import boto3
from datetime import datetime, timedelta

def remediate_untagged_resources():
    """Find and tag untagged EC2 instances, quarantine if owner unknown."""
    
    ec2 = boto3.client('ec2', region_name='us-east-1')
    config = boto3.client('config')
    
    # Get non-compliant resources from AWS Config
    response = config.get_compliance_details_by_config_rule(
        ConfigRuleName='required-tags-ec2',
        ComplianceTypes=['NON_COMPLIANT']
    )
    
    for result in response['EvaluationResults']:
        instance_id = result['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceId']
        
        # Try to infer owner from resource name or creator
        tags = get_instance_tags(ec2, instance_id)
        inferred_team = infer_team_from_resource(instance_id, tags)
        
        if inferred_team:
            # Tag automatically
            ec2.create_tags(
                Resources=[instance_id],
                Tags=[
                    {'Key': 'team', 'Value': inferred_team},
                    {'Key': 'auto_tagged', 'Value': 'true'},
                    {'Key': 'auto_tagged_date', 'Value': datetime.utcnow().isoformat()}
                ]
            )
        else:
            # Can't infer — add to quarantine watchlist
            quarantine_date = datetime.utcnow() + timedelta(days=7)
            ec2.create_tags(
                Resources=[instance_id],
                Tags=[
                    {'Key': 'quarantine_scheduled', 'Value': quarantine_date.isoformat()},
                    {'Key': 'quarantine_reason', 'Value': 'missing_required_tags'}
                ]
            )
            
            # Alert the team
            send_slack_alert(
                channel='#cloud-cost-alerts',
                message=f"⚠️ Untagged resource {instance_id} scheduled for quarantine on {quarantine_date.date()}"
            )

import boto3
import pandas as pd
from datetime import datetime, timedelta

def generate_team_cost_report(start_date: str, end_date: str) -> pd.DataFrame:
    """Pull AWS Cost Explorer data and allocate by team tag."""
    
    ce = boto3.client('cost-explorer')
    
    response = ce.get_cost_and_usage(
        TimePeriod={'Start': start_date, 'End': end_date},
        Granularity='MONTHLY',
        Metrics=['BlendedCost', 'UsageQuantity'],
        GroupBy=[
            {'Type': 'TAG', 'Key': 'team'},
            {'Type': 'DIMENSION', 'Key': 'SERVICE'}
        ],
        Filter={
            'Not': {
                'Dimensions': {
                    'Key': 'RECORD_TYPE',
                    'Values': ['Credit', 'Refund']
                }
            }
        }
    )
    
    rows = []
    for result in response['ResultsByTime']:
        period = result['TimePeriod']['Start']
        for group in result['Groups']:
            team = group['Keys'][0].replace('team$', '') or 'unallocated'
            service = group['Keys'][1]
            cost = float(group['Metrics']['BlendedCost']['Amount'])
            
            rows.append({
                'period': period,
                'team': team,
                'service': service,
                'cost_usd': cost
            })
    
    return pd.DataFrame(rows)

def calculate_cost_trends(df: pd.DataFrame) -> pd.DataFrame:
    """Add month-over-month change % per team."""
    
    team_monthly = df.groupby(['team', 'period'])['cost_usd'].sum().reset_index()
    team_monthly = team_monthly.sort_values(['team', 'period'])
    team_monthly['prev_month_cost'] = team_monthly.groupby('team')['cost_usd'].shift(1)
    team_monthly['mom_change_pct'] = (
        (team_monthly['cost_usd'] - team_monthly['prev_month_cost']) 
        / team_monthly['prev_month_cost'] * 100
    ).round(1)
    
    return team_monthly

def send_weekly_cost_digest():
    """Send a team-level cost summary to Slack every Monday."""
    
