Utils for clean data from AWS IAM and DynamoDB

clean-aws.py

import boto3
import datetime


ACCESS_KEY = ''
SECRET_KEY = ''

SKIP_USERS = []


def can_delete(username):
	for item in SKIP_USERS:
		if item in username:
			return False

	return True


def get_iam_api():
    return boto3.client(
		'iam',
	    aws_access_key_id=ACCESS_KEY,
	    aws_secret_access_key=SECRET_KEY,
	)


def get_dynamodb_api():
    return boto3.client(
		'dynamodb',
	    aws_access_key_id=ACCESS_KEY,
	    aws_secret_access_key=SECRET_KEY,
	    region_name='eu-central-1',
	)

def db_items(table):
	dynamodb = get_dynamodb_api()
	res = dynamodb.scan(
		TableName=table,
		AttributesToGet=['instance_id'],
	)
	return [item['instance_id']['S'] for item in res['Items'] if can_delete(item['instance_id']['S'])]


def get_users(prefix=None, max_items=None):
	iam = get_iam_api()
	kwargs = {}

	if prefix:
		kwargs['PathPrefix'] = prefix

	if max_items:
		kwargs['MaxItems'] = max_items

	users = iam.list_users(**kwargs)['Users']

	return [item for item in users if can_delete(item['UserName'])]


def get_first_access_key(username):
	iam = get_iam_api()
	res = iam.list_access_keys(UserName=username)
	return res['AccessKeyMetadata'][0]['AccessKeyId']

def get_access_key_last_used(access_key):
	iam = get_iam_api()
	res = iam.get_access_key_last_used(AccessKeyId=access_key)

	try:
		last_used = res['AccessKeyLastUsed']['LastUsedDate']
	except Exception as e:
		last_used = None
		print res

	return last_used


def get_user_last_used_data(username):
	return get_access_key_last_used(get_first_access_key(username))


def how_long_used(username):
	today = datetime.date.today()
	used_dt = get_user_last_used_data(username)

	if not used_dt:
		return -1

	used = datetime.date(used_dt.year, used_dt.month, used_dt.day)
	return (today - used).days


def delete_user(username):
    iam = get_iam_api()
    res = None

    try:
        print("Deleting user %s policy", username)
        iam.delete_user_policy(UserName=username, PolicyName=username)
    except Exception as e:
        print e

    try:
        key = get_first_access_key(username)
        iam.delete_access_key(
            AccessKeyId=key,
            UserName=username
        )
    except Exception as e:
        print e

    try:
        print("Deleting user %s", username)
        res = iam.delete_user(UserName=username)
    except Exception as e:
        print e

    return res


def delete_db_item(table, instance_id):
	dynamodb = get_dynamodb_api()
	print("Deleting db item ", instance_id)
	return dynamodb.delete_item(
		TableName=table,
		Key={
			'instance_id': {
				'S': instance_id
			}
		}
	)


def get_not_used_users(prefix=None):
	users = get_users(prefix)
	not_users = []

	for user in users:
		if how_long_used(user['UserName']) == -1:
			not_users.append(user['UserName'])

	return not_users


def remove_old_users(prefix=None):
	users = get_users(prefix)

	for user in users:
		print how_long_used(user['UserName']), user['UserName']


def remove_all_from(table):
	items = db_items(table)

	for item in items:
		if can_delete(item):
			delete_user(item)
			delete_db_item(table, item)