cartography 0.102.0rc1__py3-none-any.whl → 0.103.0__py3-none-any.whl

cartography/intel/tailscale/users.py

@@ -0,0 +1,80 @@
+import logging
+from typing import Any
+from typing import Dict
+from typing import List
+
+import neo4j
+import requests
+
+from cartography.client.core.tx import load
+from cartography.graph.job import GraphJob
+from cartography.models.tailscale.user import TailscaleUserSchema
+from cartography.util import timeit
+
+logger = logging.getLogger(__name__)
+# Connect and read timeouts of 60 seconds each; see https://requests.readthedocs.io/en/master/user/advanced/#timeouts
+_TIMEOUT = (60, 60)
+
+
+@timeit
+def sync(
+    neo4j_session: neo4j.Session,
+    api_session: requests.Session,
+    common_job_parameters: Dict[str, Any],
+    org: str,
+) -> List[Dict]:
+    users = get(
+        api_session,
+        common_job_parameters["BASE_URL"],
+        org,
+    )
+    load_users(
+        neo4j_session,
+        users,
+        org,
+        common_job_parameters["UPDATE_TAG"],
+    )
+    cleanup(neo4j_session, common_job_parameters)
+    return users
+
+
+@timeit
+def get(
+    api_session: requests.Session,
+    base_url: str,
+    org: str,
+) -> List[Dict[str, Any]]:
+    results: List[Dict[str, Any]] = []
+    req = api_session.get(
+        f"{base_url}/tailnet/{org}/users",
+        timeout=_TIMEOUT,
+    )
+    req.raise_for_status()
+    results = req.json()["users"]
+    return results
+
+
+@timeit
+def load_users(
+    neo4j_session: neo4j.Session,
+    data: List[Dict[str, Any]],
+    org: str,
+    update_tag: int,
+) -> None:
+    logger.info(f"Loading {len(data)} Tailscale Users to the graph")
+    load(
+        neo4j_session,
+        TailscaleUserSchema(),
+        data,
+        lastupdated=update_tag,
+        org=org,
+    )
+
+
+@timeit
+def cleanup(
+    neo4j_session: neo4j.Session, common_job_parameters: Dict[str, Any]
+) -> None:
+    GraphJob.from_node_schema(TailscaleUserSchema(), common_job_parameters).run(
+        neo4j_session
+    )

