cartography 0.102.0rc1__py3-none-any.whl → 0.103.0__py3-none-any.whl

cartography/intel/aws/iam_instance_profiles.py

@@ -13,11 +13,11 @@ from cartography.util import timeit
 @timeit
 @aws_handle_regions
 def get_iam_instance_profiles(boto3_session: boto3.Session) -> list[dict[str, Any]]:
-    client = boto3_session.client('iam', config=get_botocore_config())
-    paginator = client.get_paginator('list_instance_profiles')
+    client = boto3_session.client("iam", config=get_botocore_config())
+    paginator = client.get_paginator("list_instance_profiles")
     instance_profiles = []
     for page in paginator.paginate():
-        instance_profiles.extend(page['InstanceProfiles'])
+        instance_profiles.extend(page["InstanceProfiles"])
     return instance_profiles
 
 
@@ -25,12 +25,12 @@ def transform_instance_profiles(data: list[dict[str, Any]]) -> list[dict[str, An
     transformed = []
     for profile in data:
         transformed_profile = {
-            'Arn': profile['Arn'],
-            'CreateDate': profile['CreateDate'],
-            'InstanceProfileId': profile['InstanceProfileId'],
-            'InstanceProfileName': profile['InstanceProfileName'],
-            'Path': profile['Path'],
-            'Roles': [role['Arn'] for role in profile.get('Roles', [])],
+            "Arn": profile["Arn"],
+            "CreateDate": profile["CreateDate"],
+            "InstanceProfileId": profile["InstanceProfileId"],
+            "InstanceProfileName": profile["InstanceProfileName"],
+            "Path": profile["Path"],
+            "Roles": [role["Arn"] for role in profile.get("Roles", [])],
         }
         transformed.append(transformed_profile)
     return transformed
@@ -38,11 +38,11 @@ def transform_instance_profiles(data: list[dict[str, Any]]) -> list[dict[str, An
 
 @timeit
 def load_iam_instance_profiles(
-        neo4j_session: neo4j.Session,
-        data: list[dict[str, Any]],
-        current_aws_account_id: str,
-        update_tag: int,
-        common_job_parameters: dict[str, Any],
+    neo4j_session: neo4j.Session,
+    data: list[dict[str, Any]],
+    current_aws_account_id: str,
+    update_tag: int,
+    common_job_parameters: dict[str, Any],
 ) -> None:
     load(
         neo4j_session,
@@ -55,19 +55,19 @@ def load_iam_instance_profiles(
 
 @timeit
 def sync_iam_instance_profiles(
-        boto3_session: boto3.Session,
-        neo4j_session: neo4j.Session,
-        current_aws_account_id: str,
-        update_tag: int,
-        regions: list[str],
-        common_job_parameters: dict[str, Any],
+    boto3_session: boto3.Session,
+    neo4j_session: neo4j.Session,
+    current_aws_account_id: str,
+    update_tag: int,
+    regions: list[str],
+    common_job_parameters: dict[str, Any],
 ) -> None:
     profiles = get_iam_instance_profiles(boto3_session)
     profiles = transform_instance_profiles(profiles)
     load_iam_instance_profiles(
         neo4j_session,
         profiles,
-        common_job_parameters['AWS_ID'],
-        common_job_parameters['UPDATE_TAG'],
+        common_job_parameters["AWS_ID"],
+        common_job_parameters["UPDATE_TAG"],
         common_job_parameters,
     )

cartography/intel/aws/identitycenter.py

@@ -8,27 +8,35 @@ import neo4j
 
 from cartography.client.core.tx import load
 from cartography.graph.job import GraphJob
-from cartography.models.aws.identitycenter.awsidentitycenter import AWSIdentityCenterInstanceSchema
-from cartography.models.aws.identitycenter.awspermissionset import AWSPermissionSetSchema
+from cartography.models.aws.identitycenter.awsidentitycenter import (
+    AWSIdentityCenterInstanceSchema,
+)
+from cartography.models.aws.identitycenter.awspermissionset import (
+    AWSPermissionSetSchema,
+)
 from cartography.models.aws.identitycenter.awsssouser import AWSSSOUserSchema
 from cartography.util import aws_handle_regions
 from cartography.util import run_cleanup_job
 from cartography.util import timeit
+
 logger = logging.getLogger(__name__)
 
