cartography 0.105.0__tar.gz → 0.106.0rc1__tar.gz

{cartography-0.105.0 → cartography-0.106.0rc1}/.github/workflows/ossf-scorecard.yml

@@ -57,6 +57,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: results.sarif

{cartography-0.105.0 → cartography-0.106.0rc1}/.github/workflows/publish-to-ghcr-and-pypi.yml

@@ -57,7 +57,7 @@ jobs:
           images: ghcr.io/${{ github.repository }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0

{cartography-0.105.0 → cartography-0.106.0rc1}/.github/workflows/sphinx.yml

@@ -31,7 +31,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install uv
-        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1.0
+        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"

{cartography-0.105.0 → cartography-0.106.0rc1}/.github/workflows/test_suite.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install uv
-        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1.0
+        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -72,7 +72,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install uv
-        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1.0
+        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -98,7 +98,7 @@ jobs:
           images: ghcr.io/${{ github.repository }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Build
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0

{cartography-0.105.0 → cartography-0.106.0rc1}/AGENTS.md

@@ -309,6 +309,64 @@ class YourServiceUserSchema(CartographyNodeSchema):
     ])
 ```
 
+### Sub-Resource Relationships: Always Point to Tenant-Like Objects
+
+The `sub_resource_relationship` should **always** refer to a tenant-like object that represents the ownership or organizational boundary of the resource. This is crucial for proper data organization and cleanup operations.
+
+**✅ Correct Examples:**
+- **AWS Resources**: Point to `AWSAccount` (tenant = AWS account)
+- **Azure Resources**: Point to `AzureSubscription` (tenant = Azure subscription)
+- **GCP Resources**: Point to `GCPProject` (tenant = GCP project)
+- **SaaS Applications**: Point to `YourServiceTenant` (tenant = organization/company)
+- **GitHub Resources**: Point to `GitHubOrganization` (tenant = GitHub org)
+
+**❌ Incorrect Examples:**
+- Pointing to a parent resource that's not tenant-like (e.g., `ECSTaskDefinition` → `ECSTask`)
+- Pointing to infrastructure components (e.g., `ECSContainer` → `ECSTask`)
+- Pointing to logical groupings that aren't organizational boundaries
+
+**Example: AWS ECS Container Definitions**
+
+```python
+# ✅ CORRECT: Container definitions belong to AWS accounts
+@dataclass(frozen=True)
+class ECSContainerDefinitionSchema(CartographyNodeSchema):
+    label: str = "ECSContainerDefinition"
+    properties: ECSContainerDefinitionNodeProperties = ECSContainerDefinitionNodeProperties()
+    sub_resource_relationship: ECSContainerDefinitionToAWSAccountRel = ECSContainerDefinitionToAWSAccountRel()
+    other_relationships: OtherRelationships = OtherRelationships([
+        ECSContainerDefinitionToTaskDefinitionRel(),  # Business relationship
+    ])
+
+# ✅ CORRECT: Relationship to AWS Account (tenant-like)
+@dataclass(frozen=True)
+class ECSContainerDefinitionToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
+        "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+    })
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: ECSContainerDefinitionToAWSAccountRelProperties = ECSContainerDefinitionToAWSAccountRelProperties()
+
+# ✅ CORRECT: Business relationship to task definition (not tenant-like)
+@dataclass(frozen=True)
+class ECSContainerDefinitionToTaskDefinitionRel(CartographyRelSchema):
+    target_node_label: str = "ECSTaskDefinition"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
+        "id": PropertyRef("_taskDefinitionArn"),
+    })
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "HAS_CONTAINER_DEFINITION"
+    properties: ECSContainerDefinitionToTaskDefinitionRelProperties = ECSContainerDefinitionToTaskDefinitionRelProperties()
+```
+
+**Why This Matters:**
+1. **Cleanup Operations**: Cartography uses the sub-resource relationship to determine which data to clean up during sync operations
+2. **Data Organization**: Tenant-like objects provide natural boundaries for data organization
+3. **Access Control**: Tenant relationships enable proper access control and data isolation