cartography/intel/tailscale/utils.py

@@ -0,0 +1,132 @@
+import json
+import re
+from typing import Any
+from typing import Dict
+from typing import List
+
+
+class ACLParser:
+    """ACLParser is a class that parses Tailscale ACLs to extract data.
+
+    It removes comments and trailing commas from the ACL string
+    and converts it to a JSON object. It then provides methods
+    to extract groups and tags from the ACL.
+    The ACL string is expected to be in a format similar to JSON,
+    but with some Tailscale-specific syntax. The parser handles
+    single-line comments (//) and multi-line comments (/* */)
+    and removes trailing commas from the JSON-like structure.
+    The parser also handles Tailscale-specific syntax for groups
+    and tags, which may include user and group identifiers.
+    The parser is initialized with a raw ACL string, which is
+    processed to remove comments and trailing commas.
+
+    Args:
+        raw_acl (str): The raw ACL string to be parsed.
+
+    Attributes:
+        data (dict): The parsed JSON object representing the ACL.
+    """
+
+    RE_SINGLE_LINE_COMMENT = re.compile(r'("(?:(?=(\\?))\2.)*?")|(?:\/{2,}.*)')
+    RE_MULTI_LINE_COMMENT = re.compile(
+        r'("(?:(?=(\\?))\2.)*?")|(?:\/\*(?:(?!\*\/).)+\*\/)', flags=re.M | re.DOTALL
+    )
+    RE_TRAILING_COMMA = re.compile(r",(?=\s*?[\}\]])")
+
+    def __init__(self, raw_acl: str) -> None:
+        # Tailscale ACL use comments and trailing commas
+        # that are not valid JSON
+        filtered_json_string = self.RE_SINGLE_LINE_COMMENT.sub(r"\1", raw_acl)
+        filtered_json_string = self.RE_MULTI_LINE_COMMENT.sub(
+            r"\1", filtered_json_string
+        )
+        filtered_json_string = self.RE_TRAILING_COMMA.sub("", filtered_json_string)
+        self.data = json.loads(filtered_json_string)
+
+    def get_groups(self) -> List[Dict[str, Any]]:
+        """
+        Get all groups from the ACL
+
+        :return: list of groups
+        """
+        result: List[Dict[str, Any]] = []
+        groups = self.data.get("groups", {})
+        for group_id, members in groups.items():
+            group_name = group_id.split(":")[-1]
+            users_members = []
+            sub_groups = []
+            domain_members = []
+            for member in members:
+                if member.startswith("group:") or member.startswith("autogroup:"):
+                    sub_groups.append(member)
+                elif member.startswith("user:*@"):
+                    domain_members.append(member[7:])
+                elif member.startswith("user:"):
+                    users_members.append(member[5:])
+                else:
+                    users_members.append(member)
+            result.append(
+                {
+                    "id": group_id,
+                    "name": group_name,
+                    "members": users_members,
+                    "sub_groups": sub_groups,
+                    "domain_members": domain_members,
+                }
+            )
+        return result
+
+    def get_tags(self) -> List[Dict[str, Any]]:
+        """
+        Get all tags from the ACL
+
+        :return: list of tags
+        """
+        result: List[Dict[str, Any]] = []
+        for tag, owners in self.data.get("tagOwners", {}).items():
+            tag_name = tag.split(":")[-1]
+            user_owners = []
+            group_owners = []
+            domain_owners = []
+            for owner in owners:
+                if owner.startswith("group:") or owner.startswith("autogroup:"):
+                    group_owners.append(owner)
+                elif owner.startswith("user:*@"):
+                    domain_owners.append(owner[7:])
+                elif owner.startswith("user:"):
+                    user_owners.append(owner[5:])
+                else:
+                    user_owners.append(owner)
+            result.append(
+                {
+                    "id": tag,
+                    "name": tag_name,
+                    "owners": user_owners,
+                    "group_owners": group_owners,
+                    "domain_owners": domain_owners,
+                }
+            )
+        return result
+
+
+def role_to_group(role: str) -> list[str]:
+    """Convert Tailscale role to group
+
+    This function is used to convert Tailscale role to autogroup
+    group. The autogroup is used to manage the access control
+    in Tailscale.
+
+    Args:
+        role (str): The role of the user in Tailscale. (eg: owner, admin, member, etc)
+
+    Returns:
+        list[str]: The list of autogroup that the user belongs to. (eg: autogroup:admin, autogroup:member, etc)
+    """
+    result: list[str] = []
+    result.append(f"autogroup:{role}")
+    if role == "owner":
+        result.append("autogroup:admin")
+        result.append("autogroup:member")
+    elif role in ("admin", "auditor", "billing-admin", "it-admin", "network-admin"):
+        result.append("autogroup:member")
+    return result

cartography/models/aws/apigateway.py

@@ -12,36 +12,40 @@ from cartography.models.core.relationships import TargetNodeMatcher
 
 @dataclass(frozen=True)
 class APIGatewayRestAPINodeProperties(CartographyNodeProperties):
-    id: PropertyRef = PropertyRef('id', extra_index=True)
-    createddate: PropertyRef = PropertyRef('createdDate')
-    version: PropertyRef = PropertyRef('version')
-    minimumcompressionsize: PropertyRef = PropertyRef('minimumCompressionSize')
-    disableexecuteapiendpoint: PropertyRef = PropertyRef('disableExecuteApiEndpoint')
-    region: PropertyRef = PropertyRef('region', set_in_kwargs=True)
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
-    anonymous_access: PropertyRef = PropertyRef('anonymous_access')
-    anonymous_actions: PropertyRef = PropertyRef('anonymous_actions')
+    id: PropertyRef = PropertyRef("id", extra_index=True)
+    createddate: PropertyRef = PropertyRef("createdDate")
+    version: PropertyRef = PropertyRef("version")
+    minimumcompressionsize: PropertyRef = PropertyRef("minimumCompressionSize")
+    disableexecuteapiendpoint: PropertyRef = PropertyRef("disableExecuteApiEndpoint")
+    region: PropertyRef = PropertyRef("region", set_in_kwargs=True)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    anonymous_access: PropertyRef = PropertyRef("anonymous_access")
+    anonymous_actions: PropertyRef = PropertyRef("anonymous_actions")
 