 
 @timeit
 @aws_handle_regions
-def get_identity_center_instances(boto3_session: boto3.session.Session, region: str) -> List[Dict]:
+def get_identity_center_instances(
+    boto3_session: boto3.session.Session,
+    region: str,
+) -> List[Dict]:
     """
     Get all AWS IAM Identity Center instances in the current region
     """
-    client = boto3_session.client('sso-admin', region_name=region)
+    client = boto3_session.client("sso-admin", region_name=region)
     instances = []
 
-    paginator = client.get_paginator('list_instances')
+    paginator = client.get_paginator("list_instances")
     for page in paginator.paginate():
-        instances.extend(page.get('Instances', []))
+        instances.extend(page.get("Instances", []))
 
     return instances
 
@@ -44,7 +52,9 @@ def load_identity_center_instances(
     """
     Load Identity Center instances into the graph
     """
-    logger.info(f"Loading {len(instance_data)} Identity Center instances for region {region}")
+    logger.info(
+        f"Loading {len(instance_data)} Identity Center instances for region {region}",
+    )
     load(
         neo4j_session,
         AWSIdentityCenterInstanceSchema(),
@@ -57,24 +67,28 @@ def load_identity_center_instances(
 
 @timeit
 @aws_handle_regions
-def get_permission_sets(boto3_session: boto3.session.Session, instance_arn: str, region: str) -> List[Dict]:
+def get_permission_sets(
+    boto3_session: boto3.session.Session,
+    instance_arn: str,
+    region: str,
+) -> List[Dict]:
     """
     Get all permission sets for a given Identity Center instance
     """
-    client = boto3_session.client('sso-admin', region_name=region)
+    client = boto3_session.client("sso-admin", region_name=region)
     permission_sets = []
 
-    paginator = client.get_paginator('list_permission_sets')
+    paginator = client.get_paginator("list_permission_sets")
     for page in paginator.paginate(InstanceArn=instance_arn):
         # Get detailed info for each permission set
-        for arn in page.get('PermissionSets', []):
+        for arn in page.get("PermissionSets", []):
             details = client.describe_permission_set(
                 InstanceArn=instance_arn,
                 PermissionSetArn=arn,
             )
-            permission_set = details.get('PermissionSet', {})
+            permission_set = details.get("PermissionSet", {})
             if permission_set:
-                permission_set['RoleHint'] = (
+                permission_set["RoleHint"] = (
                     f":role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_{permission_set.get('Name')}"
                 )
                 permission_sets.append(permission_set)
@@ -94,7 +108,9 @@ def load_permission_sets(
     """
     Load Identity Center permission sets into the graph
     """
-    logger.info(f"Loading {len(permission_sets)} permission sets for instance {instance_arn} in region {region}")
+    logger.info(
+        f"Loading {len(permission_sets)} permission sets for instance {instance_arn} in region {region}",
+    )
 
     load(
         neo4j_session,
@@ -117,15 +133,15 @@ def get_sso_users(
     """
     Get all SSO users for a given Identity Store
     """
-    client = boto3_session.client('identitystore', region_name=region)
+    client = boto3_session.client("identitystore", region_name=region)
     users = []
 
-    paginator = client.get_paginator('list_users')
+    paginator = client.get_paginator("list_users")
     for page in paginator.paginate(IdentityStoreId=identity_store_id):
-        user_page = page.get('Users', [])
+        user_page = page.get("Users", [])
         for user in user_page:
-            if user.get('ExternalIds', None):
-                user['ExternalId'] = user.get('ExternalIds')[0].get('Id')
+            if user.get("ExternalIds", None):
+                user["ExternalId"] = user.get("ExternalIds")[0].get("Id")
             users.append(user)
 
     return users
@@ -143,7 +159,9 @@ def load_sso_users(
     """
     Load SSO users into the graph
     """
-    logger.info(f"Loading {len(users)} SSO users for identity store {identity_store_id} in region {region}")
+    logger.info(
+        f"Loading {len(users)} SSO users for identity store {identity_store_id} in region {region}",
+    )
 
     load(
         neo4j_session,
@@ -169,19 +187,25 @@ def get_role_assignments(
     """
 
     logger.info(f"Getting role assignments for {len(users)} users")
-    client = boto3_session.client('sso-admin', region_name=region)
+    client = boto3_session.client("sso-admin", region_name=region)
     role_assignments = []
 
