cartography 0.108.0rc1__tar.gz → 0.109.0__tar.gz

{cartography-0.108.0rc1 → cartography-0.109.0}/.github/workflows/ossf-scorecard.yml

@@ -57,6 +57,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/upload-sarif@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
         with:
           sarif_file: results.sarif

{cartography-0.108.0rc1 → cartography-0.109.0}/.github/workflows/sphinx.yml

@@ -31,7 +31,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install uv
-        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
+        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"

{cartography-0.108.0rc1 → cartography-0.109.0}/.github/workflows/test_suite.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install uv
-        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
+        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -72,7 +72,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install uv
-        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
+        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"

{cartography-0.108.0rc1 → cartography-0.109.0}/AGENTS.md

@@ -27,12 +27,13 @@ This guide teaches you how to write intel modules for Cartography using the mode
 4. @Data Model: Defining Nodes and Relationships
 5. @Advanced Node Schema Properties
 6. @One-to-Many Relationships
-7. @Configuration and Credentials
-8. @Error Handling
-9. @Testing Your Module
-10. @Common Patterns and Examples
-11. @Troubleshooting Guide
-12. @Quick Reference
+7. @MatchLinks: Connecting Existing Nodes
+8. @Configuration and Credentials
+9. @Error Handling
+10. @Testing Your Module
+11. @Common Patterns and Examples
+12. @Troubleshooting Guide
+13. @Quick Reference
 
 ## 🚀 Quick Start: Copy an Existing Module {#quick-start}
 
@@ -600,6 +601,177 @@ class MyNodeSchema(CartographyNodeSchema):
 
 If you need conditional behavior, handle it in your transform function by setting field values to `None` when relationships shouldn't be created, or by filtering your data before calling `load()`.
 
