cartography 0.91.0__tar.gz → 0.92.0__tar.gz

{cartography-0.91.0/cartography.egg-info → cartography-0.92.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cartography
-Version: 0.91.0
+Version: 0.92.0
 Summary: Explore assets and their relationships across your technical infrastructure.
 Home-page: https://www.github.com/lyft/cartography
 Maintainer: Lyft

{cartography-0.91.0 → cartography-0.92.0}/cartography/data/indexes.cypher

@@ -200,12 +200,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:KMSGrant) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:LaunchConfiguration) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:LaunchConfiguration) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:LaunchConfiguration) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:LaunchTemplate) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:LaunchTemplate) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:LaunchTemplate) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:LaunchTemplateVersion) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:LaunchTemplateVersion) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:LaunchTemplateVersion) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:LoadBalancer) ON (n.dnsname);
 CREATE INDEX IF NOT EXISTS FOR (n:LoadBalancer) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:LoadBalancer) ON (n.lastupdated);

{cartography-0.91.0 → cartography-0.92.0}/cartography/intel/aws/ec2/images.py

@@ -51,6 +51,7 @@ def get_images(boto3_session: boto3.session.Session, region: str, image_ids: Lis
         logger.warning(f"Failed retrieve images for region - {region}. Error - {e}")
     try:
         if image_ids:
+            image_ids = [image_id for image_id in image_ids if image_id is not None]
             images_in_use = client.describe_images(ImageIds=image_ids)['Images']
             # Ensure we're not adding duplicates
             _ids = [image["ImageId"] for image in images]