+4. **Consistency**: Following this pattern ensures consistent data modeling across all modules
+
 ### Relationships
 
 Define how your nodes connect to other nodes:

{cartography-0.105.0 → cartography-0.106.0rc1}/Dockerfile

@@ -1,5 +1,5 @@
 # Base image
-FROM python:3.10-slim@sha256:2ee0fb8794bf82af1b2db168ada5869b4c27d17720dd3b155b56c111fb4a38ae AS base
+FROM python:3.10-slim@sha256:034724ef64585eeb0e82385e9aabcbeabfe5f7cae2c2dcedb1da95114372b6d7 AS base
 # Default to ''. Overridden with a specific version specifier e.g. '==0.98.0' by build args or from GitHub actions.
 ARG VERSION_SPECIFIER
 # the UID and GID to run cartography as

{cartography-0.105.0 → cartography-0.106.0rc1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cartography
-Version: 0.105.0
+Version: 0.106.0rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2

{cartography-0.105.0 → cartography-0.106.0rc1}/cartography/_version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '0.105.0'
-__version_tuple__ = version_tuple = (0, 105, 0)
+__version__ = version = '0.106.0rc1'
+__version_tuple__ = version_tuple = (0, 106, 0, 'rc1')

{cartography-0.105.0 → cartography-0.106.0rc1}/cartography/data/indexes.cypher

@@ -99,21 +99,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:ECRRepositoryImage) ON (n.tag);
 CREATE INDEX IF NOT EXISTS FOR (n:ECRRepositoryImage) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:ECRScanFinding) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:ECRScanFinding) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSCluster) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSCluster) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSContainerInstance) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSContainerInstance) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSService) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSService) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSTaskDefinition) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSTaskDefinition) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSTaskDefinition) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSTask) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSTask) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSContainerDefinition) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSContainerDefinition) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSContainer) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:ECSContainer) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:ElasticacheCluster) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:ElasticacheCluster) ON (n.arn);
 CREATE INDEX IF NOT EXISTS FOR (n:ElasticacheCluster) ON (n.lastupdated);
@@ -375,22 +360,3 @@ CREATE INDEX IF NOT EXISTS FOR (n:AzureDisk) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AzureDisk) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AzureSnapshot) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AzureSnapshot) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesCluster) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesCluster) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesCluster) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesNamespace) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesNamespace) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesNamespace) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesPod) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesPod) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesPod) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesContainer) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesContainer) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesContainer) ON (n.image);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesContainer) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesSecret) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesSecret) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesSecret) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesService) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesService) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:KubernetesService) ON (n.lastupdated);

cartography-0.106.0rc1/cartography/intel/aws/ecs.py

@@ -0,0 +1,496 @@
+import logging
+from typing import Any