+## 🔗 MatchLinks: Connecting Existing Nodes {#matchlinks}
+
+**⚠️ IMPORTANT: Use MatchLinks sparingly due to performance impact!**
+
+MatchLinks are a specialized tool for creating relationships between existing nodes in the graph. They should be used **only** in these two specific scenarios:
+
+### Scenario 1: Connecting Two Existing Node Types
+
+When you need to connect two different types of nodes that already exist in the graph, and the relationship data comes from a separate API call or data source.
+
+**Example**: AWS Identity Center role assignments connecting users to roles:
+
+```python
+# Data from a separate API call that maps users to roles
+role_assignments = [
+    {
+        "UserId": "user-123",
+        "RoleArn": "arn:aws:iam::123456789012:role/AdminRole",
+        "AccountId": "123456789012",
+    },
+    {
+        "UserId": "user-456",
+        "RoleArn": "arn:aws:iam::123456789012:role/ReadOnlyRole",
+        "AccountId": "123456789012",
+    }
+]
+
+# MatchLink schema to connect existing AWSSSOUser nodes to existing AWSRole nodes
+@dataclass(frozen=True)
+class RoleAssignmentAllowedByMatchLink(CartographyRelSchema):
+    target_node_label: str = "AWSRole"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
+        "arn": PropertyRef("RoleArn"),
+    })
+    source_node_label: str = "AWSSSOUser"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher({
+        "id": PropertyRef("UserId"),
+    })
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ALLOWED_BY"
+    properties: RoleAssignmentRelProperties = RoleAssignmentRelProperties()
+
+# Load the relationships
+load_matchlinks(
+    neo4j_session,
+    RoleAssignmentAllowedByMatchLink(),
+    role_assignments,
+    lastupdated=update_tag,
+    _sub_resource_label="AWSAccount",
+    _sub_resource_id=aws_account_id,
+)
+```
+
+### Scenario 2: Rich Relationship Properties
+
+When you need to store detailed metadata on relationships that doesn't make sense as separate nodes.
+
+**Example**: AWS Inspector findings connecting to packages with remediation details:
+
+```python
+# Data with rich relationship properties
+finding_to_package_data = [
+    {
+        "findingarn": "arn:aws:inspector2:us-east-1:123456789012:finding/abc123",
+        "packageid": "openssl|0:1.1.1k-1.el8.x86_64",
+        "filePath": "/usr/lib64/libssl.so.1.1",
+        "fixedInVersion": "0:1.1.1l-1.el8",
+        "remediation": "Update OpenSSL to version 1.1.1l or later",
+    }
+]
+
+# MatchLink schema with rich properties
+@dataclass(frozen=True)
+class InspectorFindingToPackageMatchLink(CartographyRelSchema):
+    target_node_label: str = "AWSInspectorPackage"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
+        "id": PropertyRef("packageid"),
+    })
+    source_node_label: str = "AWSInspectorFinding"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher({
+        "id": PropertyRef("findingarn"),
+    })
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "HAS_VULNERABLE_PACKAGE"
+    properties: InspectorFindingToPackageRelProperties = InspectorFindingToPackageRelProperties()
+
+@dataclass(frozen=True)
+class InspectorFindingToPackageRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef("_sub_resource_label", set_in_kwargs=True)
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+    # Rich relationship properties
+    filepath: PropertyRef = PropertyRef("filePath")
+    fixedinversion: PropertyRef = PropertyRef("fixedInVersion")
+    remediation: PropertyRef = PropertyRef("remediation")
+```
+
+### ⚠️ Performance Impact
+
+MatchLinks have significant performance overhead because they require:
+
+1. **API Call A** → Write Node A to graph
+2. **API Call B** → Write Node B to graph
+3. **Read Node A** from graph
+4. **Read Node B** from graph
+5. **Write relationship** between A and B to graph
+
+**Prefer standard node schemas + relationship schemas** whenever possible:
+
+```python
+# ✅ DO: Use standard node schema with relationships
+@dataclass(frozen=True)
+class YourNodeSchema(CartographyNodeSchema):
+    label: str = "YourNode"
+    properties: YourNodeProperties = YourNodeProperties()
+    sub_resource_relationship: YourNodeToTenantRel = YourNodeToTenantRel()
+    other_relationships: OtherRelationships = OtherRelationships([
+        YourNodeToOtherNodeRel(),  # Standard relationship
+    ])
+
+# ❌ DON'T: Use MatchLinks unless absolutely necessary
+# Only use when you can't define the relationship in the node schema
+```
+
+### When NOT to Use MatchLinks
+
+**❌ Don't use MatchLinks for:**
+- Standard parent-child relationships (use `other_relationships` in node schema)
+- Simple one-to-many relationships (use `one_to_many=True` in standard relationships)
+- When you can define the relationship in the node schema
+- Performance-critical scenarios
+
+**✅ Use MatchLinks only for:**
+- Connecting two existing node types from separate data sources
+- Relationships with rich metadata that doesn't belong in nodes
+
+### Required MatchLink Properties
+
+All MatchLink relationship properties must include these mandatory fields:
+
+```python
+@dataclass(frozen=True)
+class YourMatchLinkRelProperties(CartographyRelProperties):
+    # Required for all MatchLinks
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef("_sub_resource_label", set_in_kwargs=True)
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+    # Your custom properties here
+    custom_property: PropertyRef = PropertyRef("custom_property")
+```
+
+### MatchLink Cleanup
+
+Always implement cleanup for MatchLinks:
+
+```python
+def cleanup(neo4j_session: neo4j.Session, common_job_parameters: dict[str, Any]) -> None:
+    # Standard node cleanup
+    GraphJob.from_node_schema(YourNodeSchema(), common_job_parameters).run(neo4j_session)
+
+    # MatchLink cleanup
+    GraphJob.from_matchlink(
+        YourMatchLinkSchema(),
+        "AWSAccount",  # _sub_resource_label
+        common_job_parameters["AWS_ID"],  # _sub_resource_id
+        common_job_parameters["UPDATE_TAG"],
+    ).run(neo4j_session)
+```
+
 ## ⚙️ Configuration and Credentials {#configuration}
 
