cartography 0.102.0rc2__py3-none-any.whl → 0.103.0rc1__py3-none-any.whl

cartography/intel/aws/permission_relationships.py

@@ -19,7 +19,7 @@ logger = logging.getLogger(__name__)
 
 
 def evaluate_clause(clause: str, match: str) -> bool:
-    """ Evaluates the a clause in IAM. Clauses can be AWS [not]actions and [not]resources
+    """Evaluates the a clause in IAM. Clauses can be AWS [not]actions and [not]resources
 
     Arguments:
         clause {str, re.Pattern} -- The clause you are evaluating against. Clauses can use
@@ -36,9 +36,9 @@ def evaluate_clause(clause: str, match: str) -> bool:
 
 def evaluate_notaction_for_permission(statement: Dict, permission: str) -> bool:
     """Return whether an IAM 'notaction' clause in the given statement applies to the item"""
-    if 'notaction' not in statement:
+    if "notaction" not in statement:
         return False
-    for clause in statement['notaction']:
+    for clause in statement["notaction"]:
         if evaluate_clause(clause, permission):
             return True
     return False
@@ -46,9 +46,9 @@ def evaluate_notaction_for_permission(statement: Dict, permission: str) -> bool:
 
 def evaluate_action_for_permission(statement: Dict, permission: str) -> bool:
     """Return whether an IAM 'action' clause in the given statement applies to the permission"""
-    if 'action' not in statement:
+    if "action" not in statement:
         return True
-    for clause in statement['action']:
+    for clause in statement["action"]:
         if evaluate_clause(clause, permission):
             return True
     return False
@@ -56,9 +56,9 @@ def evaluate_action_for_permission(statement: Dict, permission: str) -> bool:
 
 def evaluate_resource_for_permission(statement: Dict, resource_arn: str) -> bool:
     """Return whether the given IAM 'resource' statement applies to the resource_arn"""
-    if 'resource' not in statement:
+    if "resource" not in statement:
         return False
-    for clause in statement['resource']:
+    for clause in statement["resource"]:
         if evaluate_clause(clause, resource_arn):
             return True
     return False
@@ -66,16 +66,20 @@ def evaluate_resource_for_permission(statement: Dict, resource_arn: str) -> bool
 
 def evaluate_notresource_for_permission(statement: Dict, resource_arn: str) -> bool:
     """Return whether an IAM 'notresource' clause in the given statement applies to the resource_arn"""
-    if 'notresource' not in statement:
+    if "notresource" not in statement:
         return False
-    for clause in statement['notresource']:
+    for clause in statement["notresource"]:
         if evaluate_clause(clause, resource_arn):
             return True
     return False
 
 
-def evaluate_statements_for_permission(statements: List[Dict], permission: str, resource_arn: str) -> bool:
-    """ Evaluate an entire statement for a specific permission against a resource
+def evaluate_statements_for_permission(
+    statements: List[Dict],
+    permission: str,
+    resource_arn: str,
+) -> bool:
+    """Evaluate an entire statement for a specific permission against a resource
 
     Arguments:
         statements {[dict]} -- The list of statements to be evaluated
@@ -97,9 +101,11 @@ def evaluate_statements_for_permission(statements: List[Dict], permission: str,
 
 
 def evaluate_policy_for_permissions(
-    statements: List[Dict], permissions: List[str], resource_arn: str,
+    statements: List[Dict],
+    permissions: List[str],
+    resource_arn: str,
 ) -> Tuple[bool, bool]:
-    """ Evaluates an entire policy for specific permissions to a resource.
+    """Evaluates an entire policy for specific permissions to a resource.
     AWS Policy evaluation reference
     https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
 
@@ -118,19 +124,31 @@ def evaluate_policy_for_permissions(
     allow_statements = [s for s in statements if s["effect"] == "Allow"]
     deny_statements = [s for s in statements if s["effect"] == "Deny"]
     for permission in permissions:
-        if evaluate_statements_for_permission(deny_statements, permission, resource_arn):
+        if evaluate_statements_for_permission(
+            deny_statements,
+            permission,
+            resource_arn,
+        ):
             # The action explicitly denied then no other policy can override it
             return False, True
         else:
-            if evaluate_statements_for_permission(allow_statements, permission, resource_arn):
+            if evaluate_statements_for_permission(
+                allow_statements,
+                permission,
+                resource_arn,
+            ):
                 # The action is allowed by this policy
                 return True, False
     # The action is not allowed by this policy, but not specifically denied either
     return False, False
 
 
-def principal_allowed_on_resource(policies: Dict, resource_arn: str, permissions: List[str]) -> bool:
-    """ Evaluates an enture set of policies for a specific resource for a specific permission.
+def principal_allowed_on_resource(
+    policies: Dict,
+    resource_arn: str,
+    permissions: List[str],
+) -> bool:
+    """Evaluates an enture set of policies for a specific resource for a specific permission.
 