 
 @dataclass(frozen=True)
-class APIGatewayRestAPIToAwsAccountRelProperties(CartographyRelProperties):
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+class APIGatewayRestAPIToAWSAccountRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
 # (:APIGatewayRestAPI)<-[:RESOURCE]-(:AWSAccount)
-class APIGatewayRestAPIToAWSAccount(CartographyRelSchema):
-    target_node_label: str = 'AWSAccount'
+class APIGatewayRestAPIToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
     target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
-        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
     )
     direction: LinkDirection = LinkDirection.INWARD
     rel_label: str = "RESOURCE"
-    properties: APIGatewayRestAPIToAwsAccountRelProperties = APIGatewayRestAPIToAwsAccountRelProperties()
+    properties: APIGatewayRestAPIToAWSAccountRelRelProperties = (
+        APIGatewayRestAPIToAWSAccountRelRelProperties()
+    )
 
 
 @dataclass(frozen=True)
 class APIGatewayRestAPISchema(CartographyNodeSchema):
-    label: str = 'APIGatewayRestAPI'
+    label: str = "APIGatewayRestAPI"
     properties: APIGatewayRestAPINodeProperties = APIGatewayRestAPINodeProperties()
-    sub_resource_relationship: APIGatewayRestAPIToAWSAccount = APIGatewayRestAPIToAWSAccount()
+    sub_resource_relationship: APIGatewayRestAPIToAWSAccountRel = (
+        APIGatewayRestAPIToAWSAccountRel()
+    )

cartography/models/aws/apigatewaycertificate.py

@@ -13,54 +13,60 @@ from cartography.models.core.relationships import TargetNodeMatcher
 
 @dataclass(frozen=True)
 class APIGatewayClientCertificateNodeProperties(CartographyNodeProperties):
-    id: PropertyRef = PropertyRef('clientCertificateId')
-    createddate: PropertyRef = PropertyRef('createdDate')
-    expirationdate: PropertyRef = PropertyRef('expirationDate')
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+    id: PropertyRef = PropertyRef("clientCertificateId")
+    createddate: PropertyRef = PropertyRef("createdDate")
+    expirationdate: PropertyRef = PropertyRef("expirationDate")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
-class APIGatewayClientCertificateToStageRelProperties(CartographyRelProperties):
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+class APIGatewayClientCertificateToStageRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
-class CertToStageRelProps(CartographyRelProperties):
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+class CertToStageRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
 # (:APIGatewayStage)-[:HAS_CERTIFICATE]->(:APIGatewayClientCertificate)
-class APIGatewayClientCertificateToStage(CartographyRelSchema):
-    target_node_label: str = 'APIGatewayStage'
+class APIGatewayClientCertificateToStageRel(CartographyRelSchema):
+    target_node_label: str = "APIGatewayStage"
     target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
-        {'id': PropertyRef('stageArn')},
+        {"id": PropertyRef("stageArn")},
     )
     direction: LinkDirection = LinkDirection.INWARD
     rel_label: str = "HAS_CERTIFICATE"
-    properties: CertToStageRelProps = CertToStageRelProps()
+    properties: CertToStageRelProperties = CertToStageRelProperties()
 
 
 @dataclass(frozen=True)
-class CertToAccountRelProps(CartographyRelProperties):
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+class CertToAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
 # (:APIGatewayClientCertificate)<-[:RESOURCE]-(:AWSAccount)
-class APIGatewayClientCertificateToAWSAccount(CartographyRelSchema):
-    target_node_label: str = 'AWSAccount'
+class APIGatewayClientCertificateToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
     target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
-        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
     )
     direction: LinkDirection = LinkDirection.INWARD
     rel_label: str = "RESOURCE"
-    properties: CertToAccountRelProps = CertToAccountRelProps()
+    properties: CertToAccountRelProperties = CertToAccountRelProperties()
 