 ### Adding CLI Arguments
@@ -966,6 +1138,51 @@ Represents a user in Your Service.
 - User connected to human: `(:YourServiceUser)<-[:IDENTITY_YOUR_SERVICE]-(:Human)`
 ```
 
+### Multiple Intel Modules Modifying the Same Node Type
+
+It is possible (and encouraged) for more than one intel module to modify the same node type. However, there are two distinct patterns for this:
+
+**Simple Relationship Pattern**: When data type A only refers to data type B by an ID without providing additional properties about B, we can just define a relationship schema. This way when A is loaded, the relationship schema performs a `MATCH` to find and connect to existing nodes of type B.
+
+For example, when an RDS instance refers to EC2 security groups by ID, we create a relationship from the RDS instance to the security group nodes, since the RDS API doesn't provide additional properties about the security groups beyond their IDs.
+
+```python
+# RDS Instance refers to Security Groups by ID only
+@dataclass(frozen=True)
+class RDSInstanceToSecurityGroupRel(CartographyRelSchema):
+    target_node_label: str = "EC2SecurityGroup"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
+        "id": PropertyRef("SecurityGroupId"),  # Just the ID, no additional properties
+    })
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "MEMBER_OF_EC2_SECURITY_GROUP"
+    properties: RDSInstanceToSecurityGroupRelProperties = RDSInstanceToSecurityGroupRelProperties()
+```
+
+**Composite Node Pattern**: When a data type A refers to another data type B and offers additional fields about B that B doesn't have itself, we should define a composite node schema. This composite node would be named "`BASchema`" to denote that it's a "`B`" object as known by an "`A`" object. When loaded, the composite node schema targets the same node label as the primary `B` schema, allowing the loading system to perform a `MERGE` operation that combines properties from both sources.
+
+For example, in the AWS EC2 module, we have both `EBSVolumeSchema` (from the EBS API) and `EBSVolumeInstanceSchema` (from the EC2 Instance API). The EC2 Instance API provides additional properties about EBS volumes that the EBS API doesn't have, such as `deleteontermination`. Both schemas target the same `EBSVolume` node label, allowing the node to accumulate properties from both sources.
+
+```python
+# EC2 Instance provides additional properties about EBS Volumes
+@dataclass(frozen=True)
+class EBSVolumeInstanceProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("VolumeId")
+    arn: PropertyRef = PropertyRef("Arn", extra_index=True)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    # Additional property that EBS API doesn't have
+    deleteontermination: PropertyRef = PropertyRef("DeleteOnTermination")
+
+@dataclass(frozen=True)
+class EBSVolumeInstanceSchema(CartographyNodeSchema):
+    label: str = "EBSVolume"  # Same label as EBSVolumeSchema
+    properties: EBSVolumeInstanceProperties = EBSVolumeInstanceProperties()
+    sub_resource_relationship: EBSVolumeToAWSAccountRel = EBSVolumeToAWSAccountRel()
+    # ... other relationships
+```
+
+The key distinction is whether the referring module provides additional properties about the target entity. If it does, use a composite node schema. If it only provides IDs, use a simple relationship schema.
+
 ## 🎯 Final Checklist
 
 Before submitting your module:
@@ -1131,11 +1348,12 @@ from cartography.models.core.common import PropertyRef
 from cartography.models.core.nodes import CartographyNodeProperties, CartographyNodeSchema
 from cartography.models.core.relationships import (
     CartographyRelProperties, CartographyRelSchema, LinkDirection,
-    make_target_node_matcher, TargetNodeMatcher, OtherRelationships
+    make_target_node_matcher, TargetNodeMatcher, OtherRelationships,
+    make_source_node_matcher, SourceNodeMatcher  # For MatchLinks
 )
 
 # Loading and cleanup
-from cartography.client.core.tx import load
+from cartography.client.core.tx import load, load_matchlinks  # load_matchlinks for MatchLinks
 from cartography.graph.job import GraphJob
 
 # Utilities
@@ -1198,6 +1416,50 @@ target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
 })
 ```
 