+from typing import Dict
+from typing import List
+
+import boto3
+import neo4j
+
+from cartography.client.core.tx import load
+from cartography.graph.job import GraphJob
+from cartography.models.aws.ecs.clusters import ECSClusterSchema
+from cartography.models.aws.ecs.container_definitions import (
+    ECSContainerDefinitionSchema,
+)
+from cartography.models.aws.ecs.container_instances import ECSContainerInstanceSchema
+from cartography.models.aws.ecs.containers import ECSContainerSchema
+from cartography.models.aws.ecs.services import ECSServiceSchema
+from cartography.models.aws.ecs.task_definitions import ECSTaskDefinitionSchema
+from cartography.models.aws.ecs.tasks import ECSTaskSchema
+from cartography.util import aws_handle_regions
+from cartography.util import timeit
+
+logger = logging.getLogger(__name__)
+
+
+@timeit
+@aws_handle_regions
+def get_ecs_cluster_arns(
+    boto3_session: boto3.session.Session,
+    region: str,
+) -> List[str]:
+    client = boto3_session.client("ecs", region_name=region)
+    paginator = client.get_paginator("list_clusters")
+    cluster_arns: List[str] = []
+    for page in paginator.paginate():
+        cluster_arns.extend(page.get("clusterArns", []))
+    return cluster_arns
+
+
+@timeit
+@aws_handle_regions
+def get_ecs_clusters(
+    boto3_session: boto3.session.Session,
+    region: str,
+    cluster_arns: List[str],
+) -> List[Dict[str, Any]]:
+    client = boto3_session.client("ecs", region_name=region)
+    # TODO: also include attachment info, and make relationships between the attachements
+    # and the cluster.
+    includes = ["SETTINGS", "CONFIGURATIONS"]
+    clusters: List[Dict[str, Any]] = []
+    for i in range(0, len(cluster_arns), 100):
+        cluster_arn_chunk = cluster_arns[i : i + 100]
+        cluster_chunk = client.describe_clusters(
+            clusters=cluster_arn_chunk,
+            include=includes,
+        )
+        clusters.extend(cluster_chunk.get("clusters", []))
+    return clusters
+
+
+@timeit
+@aws_handle_regions
+def get_ecs_container_instances(
+    cluster_arn: str,
+    boto3_session: boto3.session.Session,
+    region: str,
+) -> List[Dict[str, Any]]:
+    client = boto3_session.client("ecs", region_name=region)
+    paginator = client.get_paginator("list_container_instances")
+    container_instances: List[Dict[str, Any]] = []
+    container_instance_arns: List[str] = []
+    for page in paginator.paginate(cluster=cluster_arn):
+        container_instance_arns.extend(page.get("containerInstanceArns", []))
+    includes = ["CONTAINER_INSTANCE_HEALTH"]
+    for i in range(0, len(container_instance_arns), 100):
+        container_instance_arn_chunk = container_instance_arns[i : i + 100]
+        container_instance_chunk = client.describe_container_instances(
+            cluster=cluster_arn,
+            containerInstances=container_instance_arn_chunk,
+            include=includes,
+        )
+        container_instances.extend(
+            container_instance_chunk.get("containerInstances", []),
+        )
+    return container_instances
+
+
+@timeit
+@aws_handle_regions
+def get_ecs_services(
+    cluster_arn: str,
+    boto3_session: boto3.session.Session,
+    region: str,
+) -> List[Dict[str, Any]]:
+    client = boto3_session.client("ecs", region_name=region)
+    paginator = client.get_paginator("list_services")
+    services: List[Dict[str, Any]] = []
+    service_arns: List[str] = []
+    for page in paginator.paginate(cluster=cluster_arn):
+        service_arns.extend(page.get("serviceArns", []))
+    for i in range(0, len(service_arns), 10):
+        service_arn_chunk = service_arns[i : i + 10]
+        service_chunk = client.describe_services(
+            cluster=cluster_arn,
+            services=service_arn_chunk,
+        )
+        services.extend(service_chunk.get("services", []))
+    return services
+
+
+@timeit
+@aws_handle_regions
+def get_ecs_task_definitions(
+    boto3_session: boto3.session.Session,
+    region: str,
+    tasks: List[Dict[str, Any]],
+) -> List[Dict[str, Any]]:
+    client = boto3_session.client("ecs", region_name=region)
+    task_definitions: List[Dict[str, Any]] = []
+    for task in tasks:
+        task_definition = client.describe_task_definition(
+            taskDefinition=task["taskDefinitionArn"],
+        )
+        task_definitions.append(task_definition["taskDefinition"])
