cartography 0.117.0__py3-none-any.whl → 0.118.0__py3-none-any.whl

cartography/intel/gcp/compute.py

@@ -15,6 +15,7 @@ from googleapiclient.discovery import Resource
 from googleapiclient.errors import HttpError
 
 from cartography.client.core.tx import load
+from cartography.client.core.tx import run_write_query
 from cartography.graph.job import GraphJob
 from cartography.models.gcp.compute.vpc import GCPVpcSchema
 from cartography.util import run_cleanup_job
@@ -619,7 +620,8 @@ def load_gcp_instances(
     SET r.lastupdated = $gcp_update_tag
     """
     for instance in data:
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             query,
             ProjectId=instance["project_id"],
             PartialUri=instance["partial_uri"],
@@ -714,7 +716,8 @@ def load_gcp_forwarding_rules(
         network = fwd.get("network", None)
         subnetwork = fwd.get("subnetwork", None)
 
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             query,
             PartialUri=fwd["partial_uri"],
             IPAddress=fwd["ip_address"],
@@ -760,7 +763,8 @@ def _attach_fwd_rule_to_subnet(
         SET p.lastupdated = $gcp_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         query,
         PartialUri=fwd["partial_uri"],
         SubNetworkPartialUri=fwd.get("subnetwork_partial_uri", None),
@@ -787,7 +791,8 @@ def _attach_fwd_rule_to_vpc(
         SET r.lastupdated = $gcp_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         query,
         PartialUri=fwd["partial_uri"],
         NetworkPartialUri=fwd.get("network_partial_uri", None),
@@ -831,7 +836,8 @@ def _attach_instance_tags(
     for tag in instance.get("tags", {}).get("items", []):
         for nic in instance.get("networkInterfaces", []):
             tag_id = _create_gcp_network_tag_id(nic["vpc_partial_uri"], tag)
-            neo4j_session.run(
+            run_write_query(
+                neo4j_session,
                 query,
                 InstanceId=instance["partial_uri"],
                 TagId=tag_id,
@@ -880,7 +886,8 @@ def _attach_gcp_nics(
     for nic in instance.get("networkInterfaces", []):
         # Make an ID for GCPNetworkInterface nodes because GCP doesn't define one but we need to uniquely identify them
         nic_id = f"{instance['partial_uri']}/networkinterfaces/{nic['name']}"
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             query,
             InstanceId=instance["partial_uri"],
             NicId=nic_id,
@@ -926,7 +933,8 @@ def _attach_gcp_nic_access_configs(
     for ac in nic.get("accessConfigs", []):
         # Make an ID for GCPNicAccessConfig nodes because GCP doesn't define one but we need to uniquely identify them
         access_config_id = f"{nic_id}/accessconfigs/{ac['type']}"
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             query,
             NicId=nic_id,
             AccessConfigId=access_config_id,
@@ -960,7 +968,8 @@ def _attach_gcp_vpc(
     ON CREATE SET m.firstseen = timestamp()
     SET m.lastupdated = $gcp_update_tag
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         query,
         InstanceId=instance_id,
         gcp_update_tag=gcp_update_tag,
@@ -974,10 +983,22 @@ def load_gcp_ingress_firewalls(
     gcp_update_tag: int,
 ) -> None:
     """
-    Load the firewall list to Neo4j
+    Load the firewall list to Neo4j.
     :param fw_list: The transformed list of firewalls
     :return: Nothing
     """
+    neo4j_session.execute_write(
+        _load_gcp_ingress_firewalls_tx,
+        fw_list,
+        gcp_update_tag,
+    )
+
+
+def _load_gcp_ingress_firewalls_tx(
+    tx: neo4j.Transaction,
+    fw_list: List[Resource],
+    gcp_update_tag: int,
+) -> None:
     query = """
     MERGE (fw:GCPFirewall{id:$FwPartialUri})
     ON CREATE SET fw.firstseen = timestamp(),
@@ -1000,7 +1021,7 @@ def load_gcp_ingress_firewalls(
     SET r.lastupdated = $gcp_update_tag
     """
     for fw in fw_list:
-        neo4j_session.run(
+        tx.run(
             query,
             FwPartialUri=fw["id"],
             Direction=fw["direction"],
@@ -1012,19 +1033,19 @@ def load_gcp_ingress_firewalls(
             HasTargetServiceAccounts=fw["has_target_service_accounts"],
             gcp_update_tag=gcp_update_tag,
         )
-        _attach_firewall_rules(neo4j_session, fw, gcp_update_tag)
-        _attach_target_tags(neo4j_session, fw, gcp_update_tag)
+        _attach_firewall_rules(tx, fw, gcp_update_tag)
+        _attach_target_tags(tx, fw, gcp_update_tag)
 
 
 @timeit
 def _attach_firewall_rules(
-    neo4j_session: neo4j.Session,
+    tx: neo4j.Transaction,
     fw: Resource,
     gcp_update_tag: int,
 ) -> None:
     """
     Attach the allow_rules to the Firewall object
-    :param neo4j_session: The Neo4j session
+    :param tx: The Neo4j transaction
     :param fw: The Firewall object
     :param gcp_update_tag: The timestamp
     :return: Nothing
@@ -1065,7 +1086,7 @@ def _attach_firewall_rules(
             # If sourceRanges is not specified then the rule must specify sourceTags.
             # Since an IP range cannot have a tag applied to it, it is ok if we don't ingest this rule.
             for ip_range in fw.get("sourceRanges", []):
-                neo4j_session.run(
+                tx.run(
                     template.safe_substitute(fw_rule_relationship_label=label),
                     FwPartialUri=fw["id"],
                     RuleId=rule["ruleid"],
@@ -1079,13 +1100,13 @@ def _attach_firewall_rules(
 
 @timeit
 def _attach_target_tags(
-    neo4j_session: neo4j.Session,
+    tx: neo4j.Transaction,
     fw: Resource,
     gcp_update_tag: int,
 ) -> None:
     """
     Attach target tags to the firewall object
-    :param neo4j_session: The neo4j session
+    :param tx: The neo4j transaction
     :param fw: The firewall object
     :param gcp_update_tag: The timestamp
     :return: Nothing
@@ -1105,7 +1126,7 @@ def _attach_target_tags(
     """
     for tag in fw.get("targetTags", []):
         tag_id = _create_gcp_network_tag_id(fw["vpc_partial_uri"], tag)
-        neo4j_session.run(
+        tx.run(
             query,
             FwPartialUri=fw["id"],
             TagId=tag_id,

cartography/intel/gcp/crm/folders.py

@@ -1,8 +1,10 @@
 import logging
 from typing import Dict
 from typing import List
+from typing import Optional
 
 import neo4j
+from google.auth.credentials import Credentials as GoogleCredentials
 from google.cloud import resourcemanager_v3
 
 from cartography.client.core.tx import load
@@ -13,7 +15,10 @@ logger = logging.getLogger(__name__)
 
 
 @timeit
-def get_gcp_folders(org_resource_name: str) -> List[Dict]:
+def get_gcp_folders(
+    org_resource_name: str,
+    credentials: Optional[GoogleCredentials] = None,
+) -> List[Dict]:
     """
     Return a list of all descendant GCP folders under the specified organization by traversing the folder tree.
 
@@ -21,7 +26,7 @@ def get_gcp_folders(org_resource_name: str) -> List[Dict]:
     :return: List of folder dicts with 'name' field containing full resource names (e.g., "folders/123456")
     """
     results: List[Dict] = []
-    client = resourcemanager_v3.FoldersClient()
+    client = resourcemanager_v3.FoldersClient(credentials=credentials)
     # BFS over folders starting at the org root
     queue: List[str] = [org_resource_name]
     seen: set[str] = set()
@@ -96,6 +101,7 @@ def sync_gcp_folders(
     gcp_update_tag: int,
     common_job_parameters: Dict,
     org_resource_name: str,
+    credentials: Optional[GoogleCredentials] = None,
 ) -> List[Dict]:
     """
     Get GCP folder data using the CRM v2 resource object and load the data to Neo4j.
@@ -103,6 +109,6 @@ def sync_gcp_folders(
     :return: List of folders synced
     """
     logger.debug("Syncing GCP folders")
-    folders = get_gcp_folders(org_resource_name)
+    folders = get_gcp_folders(org_resource_name, credentials=credentials)
     load_gcp_folders(neo4j_session, folders, gcp_update_tag, org_resource_name)
     return folders

cartography/intel/gcp/crm/orgs.py

@@ -1,8 +1,10 @@
 import logging
 from typing import Dict
 from typing import List
+from typing import Optional
 
 import neo4j
+from google.auth.credentials import Credentials as GoogleCredentials
 from google.cloud import resourcemanager_v3
 
 from cartography.client.core.tx import load
@@ -13,13 +15,15 @@ logger = logging.getLogger(__name__)
 
 
 @timeit
-def get_gcp_organizations() -> List[Dict]:
+def get_gcp_organizations(
+    credentials: Optional[GoogleCredentials] = None,
+) -> List[Dict]:
     """
     Return list of GCP organizations that the authenticated principal can access using the high-level client.
     Returns empty list on error.
     :return: List of org dicts with keys: name, displayName, lifecycleState.
     """
-    client = resourcemanager_v3.OrganizationsClient()
+    client = resourcemanager_v3.OrganizationsClient(credentials=credentials)
     orgs = []
     for org in client.search_organizations():
         orgs.append(
@@ -54,12 +58,13 @@ def sync_gcp_organizations(
     neo4j_session: neo4j.Session,
     gcp_update_tag: int,
     common_job_parameters: Dict,
+    credentials: Optional[GoogleCredentials] = None,
 ) -> List[Dict]:
     """
     Get GCP organization data using the CRM v1 resource object and load the data to Neo4j.
     Returns the list of organizations synced.
     """
     logger.debug("Syncing GCP organizations")
-    data = get_gcp_organizations()
+    data = get_gcp_organizations(credentials=credentials)
     load_gcp_organizations(neo4j_session, data, gcp_update_tag)
     return data

cartography/intel/gcp/crm/projects.py

@@ -1,8 +1,10 @@
 import logging
 from typing import Dict
 from typing import List
+from typing import Optional
 
 import neo4j
+from google.auth.credentials import Credentials as GoogleCredentials
 from google.cloud import resourcemanager_v3
 
 from cartography.client.core.tx import load
@@ -13,7 +15,11 @@ logger = logging.getLogger(__name__)
 
 
 @timeit
-def get_gcp_projects(org_resource_name: str, folders: List[Dict]) -> List[Dict]:
+def get_gcp_projects(
+    org_resource_name: str,
+    folders: List[Dict],
+    credentials: Optional[GoogleCredentials] = None,
+) -> List[Dict]:
     """
     Return list of ACTIVE GCP projects under the specified organization
     and within the specified folders.
@@ -25,7 +31,7 @@ def get_gcp_projects(org_resource_name: str, folders: List[Dict]) -> List[Dict]:
     parents = set([org_resource_name] + folder_names)
     results: List[Dict] = []
     for parent in parents:
-        client = resourcemanager_v3.ProjectsClient()
+        client = resourcemanager_v3.ProjectsClient(credentials=credentials)
         for proj in client.list_projects(parent=parent):
             # list_projects returns ACTIVE projects by default
             name_field = proj.name  # "projects/<number>"
@@ -96,6 +102,7 @@ def sync_gcp_projects(
     folders: List[Dict],
     gcp_update_tag: int,
     common_job_parameters: Dict,
+    credentials: Optional[GoogleCredentials] = None,
 ) -> List[Dict]:
     """
     Get and sync GCP project data to Neo4j.
@@ -104,6 +111,10 @@ def sync_gcp_projects(
     :return: List of projects synced
     """
     logger.debug("Syncing GCP projects")
-    projects = get_gcp_projects(org_resource_name, folders)
+    projects = get_gcp_projects(
+        org_resource_name,
+        folders,
+        credentials=credentials,
+    )
     load_gcp_projects(neo4j_session, projects, gcp_update_tag, org_resource_name)
     return projects

cartography/intel/jamf/computers.py

@@ -4,6 +4,7 @@ from typing import List
 
 import neo4j
 
+from cartography.client.core.tx import run_write_query
 from cartography.intel.jamf.util import call_jamf_api
 from cartography.util import run_cleanup_job
 from cartography.util import timeit
@@ -35,7 +36,12 @@ def load_computer_groups(
     g.lastupdated = $UpdateTag
     """
     groups = data.get("computer_groups")
-    neo4j_session.run(ingest_groups, JsonData=groups, UpdateTag=update_tag)
+    run_write_query(
+        neo4j_session,
+        ingest_groups,
+        JsonData=groups,
+        UpdateTag=update_tag,
+    )
 
 
 @timeit

cartography/intel/oci/iam.py

@@ -10,6 +10,8 @@ from typing import List
 import neo4j
 import oci
 
+from cartography.client.core.tx import read_list_of_dicts_tx
+from cartography.client.core.tx import run_write_query
 from cartography.util import run_cleanup_job
 
 from . import utils
@@ -89,7 +91,8 @@ def load_compartments(
     """
 
     for compartment in compartments:
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             ingest_compartment,
             OCID=compartment["id"],
             COMPARTMENT_ID=compartment["compartment-id"],
@@ -126,7 +129,8 @@ def load_users(
     """
 
     for user in users:
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             ingest_user,
             OCID=user["id"],
             CREATE_DATE=str(user["time-created"]),
@@ -206,7 +210,8 @@ def load_groups(
     """
 
     for group in groups:
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             ingest_group,
             OCID=group["id"],
             CREATE_DATE=str(group["time-created"]),
@@ -260,7 +265,11 @@ def sync_group_memberships(
         "MATCH (group:OCIGroup)<-[:RESOURCE]-(OCITenancy{ocid: $OCI_TENANCY_ID}) "
         "return group.name as name, group.ocid as ocid;"
     )
-    groups = neo4j_session.run(query, OCI_TENANCY_ID=current_tenancy_id)
+    groups = neo4j_session.execute_read(
+        read_list_of_dicts_tx,
+        query,
+        OCI_TENANCY_ID=current_tenancy_id,
+    )
     groups_membership = {
         group["ocid"]: get_group_membership_data(iam, group["ocid"], current_tenancy_id)
         for group in groups
@@ -288,7 +297,8 @@ def load_group_memberships(
     """
     for group_ocid, membership_data in group_memberships.items():
         for info in membership_data["GroupMemberships"]:
-            neo4j_session.run(
+            run_write_query(
+                neo4j_session,
                 ingest_membership,
                 COMPARTMENT_ID=info["compartment-id"],
                 GROUP_OCID=info["group-id"],
@@ -317,7 +327,8 @@ def load_policies(
     """
 
     for policy in policies:
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             ingest_policy,
             OCID=policy["id"],
             POLICY_NAME=policy["name"],
@@ -386,7 +397,8 @@ def load_oci_policy_group_reference(
     ON CREATE SET r.firstseen = timestamp()
     SET r.lastupdated = $oci_update_tag
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_policy_group_reference,
         POLICY_ID=policy_id,
         GROUP_ID=group_id,
@@ -408,7 +420,8 @@ def load_oci_policy_compartment_reference(
     ON CREATE SET r.firstseen = timestamp()
     SET r.lastupdated = $oci_update_tag
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_policy_compartment_reference,
         POLICY_ID=policy_id,
         COMPARTMENT_ID=compartment_id,
@@ -487,7 +500,8 @@ def load_region_subscriptions(
     SET r.lastupdated = $oci_update_tag
     """
     for region in regions:
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             query,
             REGION_KEY=region["region-key"],
             REGION_NAME=region["region-name"],

cartography/intel/oci/organizations.py

@@ -11,6 +11,7 @@ from oci.exceptions import ConfigFileNotFound
 from oci.exceptions import InvalidConfig
 from oci.exceptions import ProfileNotFound
 
+from cartography.client.core.tx import run_write_query
 from cartography.util import run_cleanup_job
 
 logger = logging.getLogger(__name__)
@@ -100,7 +101,8 @@ def load_oci_accounts(
     SET aa.lastupdated = $oci_update_tag, aa.name = $ACCOUNT_NAME
     """
     for name in oci_accounts:
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             query,
             TENANCY_ID=oci_accounts[name]["tenancy"],
             ACCOUNT_NAME=name,

cartography/intel/oci/utils.py

@@ -7,6 +7,8 @@ from typing import List
 
 import neo4j
 
+from cartography.client.core.tx import read_list_of_dicts_tx
+
 
 # Generic way to turn a OCI python object into the json response that you would see from calling the REST API.
 def oci_object_to_json(in_obj: Any) -> List[Dict[str, Any]]:
@@ -36,7 +38,11 @@ def get_compartments_in_tenancy(
         "return DISTINCT compartment.name as name, compartment.ocid as ocid, "
         "compartment.compartmentid as compartmentid;"
     )
-    return neo4j_session.run(query, OCI_TENANCY_ID=tenancy_id)
+    return neo4j_session.execute_read(
+        read_list_of_dicts_tx,
+        query,
+        OCI_TENANCY_ID=tenancy_id,
+    )
 
 
 # Grab list of all groups in neo4j already populated by iam.
@@ -48,7 +54,11 @@ def get_groups_in_tenancy(
         "MATCH (OCITenancy{ocid: $OCI_TENANCY_ID})-[*]->(group:OCIGroup)"
         "return DISTINCT group.name as name, group.ocid as ocid;"
     )
-    return neo4j_session.run(query, OCI_TENANCY_ID=tenancy_id)
+    return neo4j_session.execute_read(
+        read_list_of_dicts_tx,
+        query,
+        OCI_TENANCY_ID=tenancy_id,
+    )
 
 
 # Grab list of all policies in neo4j already populated by iam.
@@ -61,7 +71,11 @@ def get_policies_in_tenancy(
         "return DISTINCT policy.name as name, policy.ocid as ocid, policy.statements as statements, "
         "policy.compartmentid as compartmentid;"
     )
-    return neo4j_session.run(query, OCI_TENANCY_ID=tenancy_id)
+    return neo4j_session.execute_read(
+        read_list_of_dicts_tx,
+        query,
+        OCI_TENANCY_ID=tenancy_id,
+    )
 
 
 # Grab list of all regions in neo4j already populated by iam.
@@ -73,7 +87,11 @@ def get_regions_in_tenancy(
         "MATCH (OCITenancy{ocid: $OCI_TENANCY_ID})-->(region:OCIRegion)"
         "return DISTINCT region.name as name, region.key as key;"
     )
-    return neo4j_session.run(query, OCI_TENANCY_ID=tenancy_id)
+    return neo4j_session.execute_read(
+        read_list_of_dicts_tx,
+        query,
+        OCI_TENANCY_ID=tenancy_id,
+    )
 
 
 # Grab list of all security groups in neo4j already populated by network. Need to handle regions for this one.
@@ -88,4 +106,9 @@ def get_security_groups_in_tenancy(
         "return DISTINCT security_group.name as name, security_group.ocid as ocid, security_group.compartmentid "
         "as compartmentid;"
     )
-    return neo4j_session.run(query, OCI_TENANCY_ID=tenancy_id, OCI_REGION=region)
+    return neo4j_session.execute_read(
+        read_list_of_dicts_tx,
+        query,
+        OCI_TENANCY_ID=tenancy_id,
+        OCI_REGION=region,
+    )

cartography/intel/okta/awssaml.py

@@ -68,24 +68,25 @@ def query_for_okta_to_aws_role_mapping(
     :param neo4j_session: session from the Neo4j server
     :param mapping_regex: the regex used by the organization to map groups to aws roles
     """
-    query = "MATCH (app:OktaApplication{name:'amazon_aws'})--(group:OktaGroup) return group.id, group.name"
+    query = (
+        "MATCH (app:OktaApplication{name:'amazon_aws'})--(group:OktaGroup) "
+        "RETURN group.id AS group_id, group.name AS group_name"
+    )
 
     group_to_role_mapping: List[Dict] = []
-    has_results = False
-    results = neo4j_session.run(query)
+    results = neo4j_session.execute_read(read_list_of_dicts_tx, query)
 
     for res in results:
-        has_results = True
         # input: okta group id, okta group name. output: aws role arn.
         mapping = transform_okta_group_to_aws_role(
-            res["group.id"],
-            res["group.name"],
+            res["group_id"],
+            res["group_name"],
             mapping_regex,
         )
         if mapping:
             group_to_role_mapping.append(mapping)
 
-    if has_results and not group_to_role_mapping:
+    if results and not group_to_role_mapping:
         logger.warning(
             "AWS Okta Application present, but no mappings were found. "
             "Please verify the mapping regex is correct",

cartography/intel/pagerduty/escalation_policies.py

@@ -6,6 +6,7 @@ from typing import List
 import neo4j
 from pdpyras import APISession
 
+from cartography.client.core.tx import run_write_query
 from cartography.util import timeit
 
 logger = logging.getLogger(__name__)
@@ -72,7 +73,8 @@ def load_escalation_policy_data(
             for team in policy["teams"]:
                 teams.append({"escalation_policy": policy["id"], "team": team["id"]})
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         EscalationPolicies=data,
         update_tag=update_tag,
@@ -115,7 +117,8 @@ def _attach_rules(
                 elif target["type"] == "schedule":
                     schedules.append({"rule": rule["id"], "schedule": target["id"]})
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         Rules=data,
         update_tag=update_tag,
@@ -140,7 +143,8 @@ def _attach_user_targets(
         MERGE (p)-[r:ASSOCIATED_WITH]->(u)
         ON CREATE SET r.firstseen = timestamp()
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         Relations=data,
         update_tag=update_tag,
@@ -162,7 +166,8 @@ def _attach_schedule_targets(
         MERGE (p)-[r:ASSOCIATED_WITH]->(s)
         ON CREATE SET r.firstseen = timestamp()
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         Relations=data,
         update_tag=update_tag,
@@ -184,7 +189,8 @@ def _attach_services(
         MERGE (s)-[r:ASSOCIATED_WITH]->(p)
         ON CREATE SET r.firstseen = timestamp()
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         Relations=data,
         update_tag=update_tag,
@@ -206,7 +212,8 @@ def _attach_teams(
         MERGE (t)-[r:ASSOCIATED_WITH]->(p)
         ON CREATE SET r.firstseen = timestamp()
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         Relations=data,
         update_tag=update_tag,

cartography/intel/pagerduty/schedules.py

@@ -7,6 +7,7 @@ import dateutil.parser
 import neo4j
 from pdpyras import APISession
 
+from cartography.client.core.tx import run_write_query
 from cartography.util import timeit
 
 logger = logging.getLogger(__name__)
@@ -63,7 +64,8 @@ def load_schedule_data(
                 layer["_schedule_id"] = schedule["id"]
                 layers.append(layer)
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         Schedules=data,
         update_tag=update_tag,
@@ -87,7 +89,8 @@ def _attach_users(
         MERGE (u)-[r:MEMBER_OF]->(s)
         ON CREATE SET r.firstseen = timestamp()
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         Relations=data,
         update_tag=update_tag,
@@ -129,7 +132,8 @@ def _attach_layers(
                 users.append(
                     {"layer_id": layer["_layer_id"], "user": user["user"]["id"]},
                 )
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         Layers=data,
         update_tag=update_tag,
@@ -152,7 +156,8 @@ def _attach_layer_users(
         MERGE (u)-[r:MEMBER_OF]->(l)
         ON CREATE SET r.firstseen = timestamp()
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_cypher_query,
         Relations=data,
         update_tag=update_tag,