+### MatchLink Pattern (Use Sparingly!)
+```python
+# Only use for connecting existing nodes or rich relationship properties
+@dataclass(frozen=True)
+class YourMatchLinkSchema(CartographyRelSchema):
+    target_node_label: str = "TargetNode"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
+        "id": PropertyRef("target_id"),
+    })
+    source_node_label: str = "SourceNode"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher({
+        "id": PropertyRef("source_id"),
+    })
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "CONNECTS_TO"
+    properties: YourMatchLinkRelProperties = YourMatchLinkRelProperties()
+
+# Required properties for MatchLinks
+@dataclass(frozen=True)
+class YourMatchLinkRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef("_sub_resource_label", set_in_kwargs=True)
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+    # Your custom properties here
+
+# Load MatchLinks
+load_matchlinks(
+    neo4j_session,
+    YourMatchLinkSchema(),
+    mapping_data,
+    lastupdated=update_tag,
+    _sub_resource_label="AWSAccount",
+    _sub_resource_id=account_id,
+)
+
+# Cleanup MatchLinks
+GraphJob.from_matchlink(
+    YourMatchLinkSchema(),
+    "AWSAccount",
+    account_id,
+    update_tag,
+).run(neo4j_session)
+```
+
 ### Configuration Validation Template
 ```python
 def start_ingestion(neo4j_session: neo4j.Session, config: Config) -> None:

{cartography-0.108.0rc1 → cartography-0.109.0}/Dockerfile

@@ -1,5 +1,5 @@
 # Base image
-FROM python:3.10-slim@sha256:9dd6774a1276178f94b0cc1fb1f0edd980825d0ea7634847af9940b1b6273c13 AS base
+FROM python:3.10-slim@sha256:81f1cdb3770d54ecfdbddcc52c2125fce674c14a1d976dfd8f65dc0734f9c3c5 AS base
 # Default to ''. Overridden with a specific version specifier e.g. '==0.98.0' by build args or from GitHub actions.
 ARG VERSION_SPECIFIER
 # the UID and GID to run cartography as

{cartography-0.108.0rc1 → cartography-0.109.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cartography
-Version: 0.108.0rc1
+Version: 0.109.0
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -82,7 +82,7 @@ You can learn more about the story behind Cartography in our [presentation at BS
 
 ## Supported platforms
 - [Airbyte](https://cartography-cncf.github.io/cartography/modules/airbyte/index.html) - Organization, Workspace, User, Source, Destination, Connection, Tag, Stream
-- [Amazon Web Services](https://cartography-cncf.github.io/cartography/modules/aws/index.html) - ACM, API Gateway, CloudWatch, CodeBuild, Config, EC2, ECS, ECR, Elasticsearch, Elastic Kubernetes Service (EKS), DynamoDB, GuardDuty, IAM, Inspector, KMS, Lambda, RDS, Redshift, Route53, S3, Secrets Manager(Secret Versions), Security Hub, SQS, SSM, STS, Tags
+- [Amazon Web Services](https://cartography-cncf.github.io/cartography/modules/aws/index.html) - ACM, API Gateway, CloudWatch, CodeBuild, Config, EC2, ECS, ECR, EFS, Elasticsearch, Elastic Kubernetes Service (EKS), DynamoDB, Glue, GuardDuty, IAM, Inspector, KMS, Lambda, RDS, Redshift, Route53, S3, Secrets Manager(Secret Versions), Security Hub, SNS, SQS, SSM, STS, Tags
 - [Anthropic](https://cartography-cncf.github.io/cartography/modules/anthropic/index.html) - Organization, ApiKey, User, Workspace
 - [BigFix](https://cartography-cncf.github.io/cartography/modules/bigfix/index.html) - Computers
 - [Cloudflare](https://cartography-cncf.github.io/cartography/modules/cloudflare/index.html) - Account, Role, Member, Zone, DNSRecord

{cartography-0.108.0rc1 → cartography-0.109.0}/README.md

@@ -22,7 +22,7 @@ You can learn more about the story behind Cartography in our [presentation at BS
 
 ## Supported platforms
 - [Airbyte](https://cartography-cncf.github.io/cartography/modules/airbyte/index.html) - Organization, Workspace, User, Source, Destination, Connection, Tag, Stream
-- [Amazon Web Services](https://cartography-cncf.github.io/cartography/modules/aws/index.html) - ACM, API Gateway, CloudWatch, CodeBuild, Config, EC2, ECS, ECR, Elasticsearch, Elastic Kubernetes Service (EKS), DynamoDB, GuardDuty, IAM, Inspector, KMS, Lambda, RDS, Redshift, Route53, S3, Secrets Manager(Secret Versions), Security Hub, SQS, SSM, STS, Tags