+    return task_definitions
+
+
+def _get_container_defs_from_task_definitions(
+    definitions: list[dict[str, Any]],
+) -> list[dict[str, Any]]:
+    container_defs: list[dict[str, Any]] = []
+    for td in definitions:
+        for container in td.get("containerDefinitions", []):
+            c = container.copy()
+            c["_taskDefinitionArn"] = td["taskDefinitionArn"]
+            c["id"] = f"{td['taskDefinitionArn']}-{c['name']}"
+            container_defs.append(c)
+    return container_defs
+
+
+@timeit
+@aws_handle_regions
+def get_ecs_tasks(
+    cluster_arn: str,
+    boto3_session: boto3.session.Session,
+    region: str,
+) -> List[Dict[str, Any]]:
+    client = boto3_session.client("ecs", region_name=region)
+    paginator = client.get_paginator("list_tasks")
+    tasks: List[Dict[str, Any]] = []
+    task_arns: List[str] = []
+    for page in paginator.paginate(cluster=cluster_arn):
+        task_arns.extend(page.get("taskArns", []))
+    for i in range(0, len(task_arns), 100):
+        task_arn_chunk = task_arns[i : i + 100]
+        task_chunk = client.describe_tasks(
+            cluster=cluster_arn,
+            tasks=task_arn_chunk,
+        )
+        tasks.extend(task_chunk.get("tasks", []))
+    return tasks
+
+
+def _get_containers_from_tasks(tasks: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    containers: list[dict[str, Any]] = []
+    for task in tasks:
+        containers.extend(task.get("containers", []))
+    return containers
+
+
+@timeit
+def load_ecs_clusters(
+    neo4j_session: neo4j.Session,
+    data: List[Dict[str, Any]],
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        ECSClusterSchema(),
+        data,
+        Region=region,
+        AWS_ID=current_aws_account_id,
+        lastupdated=aws_update_tag,
+    )
+
+
+@timeit
+def load_ecs_container_instances(
+    neo4j_session: neo4j.Session,
+    cluster_arn: str,
+    data: List[Dict[str, Any]],
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        ECSContainerInstanceSchema(),
+        data,
+        ClusterArn=cluster_arn,
+        Region=region,
+        AWS_ID=current_aws_account_id,
+        lastupdated=aws_update_tag,
+    )
+
+
+@timeit
+def load_ecs_services(
+    neo4j_session: neo4j.Session,
+    cluster_arn: str,
+    data: List[Dict[str, Any]],
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        ECSServiceSchema(),
+        data,
+        ClusterArn=cluster_arn,
+        Region=region,
+        AWS_ID=current_aws_account_id,
+        lastupdated=aws_update_tag,
+    )
+
+
+@timeit
+def load_ecs_task_definitions(
+    neo4j_session: neo4j.Session,
+    data: list[dict[str, Any]],
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        ECSTaskDefinitionSchema(),
+        data,
+        Region=region,
+        AWS_ID=current_aws_account_id,
+        lastupdated=aws_update_tag,
+    )
+
+
+@timeit
+def load_ecs_tasks(
+    neo4j_session: neo4j.Session,
+    cluster_arn: str,
+    data: List[Dict[str, Any]],
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        ECSTaskSchema(),
+        data,
+        ClusterArn=cluster_arn,
+        Region=region,
+        AWS_ID=current_aws_account_id,
+        lastupdated=aws_update_tag,
+    )
+
+
+@timeit
+def load_ecs_container_definitions(
+    neo4j_session: neo4j.Session,
+    data: List[Dict[str, Any]],
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        ECSContainerDefinitionSchema(),
+        data,
+        Region=region,
+        AWS_ID=current_aws_account_id,
+        lastupdated=aws_update_tag,
+    )
+
+
+@timeit
+def load_ecs_containers(
+    neo4j_session: neo4j.Session,
+    data: List[Dict[str, Any]],
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        ECSContainerSchema(),
+        data,
+        Region=region,
+        AWS_ID=current_aws_account_id,
+        lastupdated=aws_update_tag,
+    )
+
+
+@timeit
+def cleanup_ecs(neo4j_session: neo4j.Session, common_job_parameters: Dict) -> None:
+    GraphJob.from_node_schema(ECSContainerSchema(), common_job_parameters).run(
+        neo4j_session
+    )
+    GraphJob.from_node_schema(ECSTaskSchema(), common_job_parameters).run(neo4j_session)
+    GraphJob.from_node_schema(ECSContainerInstanceSchema(), common_job_parameters).run(
+        neo4j_session
+    )