    today = datetime.utcnow()
    last_week_start = (today - timedelta(days=7)).strftime('%Y-%m-%d')
    prev_week_start = (today - timedelta(days=14)).strftime('%Y-%m-%d')
    
    current_week = generate_team_cost_report(last_week_start, today.strftime('%Y-%m-%d'))
    prev_week = generate_team_cost_report(prev_week_start, last_week_start)
    
    team_current = current_week.groupby('team')['cost_usd'].sum()
    team_prev = prev_week.groupby('team')['cost_usd'].sum()
    
    blocks = [
        {"type": "header", "text": {"type": "plain_text", "text": "☁️ Weekly Cloud Cost Digest"}},
        {"type": "section", "text": {"type": "mrkdwn", 
         "text": f"*Week of {last_week_start}*"}}
    ]
    
    for team in sorted(team_current.index):
        current = team_current.get(team, 0)
        prev = team_prev.get(team, 0)
        change_pct = ((current - prev) / prev * 100) if prev > 0 else 0
        
        trend = "📈" if change_pct > 10 else "📉" if change_pct < -10 else "➡️"
        color = "🔴" if change_pct > 20 else "🟡" if change_pct > 10 else "🟢"
        
        blocks.append({
            "type": "section",
            "text": {"type": "mrkdwn", 
                     "text": f"{color} *{team}*: ${current:,.0f} {trend} {change_pct:+.1f}% vs last week"}
        })
    
    send_to_slack(channel='#cloud-costs', blocks=blocks)

import numpy as np
from scipy import stats

class CostAnomalyDetector:
    def __init__(self, sensitivity: float = 2.5):
        self.sensitivity = sensitivity  # Z-score threshold
    
    def detect_anomalies(self, cost_series: list[float]) -> list[int]:
        """
        Find anomalous days in a cost time series using modified Z-score.
        Returns indices of anomalous days.
        """
        if len(cost_series) < 7:
            return []
        
        arr = np.array(cost_series)
        
        # Use median absolute deviation (more robust than std for skewed cost data)
        median = np.median(arr)
        mad = np.median(np.abs(arr - median))
        
        # Modified Z-score
        modified_z_scores = 0.6745 * (arr - median) / mad if mad > 0 else np.zeros_like(arr)
        
        anomalies = np.where(np.abs(modified_z_scores) > self.sensitivity)[0]
        return anomalies.tolist()
    
    def analyze_service_costs(self, daily_costs: dict[str, list[float]]) -> list[dict]:
        """Analyze costs per service and return anomaly report."""
        
        alerts = []
        for service, costs in daily_costs.items():
            anomaly_indices = self.detect_anomalies(costs)
            
            if anomaly_indices:
                latest_anomaly_idx = max(anomaly_indices)
                expected = np.median(costs[:-1])  # Median of historical
                actual = costs[latest_anomaly_idx]
                pct_increase = (actual - expected) / expected * 100
                
                if pct_increase > 0:  # Only alert on increases
                    alerts.append({
                        "service": service,
                        "expected_daily": round(expected, 2),
                        "actual_daily": round(actual, 2),
                        "pct_increase": round(pct_increase, 1),
                        "severity": "high" if pct_increase > 50 else "medium"
                    })
        
        return sorted(alerts, key=lambda x: x['pct_increase'], reverse=True)

def apply_intelligent_tiering_to_all_buckets():
    """Enable S3 Intelligent-Tiering on all buckets missing it."""
    
    s3 = boto3.client('s3')
    buckets = s3.list_buckets()['Buckets']
    
    for bucket in buckets:
        name = bucket['Name']
        
        try:
            existing = s3.list_bucket_intelligent_tiering_configurations(Bucket=name)
            if existing.get('IntelligentTieringConfigurationList'):
                continue  # Already configured
        except Exception:
            pass
        
        s3.put_bucket_intelligent_tiering_configuration(
            Bucket=name,
            Id='default-tiering',
            IntelligentTieringConfiguration={
                'Id': 'default-tiering',
                'Status': 'Enabled',
                'Tierings': [
                    {'Days': 90, 'AccessTier': 'ARCHIVE_ACCESS'},
                    {'Days': 180, 'AccessTier': 'DEEP_ARCHIVE_ACCESS'}
                ]
            }
        )
        print(f"✅ Enabled Intelligent-Tiering on {name}")