+- [Amazon Web Services](https://cartography-cncf.github.io/cartography/modules/aws/index.html) - ACM, API Gateway, CloudWatch, CodeBuild, Config, EC2, ECS, ECR, EFS, Elasticsearch, Elastic Kubernetes Service (EKS), DynamoDB, Glue, GuardDuty, IAM, Inspector, KMS, Lambda, RDS, Redshift, Route53, S3, Secrets Manager(Secret Versions), Security Hub, SNS, SQS, SSM, STS, Tags
 - [Anthropic](https://cartography-cncf.github.io/cartography/modules/anthropic/index.html) - Organization, ApiKey, User, Workspace
 - [BigFix](https://cartography-cncf.github.io/cartography/modules/bigfix/index.html) - Computers
 - [Cloudflare](https://cartography-cncf.github.io/cartography/modules/cloudflare/index.html) - Account, Role, Member, Zone, DNSRecord

{cartography-0.108.0rc1 → cartography-0.109.0}/cartography/_version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '0.108.0rc1'
-__version_tuple__ = version_tuple = (0, 108, 0, 'rc1')
+__version__ = version = '0.109.0'
+__version_tuple__ = version_tuple = (0, 109, 0)

{cartography-0.108.0rc1 → cartography-0.109.0}/cartography/cli.py

@@ -700,6 +700,15 @@ class CLI:
                 "Required if you are using the Trivy module. Ignored otherwise."
             ),
         )
+        parser.add_argument(
+            "--trivy-results-dir",
+            type=str,
+            default=None,
+            help=(
+                "Path to a directory containing Trivy JSON results on disk. "
+                "Required if you are using the Trivy module with local results."
+            ),
+        )
         parser.add_argument(
             "--scaleway-org",
             type=str,
@@ -1089,6 +1098,9 @@ class CLI:
         if config.trivy_s3_prefix:
             logger.debug(f"Trivy S3 prefix: {config.trivy_s3_prefix}")
 
+        if config.trivy_results_dir:
+            logger.debug(f"Trivy results dir: {config.trivy_results_dir}")
+
         # Scaleway config
         if config.scaleway_secret_key_env_var:
             logger.debug(
@@ -1118,6 +1130,8 @@ class CLI:
             config.sentinelone_api_token = os.environ.get(
                 config.sentinelone_api_token_env_var
             )
+        else:
+            config.sentinelone_api_token = None
 
         # Run cartography
         try:

{cartography-0.108.0rc1 → cartography-0.109.0}/cartography/config.py

@@ -152,6 +152,8 @@ class Config:
     :param trivy_s3_bucket: The S3 bucket name containing Trivy scan results. Optional.
     :type trivy_s3_prefix: str
     :param trivy_s3_prefix: The S3 prefix path containing Trivy scan results. Optional.
+    :type trivy_results_dir: str
+    :param trivy_results_dir: Local directory containing Trivy scan results. Optional.
     :type scaleway_access_key: str
     :param scaleway_access_key: Scaleway access key. Optional.
     :type scaleway_secret_key: str
@@ -243,6 +245,7 @@ class Config:
         airbyte_api_url=None,
         trivy_s3_bucket=None,
         trivy_s3_prefix=None,
+        trivy_results_dir=None,
         scaleway_access_key=None,
         scaleway_secret_key=None,
         scaleway_org=None,
@@ -327,6 +330,7 @@ class Config:
         self.airbyte_api_url = airbyte_api_url
         self.trivy_s3_bucket = trivy_s3_bucket
         self.trivy_s3_prefix = trivy_s3_prefix
+        self.trivy_results_dir = trivy_results_dir
         self.scaleway_access_key = scaleway_access_key
         self.scaleway_secret_key = scaleway_secret_key
         self.scaleway_org = scaleway_org

{cartography-0.108.0rc1 → cartography-0.109.0}/cartography/data/indexes.cypher

