cartography 0.104.0rc2__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/rules/data/rules/database_instance_exposed.py

@@ -0,0 +1,53 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS Facts
+_aws_rds_public_access = Fact(
+    id="aws_rds_public_access",
+    name="Internet-Accessible RDS Database Attack Surface",
+    description="AWS RDS instances accessible from the internet",
+    cypher_query="""
+    MATCH (rds:RDSInstance)
+    WHERE rds.publicly_accessible = true
+    RETURN rds.id AS id,
+        rds.engine AS engine,
+        rds.db_instance_class AS instance_class,
+        rds.endpoint_address AS host,
+        rds.endpoint_port AS port,
+        rds.region AS region,
+        rds.storage_encrypted AS encrypted
+    """,
+    cypher_visual_query="""
+    MATCH p1=(rds:RDSInstance{publicly_accessible: true})
+    OPTIONAL MATCH p2=(rds)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)
+    OPTIONAL MATCH p3=(rds)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)<-[:MEMBER_OF_EC2_SECURITY_GROUP]-(rule:IpPermissionInbound:IpRule)
+    OPTIONAL MATCH p4=(rds)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)<-[:MEMBER_OF_EC2_SECURITY_GROUP]-(rule:IpPermissionInbound:IpRule)<-[:MEMBER_OF_IP_RULE]-(ip:IpRange)
+    RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class DatabaseInstanceExposed(Finding):
+    host: str | None = None
+    id: str | None = None
+    engine: str | None = None
+    port: int | None = None
+    region: str | None = None
+    encrypted: bool | None = None
+
+
+database_instance_exposed = Rule(
+    id="database_instance_exposed",
+    name="Internet-Exposed Databases",
+    description=("Database instances accessible from the internet"),
+    output_model=DatabaseInstanceExposed,
+    facts=(_aws_rds_public_access,),
+    tags=("infrastructure", "databases", "attack_surface"),
+    version="0.1.0",
+)

cartography/rules/data/rules/delegation_boundary_modifiable.py

@@ -0,0 +1,90 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS
+_aws_trust_relationship_manipulation = Fact(
+    id="aws_trust_relationship_manipulation",
+    name="Roles with Cross-Account Trust Relationship Modification Capabilities",
+    description=(
+        "AWS IAM principals with permissions to modify role trust policies "
+        "(specifically AssumeRolePolicyDocuments)."
+    ),
+    cypher_query="""
+        MATCH (a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+        MATCH (principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {effect:"Allow"})
+        WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+        AND NOT principal.name CONTAINS 'QuickSetup'
+        AND principal.name <> 'OrganizationAccountAccessRole'
+        WITH a, principal, policy, stmt,
+            [label IN labels(principal) WHERE label <> 'AWSPrincipal'][0] AS principal_type,
+            ['iam:UpdateAssumeRolePolicy', 'iam:CreateRole'] AS patterns
+        // Filter for matching Allow actions
+        WITH a, principal, principal_type, stmt, policy,
+            [action IN stmt.action
+                WHERE ANY(p IN patterns WHERE action = p)
+                OR action = 'iam:*'
+                OR action = '*'
+            ] AS matched_allow_actions
+        WHERE size(matched_allow_actions) > 0
+        // Look for any explicit Deny statement on same principal that matches those actions
+        OPTIONAL MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(deny_stmt:AWSPolicyStatement {effect:"Deny"})
+        WHERE ANY(action IN deny_stmt.action
+                WHERE action IN matched_allow_actions
+                    OR action = 'iam:*'
+                    OR action = '*')
+        // Exclude principals with an explicit Deny that overlaps
+        WITH a, principal, principal_type, policy, stmt, matched_allow_actions, deny_stmt
+        WHERE deny_stmt IS NULL
+        UNWIND matched_allow_actions AS action
+        RETURN DISTINCT
+            a.name AS account,
+            a.id AS account_id,
+            principal.name AS principal_name,
+            principal.arn AS principal_identifier,
+            policy.name AS policy_name,
+            principal_type,
+            collect(DISTINCT action) AS actions,
+            stmt.resource AS resources
+        ORDER BY account, principal_name
+    """,
+    cypher_visual_query="""
+        MATCH p = (a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+        MATCH p1 = (principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+        AND principal.name <> 'OrganizationAccountAccessRole'
+        AND stmt.effect = 'Allow'
+        RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class DelegationBoundaryModifiable(Finding):
+    principal_name: str | None = None
+    principal_identifier: str | None = None
+    principal_type: str | None = None
+    account: str | None = None
+    account_id: str | None = None
+    policy_name: str | None = None
+    actions: list[str] = []
+    resources: list[str] = []
+
+
+delegation_boundary_modifiable = Rule(
+    id="delegation_boundary_modifiable",
+    name="Delegation Boundary Modifiable",
+    description=(
+        "Principals can edit role trust/assume policies or create roles with arbitrary trust—"
+        "allowing cross-account or lateral impersonation paths."
+    ),
+    output_model=DelegationBoundaryModifiable,
+    facts=(_aws_trust_relationship_manipulation,),
+    tags=("iam", "privilege_escalation"),
+    version="0.1.0",
+)

