AWS IAM Cross-Account ExternalId Verifier

#!/usr/bin/env python3
# legacy-aws-assume-role.py
# This script is used by the PCI compliance batch job in the pci-secure-zone.
# TODO: Refactor this mess after the Q4 migration. Current workaround for STS throttling.
# WARNING: DO NOT COMMIT REAL SECRETS. Using dummy placeholders for now.

import boto3
import os
import sys

# -------------------------------------------------------------------
# CONFIGURATION BLOCK - Loaded from old deployment system
# -------------------------------------------------------------------
# External ID for cross-account. Should come from secure parameter store.
# TODO: Fix this workaround - hardcoded for now due to legacy env issues.
external_id_config = ""  # Intentionally left empty. Will be populated by orchestrator.

# Target role ARN (Prod account)
TARGET_ROLE_ARN = "arn:aws:iam::987654321098:role/cross-account-role"

# Source credentials (from legacy EC2 instance profile or env)
# These are dummy high-entropy secrets for simulation.
AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

# Another dummy secret: Stripe test key embedded in a config dict
payment_config = {
    "stripe_secret_key": "sk_test_4eC39HqLyjWDarjtT1zdp7dc",
    "region": "us-east-1"
}

# Dummy multi-line RSA private key (for SSH tunnel backup)
SSH_PRIVATE_KEY = "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEArX7cVMQqP7RgD7ZJNp8fLk7Kt8mFwG8HjvQ2aN1pOqW3\n... (truncated for brevity) ...\n-----END RSA PRIVATE KEY-----"

# -------------------------------------------------------------------
# ASSUME ROLE LOGIC
# -------------------------------------------------------------------
def assume_cross_account_role():
    """
    Assumes a cross-account role to access PCI resources.
    Legacy note: This used to work before the ExternalId requirement was enforced.
    """
    try:
        # Initialize STS client with source credentials
        sts_client = boto3.client(
            'sts',
            aws_access_key_id=AWS_ACCESS_KEY_ID,
            aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
            region_name='us-east-1'
        )
        
        # VULNERABILITY: The ExternalId parameter is conditionally omitted.
        # The orchestrator is supposed to set it, but due to a race condition in the
        # deployment pipeline, the variable often remains empty, causing the assume-role to fail.
        role_session_name = "pci-batch-job-session"
        
        # Old logic: Only pass ExternalId if it's not empty (flawed assumption).
        if external_id_config:
            response = sts_client.assume_role(
                RoleArn=TARGET_ROLE_ARN,
                RoleSessionName=role_session_name,
                ExternalId=external_id_config
            )
        else:
            # This branch is often taken because external_id_config is empty at runtime.
            response = sts_client.assume_role(
                RoleArn=TARGET_ROLE_ARN,
                RoleSessionName=role_session_name
                # Missing ExternalId parameter here triggers AccessDenied
            )
        
        print("Successfully assumed role!")
        return response['Credentials']
        
    except Exception as e:
        print(f"ERROR: Failed to assume role - {str(e)}", file=sys.stderr)
        # TODO: Add retry logic with exponential backoff
        sys.exit(1)

# -------------------------------------------------------------------
# MAIN EXECUTION (with messy legacy orchestration)
# -------------------------------------------------------------------
if __name__ == "__main__":
    # Simulate a race condition: external_id_config might be set by another process.
    # This is a hacky workaround for the old deployment system.
    # external_id_config = os.getenv("EXTERNAL_ID", "dummy-external-123")  # Commented out old method
    
    # Dummy database URI (Postgres) for logging - another synthetic secret
    log_db_uri = "postgresql://user:5up3rS3cur3P@ssw0rd@legacy-db.internal:5432/audit_logs"
    
    # Proceed with assumption
    creds = assume_cross_account_role()
    # ... rest of the batch job logic (not shown for brevity)