cartography 0.112.0__py3-none-any.whl → 0.114.0__py3-none-any.whl

cartography/_version.py

@@ -28,7 +28,7 @@ version_tuple: VERSION_TUPLE
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '0.112.0'
-__version_tuple__ = version_tuple = (0, 112, 0)
+__version__ = version = '0.114.0'
+__version_tuple__ = version_tuple = (0, 114, 0)
 
 __commit_id__ = commit_id = None

cartography/cli.py

@@ -328,6 +328,14 @@ class CLI:
                 "Required if you are using the GitHub intel module. Ignored otherwise."
             ),
         )
+        parser.add_argument(
+            "--github-commit-lookback-days",
+            type=int,
+            default=30,
+            help=(
+                "Number of days to look back for tracking GitHub users committing to repositories. Defaults to 30 days."
+            ),
+        )
         parser.add_argument(
             "--digitalocean-token-env-var",
             type=str,

cartography/config.py

@@ -70,6 +70,8 @@ class Config:
     :param okta_saml_role_regex: The regex used to map okta groups to AWS roles. Optional.
     :type github_config: str
     :param github_config: Base64 encoded config object for GitHub ingestion. Optional.
+    :type github_commit_lookback_days: int
+    :param github_commit_lookback_days: Number of days to look back for GitHub commit tracking. Optional.
     :type digitalocean_token: str
     :param digitalocean_token: DigitalOcean access token. Optional.
     :type permission_relationships_file: str
@@ -210,6 +212,7 @@ class Config:
         okta_api_key=None,
         okta_saml_role_regex=None,
         github_config=None,
+        github_commit_lookback_days=30,
         digitalocean_token=None,
         permission_relationships_file=None,
         jamf_base_uri=None,
@@ -301,6 +304,7 @@ class Config:
         self.okta_api_key = okta_api_key
         self.okta_saml_role_regex = okta_saml_role_regex
         self.github_config = github_config
+        self.github_commit_lookback_days = github_commit_lookback_days
         self.digitalocean_token = digitalocean_token
         self.permission_relationships_file = permission_relationships_file
         self.jamf_base_uri = jamf_base_uri

cartography/data/indexes.cypher

@@ -21,23 +21,12 @@ CREATE INDEX IF NOT EXISTS FOR (n:AWSDNSRecord) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSDNSZone) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSDNSZone) ON (n.zoneid);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSDNSZone) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSGroup) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSGroup) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSInternetGateway) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSInternetGateway) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv4CidrBlock) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv4CidrBlock) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv6CidrBlock) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv6CidrBlock) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicy) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicy) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicy) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicyStatement) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicyStatement) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPrincipal) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPrincipal) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSRole) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSRole) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTag) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTag) ON (n.key);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTag) ON (n.lastupdated);
@@ -46,11 +35,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:AWSTransitGateway) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTransitGateway) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTransitGatewayAttachment) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTransitGatewayAttachment) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AccountAccessKey) ON (n.accesskeyid);
-CREATE INDEX IF NOT EXISTS FOR (n:AccountAccessKey) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AutoScalingGroup) ON (n.arn);
 CREATE INDEX IF NOT EXISTS FOR (n:AutoScalingGroup) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:CVE) ON (n.id);
@@ -100,12 +84,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:ESDomain) ON (n.arn);
 CREATE INDEX IF NOT EXISTS FOR (n:ESDomain) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:ESDomain) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:ESDomain) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPDNSZone) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPDNSZone) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPRecordSet) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPRecordSet) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPFolder) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPFolder) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPForwardingRule) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPForwardingRule) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPInstance) ON (n.id);
@@ -116,23 +94,14 @@ CREATE INDEX IF NOT EXISTS FOR (n:GCPNetworkTag) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPNetworkTag) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPNicAccessConfig) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPNicAccessConfig) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPOrganization) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPOrganization) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPProject) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPProject) ON (n.projectnumber);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPProject) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPBucket) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPBucket) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPBucketLabel) ON (n.key);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPBucketLabel) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPSubnet) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPSubnet) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPVpc) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPVpc) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GitHubRepository) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GitHubRepository) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GKECluster) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GKECluster) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GSuiteGroup) ON (n.email);
 CREATE INDEX IF NOT EXISTS FOR (n:GSuiteGroup) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GSuiteGroup) ON (n.lastupdated);

cartography/intel/aws/apigatewayv2.py

@@ -0,0 +1,116 @@
+import logging
+from typing import Any
+
+import boto3
+import neo4j
+
+from cartography.client.core.tx import load
+from cartography.graph.job import GraphJob
+from cartography.models.aws.apigatewayv2.apigatewayv2 import APIGatewayV2APISchema
+from cartography.util import aws_handle_regions
+from cartography.util import timeit
+
+logger = logging.getLogger(__name__)
+
+
+@timeit
+@aws_handle_regions
+def get_apigatewayv2_apis(
+    boto3_session: boto3.session.Session,
+    region: str,
+) -> list[dict[str, Any]]:
+    client = boto3_session.client("apigatewayv2", region_name=region)
+    paginator = client.get_paginator("get_apis")
+    apis: list[dict[str, Any]] = []
+    for page in paginator.paginate():
+        apis.extend(page.get("Items", []))
+    return apis
+
+
+def transform_apigatewayv2_apis(apis: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    transformed: list[dict[str, Any]] = []
+    for api in apis:
+        transformed.append(
+            {
+                "id": api.get("ApiId"),
+                "name": api.get("Name"),
+                "protocoltype": api.get("ProtocolType"),
+                "routeselectionexpression": api.get("RouteSelectionExpression"),
+                "apikeyselectionexpression": api.get("ApiKeySelectionExpression"),
+                "apiendpoint": api.get("ApiEndpoint"),
+                "version": api.get("Version"),
+                "createddate": api.get("CreatedDate"),
+                "description": api.get("Description"),
+            },
+        )
+    return transformed
+
+
+@timeit
+def load_apigatewayv2_apis(
+    neo4j_session: neo4j.Session,
+    data: list[dict[str, Any]],
+    region: str,
+    current_aws_account_id: str,
+    update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        APIGatewayV2APISchema(),
+        data,
+        lastupdated=update_tag,
+        AWS_ID=current_aws_account_id,
+        region=region,
+    )
+
+
+@timeit
+def cleanup(
+    neo4j_session: neo4j.Session, common_job_parameters: dict[str, Any]
+) -> None:
+    GraphJob.from_node_schema(
+        APIGatewayV2APISchema(),
+        common_job_parameters,
+    ).run(neo4j_session)
+
+
+@timeit
+def sync_apigatewayv2_apis(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    apis = get_apigatewayv2_apis(boto3_session, region)
+    transformed = transform_apigatewayv2_apis(apis)
+    load_apigatewayv2_apis(
+        neo4j_session,
+        transformed,
+        region,
+        current_aws_account_id,
+        aws_update_tag,
+    )
+
+
+@timeit
+def sync(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    regions: list[str],
+    current_aws_account_id: str,
+    update_tag: int,
+    common_job_parameters: dict[str, Any],
+) -> None:
+    for region in regions:
+        logger.info(
+            f"Syncing AWS APIGatewayV2 APIs for region '{region}' in account '{current_aws_account_id}'.",
+        )
+        sync_apigatewayv2_apis(
+            neo4j_session,
+            boto3_session,
+            region,
+            current_aws_account_id,
+            update_tag,
+        )
+    cleanup(neo4j_session, common_job_parameters)