IAM Automation Pipeline

import boto3
from datetime import datetime

def provision_user(username, groups, tags):
    """
    Provision IAM user with groups and tags.
    Enforces MFA and least-privilege policies.
    """
    iam = boto3.client('iam')
    
    # Create user with required tags
    iam.create_user(
        UserName=username,
        Tags=[
            {'Key': 'Environment', 'Value': 'Production'},
            {'Key': 'MFARequired', 'Value': 'true'},
            {'Key': 'CreatedBy', 'Value': 'Automation'},
            *tags
        ]
    )
    
    # Add to security groups
    for group in groups:
        iam.add_user_to_group(
            UserName=username,
            GroupName=group
        )
    
    return {'status': 'success', 'user': username}