 
 @dataclass(frozen=True)
 class APIGatewayClientCertificateSchema(CartographyNodeSchema):
-    label: str = 'APIGatewayClientCertificate'
-    properties: APIGatewayClientCertificateNodeProperties = APIGatewayClientCertificateNodeProperties()
-    sub_resource_relationship: APIGatewayClientCertificateToAWSAccount = APIGatewayClientCertificateToAWSAccount()
-    other_relationships: OtherRelationships = OtherRelationships([APIGatewayClientCertificateToStage()])
+    label: str = "APIGatewayClientCertificate"
+    properties: APIGatewayClientCertificateNodeProperties = (
+        APIGatewayClientCertificateNodeProperties()
+    )
+    sub_resource_relationship: APIGatewayClientCertificateToAWSAccountRel = (
+        APIGatewayClientCertificateToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [APIGatewayClientCertificateToStageRel()],
+    )

cartography/models/aws/apigatewayresource.py

@@ -13,50 +13,58 @@ from cartography.models.core.relationships import TargetNodeMatcher
 
 @dataclass(frozen=True)
 class APIGatewayResourceNodeProperties(CartographyNodeProperties):
-    id: PropertyRef = PropertyRef('id')
-    path: PropertyRef = PropertyRef('path')
-    pathpart: PropertyRef = PropertyRef('pathPart')
-    parentid: PropertyRef = PropertyRef('parentId')
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+    id: PropertyRef = PropertyRef("id")
+    path: PropertyRef = PropertyRef("path")
+    pathpart: PropertyRef = PropertyRef("pathPart")
+    parentid: PropertyRef = PropertyRef("parentId")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
-class APIGatewayResourceToRestAPIRelProperties(CartographyRelProperties):
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+class APIGatewayResourceToRestAPIRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
 # (:APIGatewayResource)<-[:RESOURCE]-(:APIGatewayRestAPI)
-class APIGatewayResourceToRestAPI(CartographyRelSchema):
-    target_node_label: str = 'APIGatewayRestAPI'
+class APIGatewayResourceToRestAPIRel(CartographyRelSchema):
+    target_node_label: str = "APIGatewayRestAPI"
     target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
-        {'id': PropertyRef('apiId')},
+        {"id": PropertyRef("apiId")},
     )
     direction: LinkDirection = LinkDirection.INWARD
     rel_label: str = "RESOURCE"
-    properties: APIGatewayResourceToRestAPIRelProperties = APIGatewayResourceToRestAPIRelProperties()
+    properties: APIGatewayResourceToRestAPIRelRelProperties = (
+        APIGatewayResourceToRestAPIRelRelProperties()
+    )
 
 
 @dataclass(frozen=True)
-class APIGatewayResourceToAwsAccountRelProperties(CartographyRelProperties):
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+class APIGatewayResourceToAWSAccountRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
 # (:APIGatewayResource)<-[:RESOURCE]-(:AWSAccount)
-class APIGatewayResourceToAWSAccount(CartographyRelSchema):
-    target_node_label: str = 'AWSAccount'
+class APIGatewayResourceToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
     target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
-        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
     )
     direction: LinkDirection = LinkDirection.INWARD
     rel_label: str = "RESOURCE"
-    properties: APIGatewayResourceToAwsAccountRelProperties = APIGatewayResourceToAwsAccountRelProperties()
+    properties: APIGatewayResourceToAWSAccountRelRelProperties = (
+        APIGatewayResourceToAWSAccountRelRelProperties()
+    )
 