     for user in users:
-        user_id = user['UserId']
-        paginator = client.get_paginator('list_account_assignments_for_principal')
-        for page in paginator.paginate(InstanceArn=instance_arn, PrincipalId=user_id, PrincipalType='USER'):
-            for assignment in page.get('AccountAssignments', []):
-                role_assignments.append({
-                    'UserId': user_id,
-                    'PermissionSetArn': assignment.get('PermissionSetArn'),
-                    'AccountId': assignment.get('AccountId'),
-                })
+        user_id = user["UserId"]
+        paginator = client.get_paginator("list_account_assignments_for_principal")
+        for page in paginator.paginate(
+            InstanceArn=instance_arn,
+            PrincipalId=user_id,
+            PrincipalType="USER",
+        ):
+            for assignment in page.get("AccountAssignments", []):
+                role_assignments.append(
+                    {
+                        "UserId": user_id,
+                        "PermissionSetArn": assignment.get("PermissionSetArn"),
+                        "AccountId": assignment.get("AccountId"),
+                    },
+                )
 
     return role_assignments
 
@@ -214,12 +238,22 @@ def load_role_assignments(
 
 
 @timeit
-def cleanup(neo4j_session: neo4j.Session, common_job_parameters: Dict[str, Any]) -> None:
-    GraphJob.from_node_schema(AWSIdentityCenterInstanceSchema(), common_job_parameters).run(neo4j_session)
-    GraphJob.from_node_schema(AWSPermissionSetSchema(), common_job_parameters).run(neo4j_session)
-    GraphJob.from_node_schema(AWSSSOUserSchema(), common_job_parameters).run(neo4j_session)
+def cleanup(
+    neo4j_session: neo4j.Session,
+    common_job_parameters: Dict[str, Any],
+) -> None:
+    GraphJob.from_node_schema(
+        AWSIdentityCenterInstanceSchema(),
+        common_job_parameters,
+    ).run(neo4j_session)
+    GraphJob.from_node_schema(AWSPermissionSetSchema(), common_job_parameters).run(
+        neo4j_session,
+    )
+    GraphJob.from_node_schema(AWSSSOUserSchema(), common_job_parameters).run(
+        neo4j_session,
+    )
     run_cleanup_job(
-        'aws_import_identity_center_cleanup.json',
+        "aws_import_identity_center_cleanup.json",
         neo4j_session,
         common_job_parameters,
     )
@@ -251,8 +285,8 @@ def sync_identity_center_instances(
 
         # For each instance, get and load its permission sets and SSO users
         for instance in instances:
-            instance_arn = instance['InstanceArn']
-            identity_store_id = instance['IdentityStoreId']
+            instance_arn = instance["InstanceArn"]
+            identity_store_id = instance["IdentityStoreId"]
 
             permission_sets = get_permission_sets(boto3_session, instance_arn, region)
 

cartography/intel/aws/inspector.py

@@ -15,15 +15,33 @@ from cartography.util import aws_handle_regions
 from cartography.util import aws_paginate
 from cartography.util import timeit
 
-
 logger = logging.getLogger(__name__)
 
 # As of 7/22/24, Inspector is only available in the below regions. We will need to update this hardcoded list here over
 # time. :\ https://docs.aws.amazon.com/general/latest/gr/inspector2.html
 AWS_INSPECTOR_REGIONS = {
-    "us-east-2", "us-east-1", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-southeast-3", "ap-south-1",
-    "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "ca-central-1",
-    "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-north-1", "eu-central-2", "me-south-1",
+    "us-east-2",
+    "us-east-1",
+    "us-west-1",
+    "us-west-2",
+    "af-south-1",
+    "ap-east-1",
+    "ap-southeast-3",
+    "ap-south-1",
+    "ap-northeast-3",
+    "ap-northeast-2",
+    "ap-southeast-1",
+    "ap-southeast-2",
+    "ap-northeast-1",
+    "ca-central-1",
+    "eu-central-1",
+    "eu-west-1",
+    "eu-west-2",
+    "eu-south-1",
+    "eu-west-3",
+    "eu-north-1",
+    "eu-central-2",
+    "me-south-1",
     "sa-east-1",
 }
 
