    agents=[analyzer_agent, architect_agent, assessor_agent],
    tasks=[analyze_task, policy_task, assess_task]
)
if __name__ == "__main__":
    print("Initiating IAM Rightsizing Swarm...")
    new_policy = iam_swarm.kickoff()
    print("\n--- Automated IAM Policy Remediation ---\n")
    print(new_policy)