 
 @dataclass(frozen=True)
 class APIGatewayResourceSchema(CartographyNodeSchema):
-    label: str = 'APIGatewayResource'
+    label: str = "APIGatewayResource"
     properties: APIGatewayResourceNodeProperties = APIGatewayResourceNodeProperties()
-    sub_resource_relationship: APIGatewayResourceToAWSAccount = APIGatewayResourceToAWSAccount()
-    other_relationships: OtherRelationships = OtherRelationships([APIGatewayResourceToRestAPI()])
+    sub_resource_relationship: APIGatewayResourceToAWSAccountRel = (
+        APIGatewayResourceToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [APIGatewayResourceToRestAPIRel()],
+    )

cartography/models/aws/apigatewaystage.py

@@ -13,55 +13,63 @@ from cartography.models.core.relationships import TargetNodeMatcher
 
 @dataclass(frozen=True)
 class APIGatewayStageNodeProperties(CartographyNodeProperties):
-    id: PropertyRef = PropertyRef('arn')
-    stagename: PropertyRef = PropertyRef('stageName')
-    createddate: PropertyRef = PropertyRef('createdDate')
-    deploymentid: PropertyRef = PropertyRef('deploymentId')
-    clientcertificateid: PropertyRef = PropertyRef('clientCertificateId')
-    cacheclusterenabled: PropertyRef = PropertyRef('cacheClusterEnabled')
-    cacheclusterstatus: PropertyRef = PropertyRef('cacheClusterStatus')
-    tracingenabled: PropertyRef = PropertyRef('tracingEnabled')
-    webaclarn: PropertyRef = PropertyRef('webAclArn')
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+    id: PropertyRef = PropertyRef("arn")
+    stagename: PropertyRef = PropertyRef("stageName")
+    createddate: PropertyRef = PropertyRef("createdDate")
+    deploymentid: PropertyRef = PropertyRef("deploymentId")
+    clientcertificateid: PropertyRef = PropertyRef("clientCertificateId")
+    cacheclusterenabled: PropertyRef = PropertyRef("cacheClusterEnabled")
+    cacheclusterstatus: PropertyRef = PropertyRef("cacheClusterStatus")
+    tracingenabled: PropertyRef = PropertyRef("tracingEnabled")
+    webaclarn: PropertyRef = PropertyRef("webAclArn")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
-class APIGatewayStageToRestAPIRelProperties(CartographyRelProperties):
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+class APIGatewayStageToRestAPIRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
 # (:APIGatewayStage)<-[:ASSOCIATED_WITH]-(:APIGatewayRestAPI)
-class APIGatewayStageToRestAPI(CartographyRelSchema):
-    target_node_label: str = 'APIGatewayRestAPI'
+class APIGatewayStageToRestAPIRel(CartographyRelSchema):
+    target_node_label: str = "APIGatewayRestAPI"
     target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
-        {'id': PropertyRef('apiId')},
+        {"id": PropertyRef("apiId")},
     )
     direction: LinkDirection = LinkDirection.INWARD
     rel_label: str = "ASSOCIATED_WITH"
-    properties: APIGatewayStageToRestAPIRelProperties = APIGatewayStageToRestAPIRelProperties()
+    properties: APIGatewayStageToRestAPIRelRelProperties = (
+        APIGatewayStageToRestAPIRelRelProperties()
+    )
 
 
 @dataclass(frozen=True)
-class APIGatewayStageToAwsAccountRelProperties(CartographyRelProperties):
-    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+class APIGatewayStageToAWSAccountRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
 
 
 @dataclass(frozen=True)
 # (:APIGatewayStage)<-[:RESOURCE]-(:AWSAccount)
-class APIGatewayStageToAWSAccount(CartographyRelSchema):
-    target_node_label: str = 'AWSAccount'
+class APIGatewayStageToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
     target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
-        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
     )
     direction: LinkDirection = LinkDirection.INWARD
     rel_label: str = "RESOURCE"
-    properties: APIGatewayStageToAwsAccountRelProperties = APIGatewayStageToAwsAccountRelProperties()
+    properties: APIGatewayStageToAWSAccountRelRelProperties = (
+        APIGatewayStageToAWSAccountRelRelProperties()
+    )
 
