cartography 0.101.0rc1__tar.gz → 0.101.1rc1__tar.gz

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/.github/workflows/ossf-scorecard.yml

@@ -57,6 +57,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
+        uses: github/codeql-action/upload-sarif@fc7e4a0fa01c3cca5fd6a1fddec5c0740c977aa2 # v3.28.14
         with:
           sarif_file: results.sarif

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/.github/workflows/publish-to-ghcr-and-pypi.yml

@@ -21,7 +21,7 @@ jobs:
       # 1. Publish to PyPI
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up Python 3.10
-        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
         with:
           python-version: "3.10"
 

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/.github/workflows/sphinx.yml

@@ -27,7 +27,7 @@ jobs:
       # https://github.com/marketplace/actions/setup-python
       # ^-- This gives info on matrix testing.
       - name: Install Python
-        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
         with:
           python-version: "3.10"
       # https://docs.github.com/en/actions/guides/building-and-testing-python#caching-dependencies

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/.github/workflows/test_suite.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
         with:
           python-version: "3.10"
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
@@ -36,7 +36,7 @@ jobs:
             --publish 7473:7473 \
             --publish 7687:7687 \
             neo4j:4.4-community
-      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
         with:
           python-version: "3.10"
       # Cache our pip dir for efficiency; see https://medium.com/ai2-blog/python-caching-in-github-actions-e9452698e98d.
@@ -70,7 +70,7 @@ jobs:
             --publish 7473:7473 \
             --publish 7687:7687 \
             neo4j:5
-      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
         with:
           python-version: "3.10"
       # Cache our pip dir for efficiency; see https://medium.com/ai2-blog/python-caching-in-github-actions-e9452698e98d.

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cartography
-Version: 0.101.0rc1
+Version: 0.101.1rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -59,10 +59,10 @@ Requires-Dist: moto; extra == "dev"
 Requires-Dist: pre-commit; extra == "dev"
 Requires-Dist: pytest>=6.2.4; extra == "dev"
 Requires-Dist: pytest-mock; extra == "dev"
-Requires-Dist: pytest-cov==6.0.0; extra == "dev"
+Requires-Dist: pytest-cov==6.1.1; extra == "dev"
 Requires-Dist: pytest-rerunfailures; extra == "dev"
 Requires-Dist: types-PyYAML; extra == "dev"
-Requires-Dist: types-requests<2.32.0.20250307; extra == "dev"
+Requires-Dist: types-requests<2.32.0.20250329; extra == "dev"
 Dynamic: license-file
 
 ![Cartography](docs/root/images/logo-horizontal.png)
@@ -182,6 +182,7 @@ Get started with our [developer documentation](https://cartography-cncf.github.i
 1. [MessageBird](https://messagebird.com)
 1. [Cloudanix](https://www.cloudanix.com/)
 1. [Corelight](https://www.corelight.com/)
+1. [SubImage](https://subimage.io)
 1. {Your company here} :-)
 
 If your organization uses Cartography, please file a PR and update this list. Say hi on Slack too!

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/README.md

@@ -115,6 +115,7 @@ Get started with our [developer documentation](https://cartography-cncf.github.i
 1. [MessageBird](https://messagebird.com)
 1. [Cloudanix](https://www.cloudanix.com/)
 1. [Corelight](https://www.corelight.com/)
+1. [SubImage](https://subimage.io)
 1. {Your company here} :-)
 
 If your organization uses Cartography, please file a PR and update this list. Say hi on Slack too!

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/_version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '0.101.0rc1'
-__version_tuple__ = version_tuple = (0, 101, 0)
+__version__ = version = '0.101.1rc1'
+__version_tuple__ = version_tuple = (0, 101, 1)

cartography-0.101.1rc1/cartography/data/jobs/scoped_analysis/aws_ec2_iaminstanceprofile.json

@@ -0,0 +1,15 @@
+{
+    "name": "EC2 Instances assume IAM roles",
+    "statements": [
+        {
+            "__comment": "Create STS_ASSUMEROLE_ALLOW relationships from EC2 instances to the IAM roles they can assume via their iaminstanceprofiles",
+            "query":"MATCH (aa:AWSAccount{id: $AWS_ID})-[:RESOURCE]->(i:EC2Instance)-[:INSTANCE_PROFILE]->(p:AWSInstanceProfile)-[:ASSOCIATED_WITH]->(r:AWSRole)\nMERGE (i)-[s:STS_ASSUMEROLE_ALLOW]->(r)\nON CREATE SET s.firstseen = timestamp(), s.lastupdated = $UPDATE_TAG",
+            "iterative": true
+        },
+        {
+            "__comment": "Cleanup",
+            "query":"MATCH (aa:AWSAccount{id: $AWS_ID})-[:RESOURCE]->(:EC2Instance)-[s:STS_ASSUMEROLE_ALLOW]->(:AWSRole)\nWHERE s.lastupdated <> $UPDATE_TAG\nDELETE s",
+            "iterative": true
+        }
+    ]
+}