 
     Arguments:
@@ -145,7 +163,11 @@ def principal_allowed_on_resource(policies: Dict, resource_arn: str, permissions
         raise ValueError("permissions is not a list")
     granted = False
     for _, statements in policies.items():
-        allowed, explicit_deny = evaluate_policy_for_permissions(statements, permissions, resource_arn)
+        allowed, explicit_deny = evaluate_policy_for_permissions(
+            statements,
+            permissions,
+            resource_arn,
+        )
 
         if explicit_deny:
 
@@ -157,9 +179,11 @@ def principal_allowed_on_resource(policies: Dict, resource_arn: str, permissions
 
 
 def calculate_permission_relationships(
-    principals: Dict, resource_arns: List[str], permissions: List[str],
+    principals: Dict,
+    resource_arns: List[str],
+    permissions: List[str],
 ) -> List[Dict]:
-    """ Evaluate principals permissions to resources
+    """Evaluate principals permissions to resources
     This currently only evaluates policies on IAM principals. It does not take into account
     Resource Policies - Policies attached to the resource instead of the IAM principal
     Permission Boundaries - Boundaries for an IAM principal
@@ -180,12 +204,14 @@ def calculate_permission_relationships(
     for resource_arn in resource_arns:
         for principal_arn, policies in principals.items():
             if principal_allowed_on_resource(policies, resource_arn, permissions):
-                allowed_mappings.append({"principal_arn": principal_arn, "resource_arn": resource_arn})
+                allowed_mappings.append(
+                    {"principal_arn": principal_arn, "resource_arn": resource_arn},
+                )
     return allowed_mappings
 
 
 def parse_statement_node(node_group: List[Any]) -> List[Any]:
-    """ Parse a dict from group of Neo4J node
+    """Parse a dict from group of Neo4J node
 
     Arguments:
         node_group {[Neo4j.Node]} -- the node to parse
@@ -197,7 +223,7 @@ def parse_statement_node(node_group: List[Any]) -> List[Any]:
 
 
 def compile_regex(item: str) -> Pattern:
-    r""" Compile a clause into a regex. Clause checking in AWS is case insensitive
+    r"""Compile a clause into a regex. Clause checking in AWS is case insensitive
     The following regex symbols will be replaced to make AWS * and ? matching a regex
     * -> .* (wildcard)
     ? -> .? (single character wildcard)
@@ -225,7 +251,7 @@ def compile_regex(item: str) -> Pattern:
 
 
 def compile_statement(statements: List[Any]) -> List[Any]:
-    """ Compile a statement by precompiling the regex for the relevant clauses. This is done to boost
+    """Compile a statement by precompiling the regex for the relevant clauses. This is done to boost
     performance by not recompiling the regex over and over again.
 
     Arguments:
@@ -234,11 +260,13 @@ def compile_statement(statements: List[Any]) -> List[Any]:
     Returns:
         [dict] -- the compiled statement
     """
-    properties = ['action', 'resource', 'notresource', 'notaction']
+    properties = ["action", "resource", "notresource", "notaction"]
     for statement in statements:
         for statement_property in properties:
             if statement_property in statement:
-                statement[statement_property] = [compile_regex(item) for item in statement[statement_property]]
+                statement[statement_property] = [
+                    compile_regex(item) for item in statement[statement_property]
+                ]
     return statements
 
 
@@ -263,16 +291,26 @@ def get_principals_for_account(neo4j_session: neo4j.Session, account_id: str) ->
         statements = r["statements"]
         if principal_arn not in principals:
             principals[principal_arn] = {}
-        principals[principal_arn][policy_id] = compile_statement(parse_statement_node(statements))
+        principals[principal_arn][policy_id] = compile_statement(
+            parse_statement_node(statements),
+        )
     return principals
 
 
-def get_resource_arns(neo4j_session: neo4j.Session, account_id: str, node_label: str) -> List[Any]:
-    get_resource_query = Template("""
+def get_resource_arns(
+    neo4j_session: neo4j.Session,
+    account_id: str,
+    node_label: str,
+) -> List[Any]:
+    get_resource_query = Template(
+        """
     MATCH (acc:AWSAccount{id:$AccountId})-[:RESOURCE]->(resource:$node_label)
     return resource.arn as arn
-    """)
-    get_resource_query_template = get_resource_query.safe_substitute(node_label=node_label)
+    """,
+    )
+    get_resource_query_template = get_resource_query.safe_substitute(
+        node_label=node_label,
+    )
     results = neo4j_session.run(
         get_resource_query_template,
         AccountId=account_id,
@@ -282,16 +320,21 @@ def get_resource_arns(neo4j_session: neo4j.Session, account_id: str, node_label:
 