 
 @dataclass(frozen=True)
 class APIGatewayStageSchema(CartographyNodeSchema):
-    label: str = 'APIGatewayStage'
+    label: str = "APIGatewayStage"
     properties: APIGatewayStageNodeProperties = APIGatewayStageNodeProperties()
-    sub_resource_relationship: APIGatewayStageToAWSAccount = APIGatewayStageToAWSAccount()
-    other_relationships: OtherRelationships = OtherRelationships([APIGatewayStageToRestAPI()])
+    sub_resource_relationship: APIGatewayStageToAWSAccountRel = (
+        APIGatewayStageToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [APIGatewayStageToRestAPIRel()],
+    )

cartography/models/aws/cloudtrail/trail.py

@@ -0,0 +1,61 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("TrailARN")
+    arn: PropertyRef = PropertyRef("TrailARN")
+    name: PropertyRef = PropertyRef("Name")
+    region: PropertyRef = PropertyRef("Region", set_in_kwargs=True)
+    cloudwatch_logs_log_group_arn: PropertyRef = PropertyRef(
+        "CloudWatchLogsLogGroupArn"
+    )
+    cloudwatch_logs_role_arn: PropertyRef = PropertyRef("CloudWatchLogsRoleArn")
+    has_custom_event_selectors: PropertyRef = PropertyRef("HasCustomEventSelectors")
+    has_insight_selectors: PropertyRef = PropertyRef("HasInsightSelectors")
+    home_region: PropertyRef = PropertyRef("HomeRegion")
+    include_global_service_events: PropertyRef = PropertyRef(
+        "IncludeGlobalServiceEvents"
+    )
+    is_multi_region_trail: PropertyRef = PropertyRef("IsMultiRegionTrail")
+    is_organization_trail: PropertyRef = PropertyRef("IsOrganizationTrail")
+    kms_key_id: PropertyRef = PropertyRef("KmsKeyId")
+    log_file_validation_enabled: PropertyRef = PropertyRef("LogFileValidationEnabled")
+    s3_bucket_name: PropertyRef = PropertyRef("S3BucketName")
+    s3_key_prefix: PropertyRef = PropertyRef("S3KeyPrefix")
+    sns_topic_arn: PropertyRef = PropertyRef("SnsTopicARN")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudTrailToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: CloudTrailTrailToAwsAccountRelProperties = (
+        CloudTrailTrailToAwsAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailSchema(CartographyNodeSchema):
+    label: str = "CloudTrailTrail"
+    properties: CloudTrailTrailNodeProperties = CloudTrailTrailNodeProperties()
+    sub_resource_relationship: CloudTrailToAWSAccountRel = CloudTrailToAWSAccountRel()

cartography/models/aws/cloudwatch/loggroup.py

@@ -0,0 +1,52 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class CloudWatchLogGroupNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("logGroupArn")
+    arn: PropertyRef = PropertyRef("logGroupArn", extra_index=True)
+    creation_time: PropertyRef = PropertyRef("creationTime")
+    data_protection_status: PropertyRef = PropertyRef("dataProtectionStatus")
+    inherited_properties: PropertyRef = PropertyRef("inheritedProperties")
+    kms_key_id: PropertyRef = PropertyRef("kmsKeyId")
+    log_group_arn: PropertyRef = PropertyRef("logGroupArn")
+    log_group_class: PropertyRef = PropertyRef("logGroupClass")
+    log_group_name: PropertyRef = PropertyRef("logGroupName")
+    metric_filter_count: PropertyRef = PropertyRef("metricFilterCount")
+    retention_in_days: PropertyRef = PropertyRef("retentionInDays")
+    stored_bytes: PropertyRef = PropertyRef("storedBytes")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudWatchLogGroupToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudWatchToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: CloudWatchLogGroupToAwsAccountRelProperties = (
+        CloudWatchLogGroupToAwsAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class CloudWatchLogGroupSchema(CartographyNodeSchema):
+    label: str = "CloudWatchLogGroup"
+    properties: CloudWatchLogGroupNodeProperties = CloudWatchLogGroupNodeProperties()
+    sub_resource_relationship: CloudWatchToAWSAccountRel = CloudWatchToAWSAccountRel()