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/graph/querybuilder.py

@@ -109,7 +109,10 @@ def _build_match_clause(matcher: TargetNodeMatcher) -> str:
     return ', '.join(match.safe_substitute(Key=key, PropRef=prop_ref) for key, prop_ref in matcher_asdict.items())
 
 
-def _build_where_clause_for_rel_match(node_var: str, matcher: TargetNodeMatcher) -> str:
+def _build_where_clause_for_rel_match(
+        node_var: str,
+        matcher: TargetNodeMatcher,
+) -> str:
     """
     Same as _build_match_clause, but puts the matching logic in a WHERE clause.
     This is intended specifically to use for joining with relationships where we need a case-insensitive match.
@@ -119,6 +122,8 @@ def _build_where_clause_for_rel_match(node_var: str, matcher: TargetNodeMatcher)
     match = Template("$node_var.$key = $prop_ref")
     case_insensitive_match = Template("toLower($node_var.$key) = toLower($prop_ref)")
     fuzzy_and_ignorecase_match = Template("toLower($node_var.$key) CONTAINS toLower($prop_ref)")
+    # This assumes that item.$prop_ref points to a list available on the data object
+    one_to_many_match = Template("$node_var.$key IN $prop_ref")
 
     matcher_asdict = asdict(matcher)
 
@@ -128,6 +133,9 @@ def _build_where_clause_for_rel_match(node_var: str, matcher: TargetNodeMatcher)
             prop_line = case_insensitive_match.safe_substitute(node_var=node_var, key=key, prop_ref=prop_ref)
         elif prop_ref.fuzzy_and_ignore_case:
             prop_line = fuzzy_and_ignorecase_match.safe_substitute(node_var=node_var, key=key, prop_ref=prop_ref)
+        elif prop_ref.one_to_many:
+            # Allow a single node to be attached to multiple others at once using a list of IDs provided in kwargs
+            prop_line = one_to_many_match.safe_substitute(node_var=node_var, key=key, prop_ref=prop_ref)
         else:
             # Exact match (default; most efficient)
             prop_line = match.safe_substitute(node_var=node_var, key=key, prop_ref=prop_ref)

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/intel/aws/__init__.py

@@ -20,6 +20,7 @@ from cartography.util import merge_module_sync_metadata
 from cartography.util import run_analysis_and_ensure_deps
 from cartography.util import run_analysis_job
 from cartography.util import run_cleanup_job
+from cartography.util import run_scoped_analysis_job
 from cartography.util import timeit
 
 
@@ -75,7 +76,7 @@ def _sync_one_account(
     if 'resourcegroupstaggingapi' in aws_requested_syncs:
         RESOURCE_FUNCTIONS['resourcegroupstaggingapi'](**sync_args)
 
-    run_analysis_job(
+    run_scoped_analysis_job(
         'aws_ec2_iaminstanceprofile.json',
         neo4j_session,
         common_job_parameters,
@@ -211,6 +212,9 @@ def _perform_aws_analysis(
         neo4j_session: neo4j.Session,
         common_job_parameters: Dict[str, Any],
 ) -> None:
+    """
+    Performs AWS analysis jobs that span multiple accounts.
+    """
     requested_syncs_as_set = set(requested_syncs)
 
     ec2_asset_exposure_requirements = {

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/intel/aws/ec2/launch_templates.py

@@ -2,6 +2,7 @@ import logging
 from typing import Any
 
 import boto3
+import botocore
 import neo4j
 
 from .util import get_botocore_config
@@ -56,8 +57,15 @@ def get_launch_template_versions_by_template(
     client = boto3_session.client('ec2', region_name=region, config=get_botocore_config())
     v_paginator = client.get_paginator('describe_launch_template_versions')
     template_versions = []
-    for versions in v_paginator.paginate(LaunchTemplateId=launch_template_id):
-        template_versions.extend(versions['LaunchTemplateVersions'])
+    try:
+        for versions in v_paginator.paginate(LaunchTemplateId=launch_template_id):
+            template_versions.extend(versions['LaunchTemplateVersions'])
+    except botocore.exceptions.ClientError as e:
+        error_code = e.response['Error']['Code']
+        if error_code == 'InvalidLaunchTemplateId.NotFound':
+            logger.warning("Launch template %s no longer exists in region %s", launch_template_id, region)
+        else:
+            raise
     return template_versions
 