@@ -31,9 +49,9 @@ AWS_INSPECTOR_REGIONS = {
 @timeit
 @aws_handle_regions
 def get_inspector_findings(
-        session: boto3.session.Session,
-        region: str,
-        current_aws_account_id: str,
+    session: boto3.session.Session,
+    region: str,
+    current_aws_account_id: str,
 ) -> List[Dict[str, Any]]:
     """
     We must list_findings by filtering the request, otherwise the request could tiemout.
@@ -42,28 +60,31 @@ def get_inspector_findings(
     list_members will get us all the accounts that
     have delegated access to the account specified by current_aws_account_id.
     """
-    client = session.client('inspector2', region_name=region)
+    client = session.client("inspector2", region_name=region)
 
-    members = aws_paginate(client, 'list_members', 'members')
+    members = aws_paginate(client, "list_members", "members")
     # the current host account may not be considered a "member", but we still fetch its findings
-    accounts = [current_aws_account_id] + [m['accountId'] for m in members]
+    accounts = [current_aws_account_id] + [m["accountId"] for m in members]
 
     findings = []
     for account in accounts:
-        logger.info(f'Getting findings for member account {account} in region {region}')
+        logger.info(f"Getting findings for member account {account} in region {region}")
         findings.extend(
             aws_paginate(
-                client, 'list_findings', 'findings', filterCriteria={
-                    'awsAccountId': [
+                client,
+                "list_findings",
+                "findings",
+                filterCriteria={
+                    "awsAccountId": [
                         {
-                            'comparison': 'EQUALS',
-                            'value': account,
+                            "comparison": "EQUALS",
+                            "value": account,
                         },
                     ],
-                    'findingStatus': [
+                    "findingStatus": [
                         {
-                            'comparison': 'NOT_EQUALS',
-                            'value': 'CLOSED',
+                            "comparison": "NOT_EQUALS",
+                            "value": "CLOSED",
                         },
                     ],
                 },
@@ -72,48 +93,70 @@ def get_inspector_findings(
     return findings
 
 
-def transform_inspector_findings(results: List[Dict[str, Any]]) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]]]:
+def transform_inspector_findings(
+    results: List[Dict[str, Any]],
+) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]]]:
     findings_list: List[Dict] = []
     packages: Dict[str, Any] = {}
 