cartography/rules/data/rules/identity_administration_privileges.py

@@ -0,0 +1,100 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS
+_aws_account_manipulation_permissions = Fact(
+    id="aws_account_manipulation_permissions",
+    name="IAM Principals with Account Creation and Modification Permissions",
+    description=(
+        "AWS IAM users and roles with permissions to create, modify, or delete IAM "
+        "accounts and their associated policies."
+    ),
+    cypher_query="""
+        MATCH (a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+        MATCH (principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+        AND NOT principal.name CONTAINS 'QuickSetup'
+        AND principal.name <> 'OrganizationAccountAccessRole'
+        AND stmt.effect = 'Allow'
+        WITH a, principal, stmt, policy,
+            [label IN labels(principal) WHERE label <> 'AWSPrincipal'][0] AS principal_type,
+            [p IN ['iam:Create','iam:Attach','iam:Put','iam:Update','iam:Add'] | p] AS patterns
+        // Match only Allow statements whose actions fit the patterns
+        WITH a, principal, principal_type, stmt, policy,
+            [action IN stmt.action
+                WHERE ANY(prefix IN patterns WHERE action STARTS WITH prefix)
+                OR action = 'iam:*'
+                OR action = '*'
+            ] AS matched_allow_actions
+        WHERE size(matched_allow_actions) > 0
+        // Find explicit Deny statements for the same principal that overlap
+        OPTIONAL MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(deny_stmt:AWSPolicyStatement {effect:"Deny"})
+        WHERE ANY(deny_action IN deny_stmt.action
+                    WHERE deny_action IN matched_allow_actions
+                    OR deny_action = 'iam:*'
+                    OR deny_action = '*')
+        // If a deny exists, exclude those principals
+        WITH a, principal, principal_type, policy, stmt, matched_allow_actions, deny_stmt
+        WHERE deny_stmt IS NULL
+        UNWIND matched_allow_actions AS action
+        RETURN DISTINCT
+            a.name AS account,
+            a.id AS account_id,
+            principal.name AS principal_name,
+            principal.arn AS principal_identifier,
+            principal_type,
+            policy.name AS policy_name,
+            collect(DISTINCT action) AS actions,
+            stmt.resource AS resources
+        ORDER BY account, principal_name
+    """,
+    cypher_visual_query="""
+        MATCH p = (a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+        MATCH p1 = (principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+        AND NOT principal.name CONTAINS 'QuickSetup'
+        AND NOT principal.name = 'OrganizationAccountAccessRole'
+        AND stmt.effect = 'Allow'
+        AND ANY(action IN stmt.action WHERE
+            action STARTS WITH 'iam:Create'
+            OR action STARTS WITH 'iam:Attach'
+            OR action STARTS WITH 'iam:Put'
+            OR action STARTS WITH 'iam:Update'
+            OR action STARTS WITH 'iam:Add'
+            OR action = 'iam:*'
+            OR action = '*'
+        )
+        RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class IdentityAdministrationPrivileges(Finding):
+    principal_name: str | None = None
+    principal_identifier: str | None = None
+    account: str | None = None
+    account_id: str | None = None
+    principal_type: str | None = None
+    policy_name: str | None = None
+    actions: list[str] = []
+    resources: list[str] = []
+
+
+identity_administration_privileges = Rule(
+    id="identity_administration_privileges",
+    name="Identity Administration Privileges",
+    description=(
+        "Principals can create, attach, update, or otherwise administer identities "
+        "(users/roles/groups) and their bindings—classic escalation surface."
+    ),
+    output_model=IdentityAdministrationPrivileges,
+    facts=(_aws_account_manipulation_permissions,),
+    tags=("iam", "privilege_escalation"),
+    version="0.1.0",
+)

cartography/rules/data/rules/inactive_user_active_accounts.py

@@ -0,0 +1,48 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# Facts
+_inactive_user_active_accounts_ontology = Fact(
+    id="inactive-user-active-accounts-ontology",
+    name="Active accounts linked to inactive users",
+    description="Finds user accounts that remain active despite being linked to inactive user identities.",
+    # We use COALESCE to handle NULL value and default to the opposite of the expected value to avoid false positives with NULL comparison
+    cypher_query="""
+    MATCH (u:User)-[:HAS_ACCOUNT]-(a:UserAccount)
+    WHERE COALESCE(u.active, True) = False
+    AND COALESCE(a.active, False) = True
+    RETURN a.id AS account_id, a._ont_email AS account_email, u.id AS user_id, u.email AS user_email, a._ont_username AS account_username, u.fullname AS user_name, a._ont_source AS source
+    """,
+    cypher_visual_query="""
+    MATCH (u:User)-[:HAS_ACCOUNT]-(a:UserAccount)
+    WHERE COALESCE(u.active, True) = False
+    AND COALESCE(a.active, False) = True
+    RETURN a, u
+    """,
+    module=Module.CROSS_CLOUD,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class InactiveUserActiveAccountsOutput(Finding):
+    account_username: str | None = None
+    account_email: str | None = None
+    user_name: str | None = None
+    user_email: str | None = None
+    account_id: str | None = None
+    user_id: str | None = None
+
+
+inactive_user_active_accounts = Rule(
+    id="inactive-user-active-accounts",
+    name="Active accounts linked to inactive users",
+    description="Detects user accounts that remain active despite being linked to inactive user identities. When users are deactivated in the identity provider, their associated accounts should also be deactivated to prevent unauthorized access.",
+    output_model=InactiveUserActiveAccountsOutput,
+    tags=("identity", "iam", "compliance", "access_control"),
+    facts=(_inactive_user_active_accounts_ontology,),
+    version="0.1.0",
+)