 

cartography-0.101.1rc1/cartography/intel/aws/iam_instance_profiles.py

@@ -0,0 +1,73 @@
+from typing import Any
+
+import boto3
+import neo4j
+
+from cartography.client.core.tx import load
+from cartography.intel.aws.ec2.util import get_botocore_config
+from cartography.models.aws.iam.instanceprofile import InstanceProfileSchema
+from cartography.util import aws_handle_regions
+from cartography.util import timeit
+
+
+@timeit
+@aws_handle_regions
+def get_iam_instance_profiles(boto3_session: boto3.Session) -> list[dict[str, Any]]:
+    client = boto3_session.client('iam', config=get_botocore_config())
+    paginator = client.get_paginator('list_instance_profiles')
+    instance_profiles = []
+    for page in paginator.paginate():
+        instance_profiles.extend(page['InstanceProfiles'])
+    return instance_profiles
+
+
+def transform_instance_profiles(data: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    transformed = []
+    for profile in data:
+        transformed_profile = {
+            'Arn': profile['Arn'],
+            'CreateDate': profile['CreateDate'],
+            'InstanceProfileId': profile['InstanceProfileId'],
+            'InstanceProfileName': profile['InstanceProfileName'],
+            'Path': profile['Path'],
+            'Roles': [role['Arn'] for role in profile.get('Roles', [])],
+        }
+        transformed.append(transformed_profile)
+    return transformed
+
+
+@timeit
+def load_iam_instance_profiles(
+        neo4j_session: neo4j.Session,
+        data: list[dict[str, Any]],
+        current_aws_account_id: str,
+        update_tag: int,
+        common_job_parameters: dict[str, Any],
+) -> None:
+    load(
+        neo4j_session,
+        InstanceProfileSchema(),
+        data,
+        AWS_ID=current_aws_account_id,
+        lastupdated=update_tag,
+    )
+
+
+@timeit
+def sync_iam_instance_profiles(
+        boto3_session: boto3.Session,
+        neo4j_session: neo4j.Session,
+        current_aws_account_id: str,
+        update_tag: int,
+        regions: list[str],
+        common_job_parameters: dict[str, Any],
+) -> None:
+    profiles = get_iam_instance_profiles(boto3_session)
+    profiles = transform_instance_profiles(profiles)
+    load_iam_instance_profiles(
+        neo4j_session,
+        profiles,
+        common_job_parameters['AWS_ID'],
+        common_job_parameters['UPDATE_TAG'],
+        common_job_parameters,
+    )

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/intel/aws/resources.py

@@ -1,3 +1,4 @@
+from typing import Callable
 from typing import Dict
 
 from . import apigateway
@@ -43,9 +44,11 @@ from .ec2.tgw import sync_transit_gateways
 from .ec2.volumes import sync_ebs_volumes
 from .ec2.vpc import sync_vpc
 from .ec2.vpc_peerings import sync_vpc_peerings
+from .iam_instance_profiles import sync_iam_instance_profiles
 
-RESOURCE_FUNCTIONS: Dict = {
+RESOURCE_FUNCTIONS: Dict[str, Callable[..., None]] = {
     'iam': iam.sync,
+    'iaminstanceprofiles': sync_iam_instance_profiles,
     's3': s3.sync,
     'dynamodb': dynamodb.sync,
     'ec2:launch_templates': sync_ec2_launch_templates,

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/intel/crowdstrike/endpoints.py

@@ -34,8 +34,8 @@ def load_host_data(
     UNWIND $Hosts AS host
         MERGE (h:CrowdstrikeHost{id: host.device_id})
         ON CREATE SET h.cid = host.cid,
-            h.cid = host.cid,
             h.instance_id = host.instance_id,
+            h.serial_number = host.serial_number,
             h.firstseen = timestamp()
         SET h.status = host.status,
             h.hostname = host.hostname,

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/intel/gcp/__init__.py

@@ -3,6 +3,7 @@ import logging
 from collections import namedtuple
 from typing import Dict
 from typing import List
+from typing import Optional
 from typing import Set
 
 import googleapiclient.discovery
@@ -328,7 +329,7 @@ def _sync_multiple_projects(
 