@@ -29,14 +29,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv4CidrBlock) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv4CidrBlock) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv6CidrBlock) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv6CidrBlock) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambda) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambda) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaEventSourceMapping) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaEventSourceMapping) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaFunctionAlias) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaFunctionAlias) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaLayer) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaLayer) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSPeeringConnection) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSPeeringConnection) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicy) ON (n.id);
@@ -158,13 +150,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:IpRange) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:IpRange) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:JamfComputerGroup) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:JamfComputerGroup) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSKey) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSKey) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSKey) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSAlias) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSAlias) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSGrant) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSGrant) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:LaunchConfiguration) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:LaunchConfiguration) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:LaunchConfiguration) ON (n.lastupdated);
@@ -259,8 +244,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:S3Bucket) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:S3Bucket) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:S3Bucket) ON (n.arn);
 CREATE INDEX IF NOT EXISTS FOR (n:S3Bucket) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:SecretsManagerSecret) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:SecretsManagerSecret) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:SecurityHub) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:SecurityHub) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:SpotlightVulnerability) ON (n.id);

cartography-0.109.0/cartography/data/jobs/cleanup/gcp_compute_vpc_cleanup.json

@@ -0,0 +1,11 @@
+{
+  "statements": [
+    {
+      "query": "MATCH (:GCPInstance)-[r:MEMBER_OF_GCP_VPC]->(:GCPVpc) WHERE r.lastupdated <> $UPDATE_TAG WITH r LIMIT $LIMIT_SIZE DELETE (r)",
+      "iterative": true,
+      "iterationsize": 100,
+      "__comment__": "Remove GCP Instance-to-VPC relationships that are out of date."
+    }
+  ],
+  "name": "cleanup GCP Instances"
+}

{cartography-0.108.0rc1 → cartography-0.109.0}/cartography/intel/aws/cloudtrail.py

@@ -26,13 +26,25 @@ def get_cloudtrail_trails(
     )
 
     trails = client.describe_trails()["trailList"]
-
-    # CloudTrail multi-region trails are shown in list_trails,
-    # but the get_trail call only works in the home region
     trails_filtered = [trail for trail in trails if trail.get("HomeRegion") == region]
+
     return trails_filtered
 
 
+def transform_cloudtrail_trails(
+    trails: List[Dict[str, Any]], region: str
+) -> List[Dict[str, Any]]:
+    """
+    Transform CloudTrail trail data for ingestion
+    """
+    for trail in trails:
+        arn = trail.get("CloudWatchLogsLogGroupArn")
+        if arn:
+            trail["CloudWatchLogsLogGroupArn"] = arn.split(":*")[0]
+
+    return trails
+
+
 @timeit
 def load_cloudtrail_trails(
     neo4j_session: neo4j.Session,
@@ -79,7 +91,8 @@ def sync(
         logger.info(
             f"Syncing CloudTrail for region '{region}' in account '{current_aws_account_id}'.",
         )
-        trails = get_cloudtrail_trails(boto3_session, region)
+        trails_filtered = get_cloudtrail_trails(boto3_session, region)
+        trails = transform_cloudtrail_trails(trails_filtered, region)
 
         load_cloudtrail_trails(
             neo4j_session,