 
 def load_principal_mappings(
-    neo4j_session: neo4j.Session, principal_mappings: List[Dict], node_label: str,
-    relationship_name: str, update_tag: int,
+    neo4j_session: neo4j.Session,
+    principal_mappings: List[Dict],
+    node_label: str,
+    relationship_name: str,
+    update_tag: int,
 ) -> None:
-    map_policy_query = Template("""
+    map_policy_query = Template(
+        """
     UNWIND $Mapping as mapping
     MATCH (principal:AWSPrincipal{arn:mapping.principal_arn})
     MATCH (resource:$node_label{arn:mapping.resource_arn})
     MERGE (principal)-[r:$relationship_name]->(resource)
     SET r.lastupdated = $aws_update_tag
-    """)
+    """,
+    )
     if not principal_mappings:
         return
     map_policy_query_template = map_policy_query.safe_substitute(
@@ -306,16 +349,25 @@ def load_principal_mappings(
 
 
 def cleanup_rpr(
-    neo4j_session: neo4j.Session, node_label: str, relationship_name: str, update_tag: int,
+    neo4j_session: neo4j.Session,
+    node_label: str,
+    relationship_name: str,
+    update_tag: int,
     current_aws_id: str,
 ) -> None:
-    logger.info("Cleaning up relationship '%s' for node label '%s'", relationship_name, node_label)
-    cleanup_rpr_query = Template("""
+    logger.info(
+        "Cleaning up relationship '%s' for node label '%s'",
+        relationship_name,
+        node_label,
+    )
+    cleanup_rpr_query = Template(
+        """
         MATCH (:AWSAccount{id: $AWS_ID})-[:RESOURCE]->(principal:AWSPrincipal)-[r:$relationship_name]->
         (resource:$node_label)
         WHERE r.lastupdated <> $UPDATE_TAG
         WITH r LIMIT $LIMIT_SIZE  DELETE (r) return COUNT(*) as TotalCompleted
-    """)
+    """,
+    )
     cleanup_rpr_query_template = cleanup_rpr_query.safe_substitute(
         node_label=node_label,
         relationship_name=relationship_name,
@@ -323,7 +375,7 @@ def cleanup_rpr(
 
     statement = GraphStatement(
         cleanup_rpr_query_template,
-        {'UPDATE_TAG': update_tag, 'AWS_ID': current_aws_id},
+        {"UPDATE_TAG": update_tag, "AWS_ID": current_aws_id},
         True,
         1000,
         parent_job_name=f"{relationship_name}:{node_label}",
@@ -359,10 +411,17 @@ def is_valid_rpr(rpr: Dict) -> bool:
 
 @timeit
 def sync(
-    neo4j_session: neo4j.Session, boto3_session: boto3.session.Session, regions: List[str], current_aws_account_id: str,
-    update_tag: int, common_job_parameters: Dict,
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    regions: List[str],
+    current_aws_account_id: str,
+    update_tag: int,
+    common_job_parameters: Dict,
 ) -> None:
-    logger.info("Syncing Permission Relationships for account '%s'.", current_aws_account_id)
+    logger.info(
+        "Syncing Permission Relationships for account '%s'.",
+        current_aws_account_id,
+    )
     principals = get_principals_for_account(neo4j_session, current_aws_account_id)
     pr_file = common_job_parameters["permission_relationships_file"]
     if not pr_file:
@@ -374,18 +433,41 @@ def sync(
     relationship_mapping = parse_permission_relationships_file(pr_file)
     for rpr in relationship_mapping:
         if not is_valid_rpr(rpr):
-            raise ValueError("""
+            raise ValueError(
+                """
         Resource permission relationship is missing fields.
         Required fields: permissions, relationship_name, target_label"
-        """)
+        """,
+            )
         permissions = rpr["permissions"]
         relationship_name = rpr["relationship_name"]
         target_label = rpr["target_label"]
-        resource_arns = get_resource_arns(neo4j_session, current_aws_account_id, target_label)
-        logger.info("Syncing relationship '%s' for node label '%s'", relationship_name, target_label)
-        allowed_mappings = calculate_permission_relationships(principals, resource_arns, permissions)
+        resource_arns = get_resource_arns(
+            neo4j_session,
+            current_aws_account_id,
+            target_label,
+        )
+        logger.info(
+            "Syncing relationship '%s' for node label '%s'",
+            relationship_name,
+            target_label,
+        )
+        allowed_mappings = calculate_permission_relationships(
+            principals,
+            resource_arns,
+            permissions,
+        )
         load_principal_mappings(
-            neo4j_session, allowed_mappings,
-            target_label, relationship_name, update_tag,
+            neo4j_session,
+            allowed_mappings,
+            target_label,
+            relationship_name,
+            update_tag,
+        )
+        cleanup_rpr(
+            neo4j_session,
+            target_label,
+            relationship_name,
+            update_tag,
+            current_aws_account_id,
         )
-        cleanup_rpr(neo4j_session, target_label, relationship_name, update_tag, current_aws_account_id)