cartography 0.104.0rc2__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/models/aws/guardduty/findings.py

@@ -0,0 +1,121 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+    title: PropertyRef = PropertyRef("title")
+    description: PropertyRef = PropertyRef("description")
+    type: PropertyRef = PropertyRef("type")
+    severity: PropertyRef = PropertyRef("severity")
+    confidence: PropertyRef = PropertyRef("confidence")
+    eventfirstseen: PropertyRef = PropertyRef("eventfirstseen")
+    eventlastseen: PropertyRef = PropertyRef("eventlastseen")
+    accountid: PropertyRef = PropertyRef("accountid")
+    region: PropertyRef = PropertyRef("region")
+    detectorid: PropertyRef = PropertyRef("detectorid")
+    resource_type: PropertyRef = PropertyRef("resource_type")
+    resource_id: PropertyRef = PropertyRef("resource_id")
+    archived: PropertyRef = PropertyRef("archived")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingToAWSAccountRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: GuardDutyFindingToAWSAccountRelRelProperties = (
+        GuardDutyFindingToAWSAccountRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingToEC2InstanceRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingToEC2InstanceRel(CartographyRelSchema):
+    target_node_label: str = "EC2Instance"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("resource_id")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "AFFECTS"
+    properties: GuardDutyFindingToEC2InstanceRelRelProperties = (
+        GuardDutyFindingToEC2InstanceRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingToGuardDutyDetectorRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingToGuardDutyDetectorRel(CartographyRelSchema):
+    target_node_label: str = "GuardDutyDetector"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("detectorid")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "DETECTED_BY"
+    properties: GuardDutyFindingToGuardDutyDetectorRelRelProperties = (
+        GuardDutyFindingToGuardDutyDetectorRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingToS3BucketRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingToS3BucketRel(CartographyRelSchema):
+    target_node_label: str = "S3Bucket"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("resource_id")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "AFFECTS"
+    properties: GuardDutyFindingToS3BucketRelRelProperties = (
+        GuardDutyFindingToS3BucketRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class GuardDutyFindingSchema(CartographyNodeSchema):
+    label: str = "GuardDutyFinding"
+    properties: GuardDutyFindingNodeProperties = GuardDutyFindingNodeProperties()
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["Risk"])
+    sub_resource_relationship: GuardDutyFindingToAWSAccountRel = (
+        GuardDutyFindingToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            GuardDutyFindingToGuardDutyDetectorRel(),
+            GuardDutyFindingToEC2InstanceRel(),
+            GuardDutyFindingToS3BucketRel(),
+        ],
+    )

cartography/models/aws/iam/access_key.py

@@ -0,0 +1,103 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("accesskeyid")
+    accesskeyid: PropertyRef = PropertyRef("accesskeyid", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM access keys
+    createdate: PropertyRef = PropertyRef("createdate")
+    status: PropertyRef = PropertyRef("status")
+    lastuseddate: PropertyRef = PropertyRef("lastuseddate")
+    lastusedservice: PropertyRef = PropertyRef("lastusedservice")
+    lastusedregion: PropertyRef = PropertyRef("lastusedregion")
+
+
+@dataclass(frozen=True)
+class AWSUserToAccountAccessKeyRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSUserToAccountAccessKeyRel(CartographyRelSchema):
+    target_node_label: str = "AccountAccessKey"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "accesskeyid": PropertyRef("accesskeyid"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "AWS_ACCESS_KEY"
+    properties: AWSUserToAccountAccessKeyRelProperties = (
+        AWSUserToAccountAccessKeyRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyToAWSUserRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyToAWSUserRel(CartographyRelSchema):
+    target_node_label: str = "AWSUser"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("user_arn"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "AWS_ACCESS_KEY"
+    properties: AccountAccessKeyToAWSUserRelProperties = (
+        AccountAccessKeyToAWSUserRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AccountAccessKeyToAWSAccountRelProperties = (
+        AccountAccessKeyToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AccountAccessKeySchema(CartographyNodeSchema):
+    label: str = "AccountAccessKey"
+    properties: AccountAccessKeyNodeProperties = AccountAccessKeyNodeProperties()
+    sub_resource_relationship: AccountAccessKeyToAWSAccountRel = (
+        AccountAccessKeyToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AccountAccessKeyToAWSUserRel(),
+            AccountAccessKeyToAWSAccountRel(),
+        ]
+    )

