#!/bin/bash

# by David Lin

# ===========
# DESCRIPTION
# ===========
# This script is used to fetch all IAM RoleIds across all accounts.
#
# This script uses c7n-org's orgaccounts.py script to generate a yml file named
# all-orgaccounts.yml which contains the list of all known AWS accounts
# under the TRI org.
#
# The all-orgaccounts.yml file is then used by c7n-org to
# search against all IAM roles and write the results to file.
#
# VIM is used to open the file to quickly search for IAM RoleIds and RoleNames.
#
# Within vim, you can use the `/` command to search against role names.
# If a match is found, the account name that maps to the aws account number
# can be found in the offboarding-oraccounts.yml file.

# =========
# VARIABLES
# =========
# |-------------------+--------------------------------------------------------------|
# | Variable Name     | Description                                                  |
# |-------------------+--------------------------------------------------------------|
# | ORG_ACCOUNTS_FILE | filename generated by c7n-org's orgaccounts.py               |
# |                   | after orgaccounts.py is invoked                              |
# |                   | this file is saved in the $HOME directory for easy retrieval |
# |-------------------+--------------------------------------------------------------|
# | ORG_ACCOUNTS_PATH | path where c7n-org's orgaccounts.py lives                    |
# |-------------------+--------------------------------------------------------------|
# | C7N_ORG_PATH      | path where the output file ourput-iam-roleids.yml is stored  |
# |-------------------+--------------------------------------------------------------|
# | CUSTODIAN_POLICY  | name of cloud custodian policy that retrieves iam roles      |
# |-------------------+--------------------------------------------------------------|
# | REGION            | AWS region                                                   |
# |-------------------+--------------------------------------------------------------|

ORG_ACCOUNTS_FILE="all-orgaccounts.yml"
ORG_ACCOUNTS_PATH="${HOME}/cloud-custodian/tools/c7n_org/scripts"
C7N_ORG_PATH="${HOME}/cloudcustodian/policies/c7n-org"
CUSTODIAN_POLICY="iam-role.yml"
OUTPUT_IAM_ROLEIDS="${HOME}/output-iam-roleids.txt"
REGION="us-east-1"

read -p "Use latest list of all accounts? [y|n]:" response

if [ "${response}" = "y" ]
then
  # ============================
  # CREATE all-accounts.yml FILE
  # ============================
  echo "Creating ${HOME}/${ORG_ACCOUNTS_FILE} file. This will take a minute..."
  python $ORG_ACCOUNTS_PATH/orgaccounts.py -f $HOME/$ORG_ACCOUNTS_FILE
  echo "${HOME}/${ORG_ACCOUNTS_FILE} successfully created!"

  echo "Retrieving list of all IAM roles across org..."
  echo "You will be taken into a VIM session upon completion"
  echo "Use the forward slash '/' to search file against IAM role(s)"
  read -p "Press enter to continue..."
else
  echo "Using last known list of accounts..."
fi


# Activate c7n-org virtual environment
source $HOME/c7n_org/bin/activate
c7n-org run -s output -c $HOME/$ORG_ACCOUNTS_FILE -u $C7N_ORG_PATH/$CUSTODIAN_POLICY --region $REGION
c7n-org report -c $HOME/$ORG_ACCOUNTS_FILE -u $C7N_ORG_PATH/$CUSTODIAN_POLICY -s output --no-default-fields --field RoleId=RoleId --field RoleName=RoleName --region us-east-
1 > $OUTPUT_IAM_ROLEIDS
vim $OUTPUT_IAM_ROLEIDS

echo "==================================================="
echo "IAM role audit across accounts completed"
echo "If you would like to see the results again, see file $OUTPUT_IAM_ROLEIDS
echo "To get the role name to account ID mapping, see file $OUTPUT_IAM_ROLEIDS