 
 @timeit
-def get_gcp_credentials() -> GoogleCredentials:
+def get_gcp_credentials() -> Optional[GoogleCredentials]:
     """
     Gets access tokens for GCP API access.
     :param: None
@@ -338,6 +339,7 @@ def get_gcp_credentials() -> GoogleCredentials:
         # Explicitly use Application Default Credentials.
         # See https://google-auth.readthedocs.io/en/master/user-guide.html#application-default-credentials
         credentials, project_id = default()
+        return credentials
     except DefaultCredentialsError as e:
         logger.debug("Error occurred calling GoogleCredentials.get_application_default().", exc_info=True)
         logger.error(
@@ -349,7 +351,7 @@ def get_gcp_credentials() -> GoogleCredentials:
             ),
             e,
         )
-        return credentials
+    return None
 
 
 @timeit
@@ -367,6 +369,9 @@ def start_gcp_ingestion(neo4j_session: neo4j.Session, config: Config) -> None:
     }
 
     credentials = get_gcp_credentials()
+    if credentials is None:
+        logger.warning("Unable to initialize GCP credentials. Skipping module.")
+        return
 
     resources = _initialize_resources(credentials)
 

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/intel/gsuite/__init__.py

@@ -67,6 +67,14 @@ def start_gsuite_ingestion(neo4j_session: neo4j.Session, config: Config) -> None
 
     creds: OAuth2Credentials | ServiceAccountCredentials
     if config.gsuite_auth_method == 'delegated':  # Legacy delegated method
+        if config.gsuite_config is None or not os.path.isfile(config.gsuite_config):
+            logger.warning(
+                (
+                    "The GSuite config file is not set or is not a valid file."
+                    "Skipping GSuite ingestion."
+                ),
+            )
+            return
         logger.info('Attempting to authenticate to GSuite using legacy delegated method')
         try:
             creds = service_account.Credentials.from_service_account_file(

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/models/aws/ec2/instances.py

@@ -71,6 +71,22 @@ class EC2InstanceToEC2Reservation(CartographyRelSchema):
     properties: EC2InstanceToEC2ReservationRelProperties = EC2InstanceToEC2ReservationRelProperties()
 
 
+@dataclass(frozen=True)
+class EC2InstanceToInstanceProfileRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2InstanceToInstanceProfile(CartographyRelSchema):
+    target_node_label: str = 'AWSInstanceProfile'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'arn': PropertyRef('IamInstanceProfile')},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "INSTANCE_PROFILE"
+    properties: EC2InstanceToInstanceProfileRelProperties = EC2InstanceToInstanceProfileRelProperties()
+
+
 @dataclass(frozen=True)
 class EC2InstanceSchema(CartographyNodeSchema):
     label: str = 'EC2Instance'
@@ -79,5 +95,6 @@ class EC2InstanceSchema(CartographyNodeSchema):
     other_relationships: OtherRelationships = OtherRelationships(
         [
             EC2InstanceToEC2Reservation(),
+            EC2InstanceToInstanceProfile(),  # Add the new relationship
         ],
     )

cartography-0.101.1rc1/cartography/models/aws/iam/instanceprofile.py

@@ -0,0 +1,67 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class InstanceProfileNodeProperties(CartographyNodeProperties):
+    """
+    Schema describing a InstanceProfile.
+    """
+    arn: PropertyRef = PropertyRef('Arn')
+    createdate: PropertyRef = PropertyRef('CreateDate')
+    id: PropertyRef = PropertyRef('Arn')
+    instance_profile_id: PropertyRef = PropertyRef('InstanceProfileId')
+    instance_profile_name: PropertyRef = PropertyRef('InstanceProfileName')
+    path: PropertyRef = PropertyRef('Path')
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class InstanceProfileToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class InstanceProfileToAWSAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: InstanceProfileToAwsAccountRelProperties = InstanceProfileToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class InstanceProfileToAWSRoleRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class InstanceProfileToAWSRole(CartographyRelSchema):
+    target_node_label: str = 'AWSRole'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'arn': PropertyRef('Roles', one_to_many=True)},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ASSOCIATED_WITH"
+    properties: InstanceProfileToAWSRoleRelProperties = InstanceProfileToAWSRoleRelProperties()
+
+
+@dataclass(frozen=True)
+class InstanceProfileSchema(CartographyNodeSchema):
+    label: str = 'AWSInstanceProfile'
+    properties: InstanceProfileNodeProperties = InstanceProfileNodeProperties()
+    sub_resource_relationship: InstanceProfileToAWSAccount = InstanceProfileToAWSAccount()
+    other_relationships: OtherRelationships = OtherRelationships([
+        InstanceProfileToAWSRole(),
+    ])

