CloudTrail Parsing for Unauthorized Access | Dataford Interview Questions

Write a Python script to parse a large CloudTrail log file and identify API calls made by unauthorized or expired IAM roles.

Implement a function that takes a list of CloudTrail event records, a list of allowed role names, and a mapping of role expiration timestamps, then returns the events made by roles that are not allowed or whose role session time is past expiration.

Input

events: list[str], allowed_roles: list[str], role_expirations: dict[str, str]

Output

Return list[dict] of parsed CloudTrail events that match the rule.

Constraints

1 <= len(events) <= 10^5
0 <= len(allowed_roles) <= 10^5
0 <= len(role_expirations) <= 10^5
Event timestamps and expiration timestamps use UTC format YYYY-MM-DDTHH:MM:SSZ
Malformed JSON records must be ignored
Only AssumedRole events with a valid assumed-role ARN are considered

Function Signature

def find_unauthorized_cloudtrail_calls(events, allowed_roles, role_expirations):

Your question is CloudTrail Parsing for Unauthorized Access. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem