cartography 0.112.0__py3-none-any.whl → 0.114.0__py3-none-any.whl

cartography/models/aws/iam/access_key.py

@@ -0,0 +1,103 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("accesskeyid")
+    accesskeyid: PropertyRef = PropertyRef("accesskeyid", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM access keys
+    createdate: PropertyRef = PropertyRef("createdate")
+    status: PropertyRef = PropertyRef("status")
+    lastuseddate: PropertyRef = PropertyRef("lastuseddate")
+    lastusedservice: PropertyRef = PropertyRef("lastusedservice")
+    lastusedregion: PropertyRef = PropertyRef("lastusedregion")
+
+
+@dataclass(frozen=True)
+class AWSUserToAccountAccessKeyRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSUserToAccountAccessKeyRel(CartographyRelSchema):
+    target_node_label: str = "AccountAccessKey"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "accesskeyid": PropertyRef("accesskeyid"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "AWS_ACCESS_KEY"
+    properties: AWSUserToAccountAccessKeyRelProperties = (
+        AWSUserToAccountAccessKeyRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyToAWSUserRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyToAWSUserRel(CartographyRelSchema):
+    target_node_label: str = "AWSUser"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("user_arn"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "AWS_ACCESS_KEY"
+    properties: AccountAccessKeyToAWSUserRelProperties = (
+        AccountAccessKeyToAWSUserRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AccountAccessKeyToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AccountAccessKeyToAWSAccountRelProperties = (
+        AccountAccessKeyToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AccountAccessKeySchema(CartographyNodeSchema):
+    label: str = "AccountAccessKey"
+    properties: AccountAccessKeyNodeProperties = AccountAccessKeyNodeProperties()
+    sub_resource_relationship: AccountAccessKeyToAWSAccountRel = (
+        AccountAccessKeyToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AccountAccessKeyToAWSUserRel(),
+            AccountAccessKeyToAWSAccountRel(),
+        ]
+    )

cartography/models/aws/iam/account_role.py

@@ -0,0 +1,24 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+
+
+@dataclass(frozen=True)
+class AWSAccountAWSRoleNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("id")
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSAccountAWSRoleSchema(CartographyNodeSchema):
+    """
+    An AWSAccount that was discovered from a trusted principal in an IAM role.
+    """
+
+    label: str = "AWSAccount"
+    properties: AWSAccountAWSRoleNodeProperties = AWSAccountAWSRoleNodeProperties()

cartography/models/aws/iam/federated_principal.py

@@ -0,0 +1,60 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSFederatedPrincipalNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM federated principals
+    type: PropertyRef = PropertyRef("type")
+
+
+@dataclass(frozen=True)
+class AWSFederatedPrincipalToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSFederatedPrincipalToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSFederatedPrincipalToAWSAccountRelProperties = (
+        AWSFederatedPrincipalToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSFederatedPrincipalSchema(CartographyNodeSchema):
+    """
+    E.g. "arn:aws:iam::123456789012:saml-provider/my-saml-provider".
+    """
+
+    label: str = "AWSFederatedPrincipal"
+    properties: AWSFederatedPrincipalNodeProperties = (
+        AWSFederatedPrincipalNodeProperties()
+    )
+    sub_resource_relationship: AWSFederatedPrincipalToAWSAccountRel = (
+        AWSFederatedPrincipalToAWSAccountRel()
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])

cartography/models/aws/iam/group.py

@@ -0,0 +1,60 @@
+from dataclasses import dataclass
+
+from cartography.models.aws.iam.group_membership import AWSGroupToAWSUserRel
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSGroupNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM groups
+    groupid: PropertyRef = PropertyRef("groupid")
+    name: PropertyRef = PropertyRef("name")
+    path: PropertyRef = PropertyRef("path")
+    createdate: PropertyRef = PropertyRef("createdate")
+
+
+@dataclass(frozen=True)
+class AWSGroupToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSGroupToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSGroupToAWSAccountRelProperties = AWSGroupToAWSAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class AWSGroupSchema(CartographyNodeSchema):
+    label: str = "AWSGroup"
+    properties: AWSGroupNodeProperties = AWSGroupNodeProperties()
+    sub_resource_relationship: AWSGroupToAWSAccountRel = AWSGroupToAWSAccountRel()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AWSGroupToAWSUserRel(),
+        ]
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])

cartography/models/aws/iam/group_membership.py

@@ -0,0 +1,26 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSGroupToAWSUserRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSGroupToAWSUserRel(CartographyRelSchema):
+    target_node_label: str = "AWSUser"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("user_arn"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "MEMBER_AWS_GROUP"
+    properties: AWSGroupToAWSUserRelProperties = AWSGroupToAWSUserRelProperties()

cartography/models/aws/iam/inline_policy.py

@@ -0,0 +1,78 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    name: PropertyRef = PropertyRef("name")
+    type: PropertyRef = PropertyRef("type")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyToAWSPrincipalRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyToAWSPrincipalRel(CartographyRelSchema):
+    target_node_label: str = "AWSPrincipal"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("principal_arns", one_to_many=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "POLICY"
+    properties: AWSInlinePolicyToAWSPrincipalRelProperties = (
+        AWSInlinePolicyToAWSPrincipalRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicyToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSInlinePolicyToAWSAccountRelProperties = (
+        AWSInlinePolicyToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSInlinePolicySchema(CartographyNodeSchema):
+    """
+    Inline policies are defined on the given principal and are therefore scoped to that principal's account.
+    """
+
+    label: str = "AWSInlinePolicy"
+    properties: AWSInlinePolicyNodeProperties = AWSInlinePolicyNodeProperties()
+    sub_resource_relationship: AWSInlinePolicyToAWSAccountRel = (
+        AWSInlinePolicyToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [AWSInlinePolicyToAWSPrincipalRel()]
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPolicy"])

cartography/models/aws/iam/managed_policy.py

@@ -0,0 +1,51 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSManagedPolicyNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    name: PropertyRef = PropertyRef("name")
+    type: PropertyRef = PropertyRef("type")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+
+@dataclass(frozen=True)
+class AWSManagedPolicyToAWSPrincipalRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSManagedPolicyToAWSPrincipalRel(CartographyRelSchema):
+    target_node_label: str = "AWSPrincipal"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("principal_arns", one_to_many=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "POLICY"
+    properties: AWSManagedPolicyToAWSPrincipalRelProperties = (
+        AWSManagedPolicyToAWSPrincipalRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSManagedPolicySchema(CartographyNodeSchema):
+    label: str = "AWSManagedPolicy"
+    properties: AWSManagedPolicyNodeProperties = AWSManagedPolicyNodeProperties()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [AWSManagedPolicyToAWSPrincipalRel()]
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPolicy"])

cartography/models/aws/iam/policy_statement.py

@@ -0,0 +1,57 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("id")
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM policy statements
+    effect: PropertyRef = PropertyRef("Effect")
+    action: PropertyRef = PropertyRef("Action")
+    notaction: PropertyRef = PropertyRef("NotAction")
+    resource: PropertyRef = PropertyRef("Resource")
+    notresource: PropertyRef = PropertyRef("NotResource")
+    condition: PropertyRef = PropertyRef("Condition")
+    sid: PropertyRef = PropertyRef("Sid")
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementToAWSPolicyRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementToAWSPolicyRel(CartographyRelSchema):
+    target_node_label: str = "AWSPolicy"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("POLICY_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "STATEMENT"
+    properties: AWSPolicyStatementToAWSPolicyRelProperties = (
+        AWSPolicyStatementToAWSPolicyRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementSchema(CartographyNodeSchema):
+    label: str = "AWSPolicyStatement"
+    properties: AWSPolicyStatementNodeProperties = AWSPolicyStatementNodeProperties()
+    sub_resource_relationship: AWSPolicyStatementToAWSPolicyRel = (
+        AWSPolicyStatementToAWSPolicyRel()
+    )

cartography/models/aws/iam/role.py

@@ -0,0 +1,83 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSRoleNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM roles
+    roleid: PropertyRef = PropertyRef("roleid")
+    name: PropertyRef = PropertyRef("name")
+    path: PropertyRef = PropertyRef("path")
+    createdate: PropertyRef = PropertyRef("createdate")
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSRoleToAWSAccountRelProperties = AWSRoleToAWSAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSPrincipalTrustRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSPrincipalTrustRel(CartographyRelSchema):
+    """
+    Trust relationship with principals of type "AWS".
+    """
+
+    target_node_label: str = "AWSPrincipal"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("trusted_aws_principals", one_to_many=True),
+        },
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "TRUSTS_AWS_PRINCIPAL"
+    properties: AWSRoleToAWSPrincipalTrustRelProperties = (
+        AWSRoleToAWSPrincipalTrustRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSRoleSchema(CartographyNodeSchema):
+    label: str = "AWSRole"
+    properties: AWSRoleNodeProperties = AWSRoleNodeProperties()
+    sub_resource_relationship: AWSRoleToAWSAccountRel = AWSRoleToAWSAccountRel()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AWSRoleToAWSPrincipalTrustRel(),
+        ]
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])

cartography/models/aws/iam/root_principal.py

@@ -0,0 +1,52 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSRootPrincipalNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRootPrincipalToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRootPrincipalToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSRootPrincipalToAWSAccountRelProperties = (
+        AWSRootPrincipalToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSRootPrincipalSchema(CartographyNodeSchema):
+    """
+    Represents the AWS root principal for an AWS account
+    """
+
+    label: str = "AWSRootPrincipal"
+    properties: AWSRootPrincipalNodeProperties = AWSRootPrincipalNodeProperties()
+    sub_resource_relationship: AWSRootPrincipalToAWSAccountRel = (
+        AWSRootPrincipalToAWSAccountRel()
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])

cartography/models/aws/iam/service_principal.py

@@ -0,0 +1,30 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+
+
+@dataclass(frozen=True)
+class AWSServicePrincipalNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM service principals
+    type: PropertyRef = PropertyRef("type")
+
+
+@dataclass(frozen=True)
+class AWSServicePrincipalSchema(CartographyNodeSchema):
+    """
+    Represents a global AWS service principal e.g. "ec2.amazonaws.com"
+    """
+
+    label: str = "AWSServicePrincipal"
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])
+    properties: AWSServicePrincipalNodeProperties = AWSServicePrincipalNodeProperties()

cartography/models/aws/iam/sts_assumerole_allow.py

@@ -0,0 +1,38 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_source_node_matcher
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import SourceNodeMatcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class STSAssumeRoleAllowRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef(
+        "_sub_resource_label", set_in_kwargs=True
+    )
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class STSAssumeRoleAllowMatchLink(CartographyRelSchema):
+    rel_label: str = "STS_ASSUMEROLE_ALLOW"
+    direction: LinkDirection = LinkDirection.OUTWARD
+    properties: STSAssumeRoleAllowRelProperties = STSAssumeRoleAllowRelProperties()
+
+    # Target node (the role being assumed)
+    target_node_label: str = "AWSRole"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"arn": PropertyRef("target_arn")},
+    )
+
+    # Source node (the principal that can assume the role)
+    source_node_label: str = "AWSPrincipal"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher(
+        {"arn": PropertyRef("source_arn")},
+    )