cartography/models/aws/iam/account_role.py

@@ -0,0 +1,24 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+
+
+@dataclass(frozen=True)
+class AWSAccountAWSRoleNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("id")
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSAccountAWSRoleSchema(CartographyNodeSchema):
+    """
+    An AWSAccount that was discovered from a trusted principal in an IAM role.
+    """
+
+    label: str = "AWSAccount"
+    properties: AWSAccountAWSRoleNodeProperties = AWSAccountAWSRoleNodeProperties()

cartography/models/aws/iam/federated_principal.py

@@ -0,0 +1,60 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSFederatedPrincipalNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM federated principals
+    type: PropertyRef = PropertyRef("type")
+
+
+@dataclass(frozen=True)
+class AWSFederatedPrincipalToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSFederatedPrincipalToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSFederatedPrincipalToAWSAccountRelProperties = (
+        AWSFederatedPrincipalToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSFederatedPrincipalSchema(CartographyNodeSchema):
+    """
+    E.g. "arn:aws:iam::123456789012:saml-provider/my-saml-provider".
+    """
+
+    label: str = "AWSFederatedPrincipal"
+    properties: AWSFederatedPrincipalNodeProperties = (
+        AWSFederatedPrincipalNodeProperties()
+    )
+    sub_resource_relationship: AWSFederatedPrincipalToAWSAccountRel = (
+        AWSFederatedPrincipalToAWSAccountRel()
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])

cartography/models/aws/iam/group.py

@@ -0,0 +1,60 @@
+from dataclasses import dataclass
+
+from cartography.models.aws.iam.group_membership import AWSGroupToAWSUserRel
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSGroupNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM groups
+    groupid: PropertyRef = PropertyRef("groupid")
+    name: PropertyRef = PropertyRef("name")
+    path: PropertyRef = PropertyRef("path")
+    createdate: PropertyRef = PropertyRef("createdate")
+
+
+@dataclass(frozen=True)
+class AWSGroupToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSGroupToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSGroupToAWSAccountRelProperties = AWSGroupToAWSAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class AWSGroupSchema(CartographyNodeSchema):
+    label: str = "AWSGroup"
+    properties: AWSGroupNodeProperties = AWSGroupNodeProperties()
+    sub_resource_relationship: AWSGroupToAWSAccountRel = AWSGroupToAWSAccountRel()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AWSGroupToAWSUserRel(),
+        ]
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])

cartography/models/aws/iam/group_membership.py

@@ -0,0 +1,27 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSGroupToAWSUserRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSGroupToAWSUserRel(CartographyRelSchema):
+    # AWSUser -MEMBER_AWS_GROUP-> AWSGroup
+    target_node_label: str = "AWSUser"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("user_arns", one_to_many=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "MEMBER_AWS_GROUP"
+    properties: AWSGroupToAWSUserRelProperties = AWSGroupToAWSUserRelProperties()