     for f in results:
         finding: Dict = {}
 
-        finding['id'] = f['findingArn']
-        finding['arn'] = f['findingArn']
-        finding['severity'] = f['severity']
-        finding['name'] = f['title']
-        finding['firstobservedat'] = f['firstObservedAt']
-        finding['updatedat'] = f['updatedAt']
-        finding['awsaccount'] = f['awsAccountId']
-        finding['description'] = f['description']
-        finding['type'] = f['type']
-        finding['status'] = f['status']
-        if f.get('inspectorScoreDetails'):
-            finding['cvssscore'] = f['inspectorScoreDetails']['adjustedCvss']['score']
-        if f['resources'][0]['type'] == "AWS_EC2_INSTANCE":
-            finding['instanceid'] = f['resources'][0]['id']
-        if f['resources'][0]['type'] == "AWS_ECR_CONTAINER_IMAGE":
-            finding['ecrimageid'] = f['resources'][0]['id'].split('/')[2]
-        if f['resources'][0]['type'] == "AWS_ECR_REPOSITORY":
-            finding['ecrrepositoryid'] = f['resources'][0]['id']
-        if f.get('networkReachabilityDetails'):
-            finding['protocol'] = f['networkReachabilityDetails']['protocol']
-            finding['portrangebegin'] = f['networkReachabilityDetails']['openPortRange']['begin']
-            finding['portrangeend'] = f['networkReachabilityDetails']['openPortRange']['end']
-            finding['portrange'] = _port_range_string(f['networkReachabilityDetails'])
-        if f.get('packageVulnerabilityDetails'):
-            finding['vulnerabilityid'] = f['packageVulnerabilityDetails']['vulnerabilityId']
-            finding['referenceurls'] = f['packageVulnerabilityDetails'].get('referenceUrls')
-            finding['relatedvulnerabilities'] = f['packageVulnerabilityDetails'].get('relatedVulnerabilities')
-            finding['source'] = f['packageVulnerabilityDetails'].get('source')
-            finding['sourceurl'] = f['packageVulnerabilityDetails'].get('sourceUrl')
-            finding['vendorcreatedat'] = f['packageVulnerabilityDetails'].get('vendorCreatedAt')
-            finding['vendorseverity'] = f['packageVulnerabilityDetails'].get('vendorSeverity')
-            finding['vendorupdatedat'] = f['packageVulnerabilityDetails'].get('vendorUpdatedAt')
-
-            new_packages = _process_packages(f['packageVulnerabilityDetails'], f['awsAccountId'], f['findingArn'])
-            finding['vulnerablepackageids'] = list(new_packages.keys())
+        finding["id"] = f["findingArn"]
+        finding["arn"] = f["findingArn"]
+        finding["severity"] = f["severity"]
+        finding["name"] = f["title"]
+        finding["firstobservedat"] = f["firstObservedAt"]
+        finding["updatedat"] = f["updatedAt"]
+        finding["awsaccount"] = f["awsAccountId"]
+        finding["description"] = f["description"]
+        finding["type"] = f["type"]
+        finding["status"] = f["status"]
+        if f.get("inspectorScoreDetails"):
+            finding["cvssscore"] = f["inspectorScoreDetails"]["adjustedCvss"]["score"]
+        if f["resources"][0]["type"] == "AWS_EC2_INSTANCE":
+            finding["instanceid"] = f["resources"][0]["id"]
+        if f["resources"][0]["type"] == "AWS_ECR_CONTAINER_IMAGE":
+            finding["ecrimageid"] = f["resources"][0]["id"].split("/")[2]
+        if f["resources"][0]["type"] == "AWS_ECR_REPOSITORY":
+            finding["ecrrepositoryid"] = f["resources"][0]["id"]
+        if f.get("networkReachabilityDetails"):
+            finding["protocol"] = f["networkReachabilityDetails"]["protocol"]
+            finding["portrangebegin"] = f["networkReachabilityDetails"][
+                "openPortRange"
+            ]["begin"]
+            finding["portrangeend"] = f["networkReachabilityDetails"]["openPortRange"][
+                "end"
+            ]
+            finding["portrange"] = _port_range_string(f["networkReachabilityDetails"])
+        if f.get("packageVulnerabilityDetails"):
+            finding["vulnerabilityid"] = f["packageVulnerabilityDetails"][
+                "vulnerabilityId"
+            ]
+            finding["referenceurls"] = f["packageVulnerabilityDetails"].get(
+                "referenceUrls",
+            )
+            finding["relatedvulnerabilities"] = f["packageVulnerabilityDetails"].get(
+                "relatedVulnerabilities",
+            )
+            finding["source"] = f["packageVulnerabilityDetails"].get("source")
+            finding["sourceurl"] = f["packageVulnerabilityDetails"].get("sourceUrl")
+            finding["vendorcreatedat"] = f["packageVulnerabilityDetails"].get(
+                "vendorCreatedAt",
+            )
+            finding["vendorseverity"] = f["packageVulnerabilityDetails"].get(
+                "vendorSeverity",
+            )
+            finding["vendorupdatedat"] = f["packageVulnerabilityDetails"].get(
+                "vendorUpdatedAt",
+            )
+
+            new_packages = _process_packages(
+                f["packageVulnerabilityDetails"],
+                f["awsAccountId"],
+                f["findingArn"],
+            )
+            finding["vulnerablepackageids"] = list(new_packages.keys())
             packages = {**packages, **new_packages}
 
         findings_list.append(finding)
@@ -129,47 +172,51 @@ def transform_inspector_packages(packages: Dict[str, Any]) -> List[Dict[str, Any
     return packages_list
 
 
-def _process_packages(package_details: Dict[str, Any], aws_account_id: str, finding_arn: str) -> Dict[str, Any]:
+def _process_packages(
+    package_details: Dict[str, Any],
+    aws_account_id: str,
+    finding_arn: str,
+) -> Dict[str, Any]:
     packages: Dict[str, Any] = {}
-    for package in package_details['vulnerablePackages']:
+    for package in package_details["vulnerablePackages"]:
         new_package = {}
-        new_package['id'] = (
+        new_package["id"] = (
             f"{package.get('name', '')}|"
             f"{package.get('arch', '')}|"
             f"{package.get('version', '')}|"
             f"{package.get('release', '')}|"
             f"{package.get('epoch', '')}"
         )
-        new_package['name'] = package.get('name')
-        new_package['arch'] = package.get('arch')
-        new_package['version'] = package.get('version')
-        new_package['release'] = package.get('release')
-        new_package['epoch'] = package.get('epoch')
-        new_package['manager'] = package.get("packageManager")
-        new_package['filepath'] = package.get('filePath')
-        new_package['fixedinversion'] = package.get('fixedInVersion')
-        new_package['sourcelayerhash'] = package.get('sourceLayerHash')
-        new_package['awsaccount'] = aws_account_id
-        new_package['findingarn'] = finding_arn
-
-        packages[new_package['id']] = new_package
+        new_package["name"] = package.get("name")
+        new_package["arch"] = package.get("arch")
+        new_package["version"] = package.get("version")
+        new_package["release"] = package.get("release")
+        new_package["epoch"] = package.get("epoch")
+        new_package["manager"] = package.get("packageManager")
+        new_package["filepath"] = package.get("filePath")
+        new_package["fixedinversion"] = package.get("fixedInVersion")
+        new_package["sourcelayerhash"] = package.get("sourceLayerHash")
+        new_package["awsaccount"] = aws_account_id
+        new_package["findingarn"] = finding_arn
+
+        packages[new_package["id"]] = new_package
 