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography/models/core/common.py

@@ -9,12 +9,13 @@ class PropertyRef:
     """
 
     def __init__(
-        self,
-        name: str,
-        set_in_kwargs=False,
-        extra_index=False,
-        ignore_case=False,
-        fuzzy_and_ignore_case=False,
+            self,
+            name: str,
+            set_in_kwargs=False,
+            extra_index=False,
+            ignore_case=False,
+            fuzzy_and_ignore_case=False,
+            one_to_many=False,
     ):
         """
         :param name: The name of the property
@@ -44,19 +45,49 @@ class PropertyRef:
         this property using the `CONTAINS` operator.
         query. Defaults to False. This only has effect as part of a TargetNodeMatcher and is not supported for the
         sub resource relationship.
+        :param one_to_many: Indicates that this property is meant to create one-to-many associations. If set to True,
+        this property ref points to a list stored on the data dict where each item is an ID. Only has effect as
+        part of a TargetNodeMatcher and is not supported for the sub resource relationship. Defaults to False.
+            Example on why you would set this to True:
+            AWS IAM instance profiles can be associated with one or more roles. This is reflected in their API object:
+            when we call describe-iam-instance-profiles, the `Roles` field contains a list of all the roles that the
+            profile is associated with. So, to create AWSInstanceProfile nodes while attaching them to multiple roles,
+            we can create a CartographyRelSchema with
+            ```
+            class InstanceProfileSchema(Schema):
+                target_node_label: str = 'AWSRole'
+                target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+                    'arn': PropertyRef('Roles', one_to_many=True),
+                )
+                ...
+            ```
+            This means that as we create AWSInstanceProfile nodes, we will search for AWSRoles to attach to, and we do
+            this by checking if each role's `arn` field is in the `Roles` list of the data dict.
         """
         self.name = name
         self.set_in_kwargs = set_in_kwargs
         self.extra_index = extra_index
         self.ignore_case = ignore_case
         self.fuzzy_and_ignore_case = fuzzy_and_ignore_case
+        self.one_to_many = one_to_many
+
         if self.fuzzy_and_ignore_case and self.ignore_case:
             raise ValueError(
                 f'Error setting PropertyRef "{self.name}": ignore_case cannot be used together with'
                 'fuzzy_and_ignore_case. Pick one or the other.',
             )
 
+        if self.one_to_many and (self.ignore_case or self.fuzzy_and_ignore_case):
+            raise ValueError(
+                f'Error setting PropertyRef "{self.name}": one_to_many cannot be used together with '
+                '`ignore_case` or `fuzzy_and_ignore_case`.',
+            )
+
     def _parameterize_name(self) -> str:
+        """
+        Prefixes the name of the property ref with a '$' so that we can receive keyword args. See docs on __repr__ for
+        PropertyRef.
+        """
         return f"${self.name}"
 
     def __repr__(self) -> str:

{cartography-0.101.0rc1 → cartography-0.101.1rc1}/cartography.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cartography
-Version: 0.101.0rc1
+Version: 0.101.1rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -59,10 +59,10 @@ Requires-Dist: moto; extra == "dev"
 Requires-Dist: pre-commit; extra == "dev"
 Requires-Dist: pytest>=6.2.4; extra == "dev"
 Requires-Dist: pytest-mock; extra == "dev"
-Requires-Dist: pytest-cov==6.0.0; extra == "dev"
+Requires-Dist: pytest-cov==6.1.1; extra == "dev"
 Requires-Dist: pytest-rerunfailures; extra == "dev"
 Requires-Dist: types-PyYAML; extra == "dev"
-Requires-Dist: types-requests<2.32.0.20250307; extra == "dev"
+Requires-Dist: types-requests<2.32.0.20250329; extra == "dev"
 Dynamic: license-file
 
 ![Cartography](docs/root/images/logo-horizontal.png)
@@ -182,6 +182,7 @@ Get started with our [developer documentation](https://cartography-cncf.github.i
 1. [MessageBird](https://messagebird.com)
 1. [Cloudanix](https://www.cloudanix.com/)
 1. [Corelight](https://www.corelight.com/)
+1. [SubImage](https://subimage.io)
 1. {Your company here} :-)
 
 If your organization uses Cartography, please file a PR and update this list. Say hi on Slack too!