+    GraphJob.from_node_schema(ECSServiceSchema(), common_job_parameters).run(
+        neo4j_session
+    )
+    GraphJob.from_node_schema(
+        ECSContainerDefinitionSchema(), common_job_parameters
+    ).run(neo4j_session)
+    GraphJob.from_node_schema(ECSTaskDefinitionSchema(), common_job_parameters).run(
+        neo4j_session
+    )
+    GraphJob.from_node_schema(ECSClusterSchema(), common_job_parameters).run(
+        neo4j_session
+    )
+
+
+@timeit
+def _sync_ecs_cluster_arns(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    cluster_arns: List[str],
+    region: str,
+    current_aws_account_id: str,
+    update_tag: int,
+) -> None:
+    clusters = get_ecs_clusters(boto3_session, region, cluster_arns)
+    if len(clusters) == 0:
+        return
+    load_ecs_clusters(
+        neo4j_session,
+        clusters,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+
+
+@timeit
+def _sync_ecs_container_instances(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    cluster_arn: str,
+    region: str,
+    current_aws_account_id: str,
+    update_tag: int,
+) -> None:
+    cluster_instances = get_ecs_container_instances(
+        cluster_arn,
+        boto3_session,
+        region,
+    )
+    load_ecs_container_instances(
+        neo4j_session,
+        cluster_arn,
+        cluster_instances,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+
+
+@timeit
+def _sync_ecs_services(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    cluster_arn: str,
+    region: str,
+    current_aws_account_id: str,
+    update_tag: int,
+) -> None:
+    services = get_ecs_services(
+        cluster_arn,
+        boto3_session,
+        region,
+    )
+    load_ecs_services(
+        neo4j_session,
+        cluster_arn,
+        services,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+
+
+@timeit
+def _sync_ecs_task_and_container_defns(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    cluster_arn: str,
+    region: str,
+    current_aws_account_id: str,
+    update_tag: int,
+) -> None:
+    tasks = get_ecs_tasks(
+        cluster_arn,
+        boto3_session,
+        region,
+    )
+    containers = _get_containers_from_tasks(tasks)
+    load_ecs_tasks(
+        neo4j_session,
+        cluster_arn,
+        tasks,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+    load_ecs_containers(
+        neo4j_session,
+        containers,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+
+    task_definitions = get_ecs_task_definitions(
+        boto3_session,
+        region,
+        tasks,
+    )
+    container_defs = _get_container_defs_from_task_definitions(task_definitions)
+    load_ecs_task_definitions(
+        neo4j_session,
+        task_definitions,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+    load_ecs_container_definitions(
+        neo4j_session,
+        container_defs,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+
+
+@timeit
+def sync(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    regions: List[str],
+    current_aws_account_id: str,
+    update_tag: int,
+    common_job_parameters: Dict,
+) -> None:
+    for region in regions:
+        logger.info(
+            f"Syncing ECS for region '{region}' in account '{current_aws_account_id}'.",
+        )
+        cluster_arns = get_ecs_cluster_arns(boto3_session, region)
+        _sync_ecs_cluster_arns(
+            neo4j_session,
+            boto3_session,
+            cluster_arns,
+            region,
+            current_aws_account_id,
+            update_tag,
+        )
+        for cluster_arn in cluster_arns:
+            _sync_ecs_container_instances(
+                neo4j_session,
+                boto3_session,
+                cluster_arn,
+                region,
+                current_aws_account_id,
+                update_tag,
+            )
+            _sync_ecs_task_and_container_defns(
+                neo4j_session,
+                boto3_session,
+                cluster_arn,
+                region,
+                current_aws_account_id,
+                update_tag,
+            )
+            _sync_ecs_services(
+                neo4j_session,
+                boto3_session,
+                cluster_arn,
+                region,
+                current_aws_account_id,
+                update_tag,
+            )
+    cleanup_ecs(neo4j_session, common_job_parameters)