     return packages
 
 
 def _port_range_string(details: Dict[str, Any]) -> str:
-    begin = details['openPortRange']['begin']
-    end = details['openPortRange']['end']
+    begin = details["openPortRange"]["begin"]
+    end = details["openPortRange"]["end"]
     return f"{begin}-{end}"
 
 
 @timeit
 def load_inspector_findings(
-        neo4j_session: neo4j.Session,
-        findings: List[Dict[str, Any]],
-        region: str,
-        aws_update_tag: int,
-        current_aws_account_id: str,
+    neo4j_session: neo4j.Session,
+    findings: List[Dict[str, Any]],
+    region: str,
+    aws_update_tag: int,
+    current_aws_account_id: str,
 ) -> None:
     load(
         neo4j_session,
@@ -183,11 +230,11 @@ def load_inspector_findings(
 
 @timeit
 def load_inspector_packages(
-        neo4j_session: neo4j.Session,
-        packages: List[Dict[str, Any]],
-        region: str,
-        aws_update_tag: int,
-        current_aws_account_id: str,
+    neo4j_session: neo4j.Session,
+    packages: List[Dict[str, Any]],
+    region: str,
+    aws_update_tag: int,
+    current_aws_account_id: str,
 ) -> None:
     load(
         neo4j_session,
@@ -200,10 +247,17 @@ def load_inspector_packages(
 
 
 @timeit
-def cleanup(neo4j_session: neo4j.Session, common_job_parameters: Dict[str, Any]) -> None:
+def cleanup(
+    neo4j_session: neo4j.Session,
+    common_job_parameters: Dict[str, Any],
+) -> None:
     logger.info("Running AWS Inspector cleanup")
-    GraphJob.from_node_schema(AWSInspectorFindingSchema(), common_job_parameters).run(neo4j_session)
-    GraphJob.from_node_schema(AWSInspectorPackageSchema(), common_job_parameters).run(neo4j_session)
+    GraphJob.from_node_schema(AWSInspectorFindingSchema(), common_job_parameters).run(
+        neo4j_session,
+    )
+    GraphJob.from_node_schema(AWSInspectorPackageSchema(), common_job_parameters).run(
+        neo4j_session,
+    )
 
 
 @timeit
@@ -215,14 +269,30 @@ def sync(
     update_tag: int,
     common_job_parameters: Dict[str, Any],
 ) -> None:
-    inspector_regions = [region for region in regions if region in AWS_INSPECTOR_REGIONS]
+    inspector_regions = [
+        region for region in regions if region in AWS_INSPECTOR_REGIONS
+    ]
 
     for region in inspector_regions:
-        logger.info(f"Syncing AWS Inspector findings for account {current_aws_account_id} and region {region}")
+        logger.info(
+            f"Syncing AWS Inspector findings for account {current_aws_account_id} and region {region}",
+        )
         findings = get_inspector_findings(boto3_session, region, current_aws_account_id)
         finding_data, package_data = transform_inspector_findings(findings)
         logger.info(f"Loading {len(finding_data)} findings")
-        load_inspector_findings(neo4j_session, finding_data, region, update_tag, current_aws_account_id)
+        load_inspector_findings(
+            neo4j_session,
+            finding_data,
+            region,
+            update_tag,
+            current_aws_account_id,
+        )
         logger.info(f"Loading {len(package_data)} packages")
-        load_inspector_packages(neo4j_session, package_data, region, update_tag, current_aws_account_id)
+        load_inspector_packages(
+            neo4j_session,
+            package_data,
+            region,
+            update_tag,
+            current_aws_account_id,
+        )
         cleanup(neo4j_session, common_job_parameters)