cartography/models/aws/iam/inline_policy.py

@@ -0,0 +1,78 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    name: PropertyRef = PropertyRef("name")
+    type: PropertyRef = PropertyRef("type")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyToAWSPrincipalRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyToAWSPrincipalRel(CartographyRelSchema):
+    target_node_label: str = "AWSPrincipal"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("principal_arns", one_to_many=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "POLICY"
+    properties: AWSInlinePolicyToAWSPrincipalRelProperties = (
+        AWSInlinePolicyToAWSPrincipalRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSInlinePolicyToAWSAccountRelProperties = (
+        AWSInlinePolicyToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicySchema(CartographyNodeSchema):
+    """
+    Inline policies are defined on the given principal and are therefore scoped to that principal's account.
+    """
+
+    label: str = "AWSInlinePolicy"
+    properties: AWSInlinePolicyNodeProperties = AWSInlinePolicyNodeProperties()
+    sub_resource_relationship: AWSInlinePolicyToAWSAccountRel = (
+        AWSInlinePolicyToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [AWSInlinePolicyToAWSPrincipalRel()]
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPolicy"])

cartography/models/aws/iam/managed_policy.py

@@ -0,0 +1,51 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSManagedPolicyNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    name: PropertyRef = PropertyRef("name")
+    type: PropertyRef = PropertyRef("type")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+
+@dataclass(frozen=True)
+class AWSManagedPolicyToAWSPrincipalRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSManagedPolicyToAWSPrincipalRel(CartographyRelSchema):
+    target_node_label: str = "AWSPrincipal"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("principal_arns", one_to_many=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "POLICY"
+    properties: AWSManagedPolicyToAWSPrincipalRelProperties = (
+        AWSManagedPolicyToAWSPrincipalRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSManagedPolicySchema(CartographyNodeSchema):
+    label: str = "AWSManagedPolicy"
+    properties: AWSManagedPolicyNodeProperties = AWSManagedPolicyNodeProperties()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [AWSManagedPolicyToAWSPrincipalRel()]
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPolicy"])

cartography/models/aws/iam/policy_statement.py

@@ -0,0 +1,57 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("id")
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM policy statements
+    effect: PropertyRef = PropertyRef("Effect")
+    action: PropertyRef = PropertyRef("Action")
+    notaction: PropertyRef = PropertyRef("NotAction")
+    resource: PropertyRef = PropertyRef("Resource")
+    notresource: PropertyRef = PropertyRef("NotResource")
+    condition: PropertyRef = PropertyRef("Condition")
+    sid: PropertyRef = PropertyRef("Sid")
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementToAWSPolicyRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementToAWSPolicyRel(CartographyRelSchema):
+    target_node_label: str = "AWSPolicy"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("POLICY_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "STATEMENT"
+    properties: AWSPolicyStatementToAWSPolicyRelProperties = (
+        AWSPolicyStatementToAWSPolicyRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementSchema(CartographyNodeSchema):
+    label: str = "AWSPolicyStatement"
+    properties: AWSPolicyStatementNodeProperties = AWSPolicyStatementNodeProperties()
+    sub_resource_relationship: AWSPolicyStatementToAWSPolicyRel = (
+        AWSPolicyStatementToAWSPolicyRel()
+    )

cartography/models/aws/iam/role.py

@@ -0,0 +1,83 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSRoleNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM roles
+    roleid: PropertyRef = PropertyRef("roleid")
+    name: PropertyRef = PropertyRef("name")
+    path: PropertyRef = PropertyRef("path")
+    createdate: PropertyRef = PropertyRef("createdate")
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSRoleToAWSAccountRelProperties = AWSRoleToAWSAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSPrincipalTrustRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSPrincipalTrustRel(CartographyRelSchema):
+    """
+    Trust relationship with principals of type "AWS".
+    """
+
+    target_node_label: str = "AWSPrincipal"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("trusted_aws_principals", one_to_many=True),
+        },
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "TRUSTS_AWS_PRINCIPAL"
+    properties: AWSRoleToAWSPrincipalTrustRelProperties = (
+        AWSRoleToAWSPrincipalTrustRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSRoleSchema(CartographyNodeSchema):
+    label: str = "AWSRole"
+    properties: AWSRoleNodeProperties = AWSRoleNodeProperties()
+    sub_resource_relationship: AWSRoleToAWSAccountRel = AWSRoleToAWSAccountRel()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AWSRoleToAWSPrincipalTrustRel(),
+        ]
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])