cartography-0.92.0/cartography/intel/aws/ec2/launch_templates.py

@@ -0,0 +1,147 @@
+import logging
+from typing import Any
+
+import boto3
+import neo4j
+
+from .util import get_botocore_config
+from cartography.client.core.tx import load
+from cartography.graph.job import GraphJob
+from cartography.models.aws.ec2.launch_template_versions import LaunchTemplateVersionSchema
+from cartography.models.aws.ec2.launch_templates import LaunchTemplateSchema
+from cartography.util import aws_handle_regions
+from cartography.util import timeit
+
+logger = logging.getLogger(__name__)
+
+
+@timeit
+@aws_handle_regions
+def get_launch_templates(boto3_session: boto3.session.Session, region: str) -> list[dict[str, Any]]:
+    client = boto3_session.client('ec2', region_name=region, config=get_botocore_config())
+    paginator = client.get_paginator('describe_launch_templates')
+    templates: list[dict[str, Any]] = []
+    for page in paginator.paginate():
+        templates.extend(page['LaunchTemplates'])
+    return templates
+
+
+def transform_launch_templates(templates: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    result: list[dict[str, Any]] = []
+    for template in templates:
+        current = template.copy()
+        current['CreateTime'] = str(int(current['CreateTime'].timestamp()))
+        result.append(current)
+    return result
+
+
+@timeit
+def load_launch_templates(
+        neo4j_session: neo4j.Session,
+        data: list[dict[str, Any]],
+        region: str,
+        current_aws_account_id: str,
+        update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        LaunchTemplateSchema(),
+        data,
+        Region=region,
+        AWS_ID=current_aws_account_id,
+        lastupdated=update_tag,
+    )
+
+
+@timeit
+@aws_handle_regions
+def get_launch_template_versions(
+        boto3_session: boto3.session.Session,
+        templates: list[dict[str, Any]],
+        region: str,
+) -> list[dict[str, Any]]:
+    client = boto3_session.client('ec2', region_name=region, config=get_botocore_config())
+    v_paginator = client.get_paginator('describe_launch_template_versions')
+    template_versions = []
+    for template in templates:
+        for versions in v_paginator.paginate(LaunchTemplateId=template['LaunchTemplateId']):
+            template_versions.extend(versions['LaunchTemplateVersions'])
+    return template_versions
+
+
+def transform_launch_template_versions(versions: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    result: list[dict[str, Any]] = []
+    for version in versions:
+        current = version.copy()
+
+        # Reformat some fields
+        current['Id'] = f"{version['LaunchTemplateId']}-{version['VersionNumber']}"
+        current['CreateTime'] = str(int(version['CreateTime'].timestamp()))
+
+        # Handle the nested object returned from boto
+        ltd = version['LaunchTemplateData']
+        current['KernelId'] = ltd.get('KernelId')
+        current['EbsOptimized'] = ltd.get('EbsOptimized')
+        current['IamInstanceProfileArn'] = ltd.get('IamInstanceProfileArn')
+        current['IamInstanceProfileName'] = ltd.get('IamInstanceProfileName')
+        current['ImageId'] = ltd.get('ImageId')
+        current['InstanceType'] = ltd.get('InstanceType')
+        current['KeyName'] = ltd.get('KeyName')
+        current['MonitoringEnabled'] = ltd.get('MonitoringEnabled')
+        current['RamdiskId'] = ltd.get('RamdiskId')
+        current['DisableApiTermination'] = ltd.get('DisableApiTermination')
+        current['InstanceInitiatedShutDownBehavior'] = ltd.get('InstanceInitiatedShutDownBehavior')
+        current['SecurityGroupIds'] = ltd.get('SecurityGroupIds')
+        current['SecurityGroups'] = ltd.get('SecurityGroups')
+        result.append(current)
+    return result
+
+
+@timeit
+def load_launch_template_versions(
+        neo4j_session: neo4j.Session,
+        data: list[dict[str, Any]],
+        region: str,
+        current_aws_account_id: str,
+        update_tag: int,
+) -> None:
+    load(
+        neo4j_session,
+        LaunchTemplateVersionSchema(),
+        data,
+        Region=region,
+        AWS_ID=current_aws_account_id,
+        lastupdated=update_tag,
+    )
+
+
+@timeit
+def cleanup(neo4j_session: neo4j.Session, common_job_parameters: dict[str, Any]) -> None:
+    logger.info("Running launch template cleanup job.")
+    cleanup_job = GraphJob.from_node_schema(LaunchTemplateSchema(), common_job_parameters)
+    cleanup_job.run(neo4j_session)
+
+    cleanup_job = GraphJob.from_node_schema(LaunchTemplateVersionSchema(), common_job_parameters)
+    cleanup_job.run(neo4j_session)
+
+
+@timeit
+def sync_ec2_launch_templates(
+        neo4j_session: neo4j.Session,
+        boto3_session: boto3.session.Session,
+        regions: list[str],
+        current_aws_account_id: str,
+        update_tag: int,
+        common_job_parameters: dict[str, Any],
+) -> None:
+    for region in regions:
+        logger.info(f"Syncing launch templates for region '{region}' in account '{current_aws_account_id}'.")
+        templates = get_launch_templates(boto3_session, region)
+        templates = transform_launch_templates(templates)
+        load_launch_templates(neo4j_session, templates, region, current_aws_account_id, update_tag)
+
+        versions = get_launch_template_versions(boto3_session, templates, region)
+        versions = transform_launch_template_versions(versions)
+        load_launch_template_versions(neo4j_session, versions, region, current_aws_account_id, update_tag)
+
+    cleanup(neo4j_session, common_job_parameters)

{cartography-0.91.0 → cartography-0.92.0}/cartography/intel/aws/iam.py

@@ -227,6 +227,7 @@ def get_account_access_key_data(boto3_session: boto3.session.Session, username:
         logger.warning(
             f"Could not get access key for user {username} due to NoSuchEntityException; skipping.",
         )
+        return access_keys
     for access_key in access_keys['AccessKeyMetadata']:
         access_key_id = access_key['AccessKeyId']
         last_used_info = client.get_access_key_last_used(

{cartography-0.91.0 → cartography-0.92.0}/cartography/intel/okta/__init__.py

@@ -68,7 +68,7 @@ def start_okta_ingestion(neo4j_session: neo4j.Session, config: Config) -> None:
     applications.sync_okta_applications(neo4j_session, config.okta_org_id, config.update_tag, config.okta_api_key)
     factors.sync_users_factors(neo4j_session, config.okta_org_id, config.update_tag, config.okta_api_key, state)
     origins.sync_trusted_origins(neo4j_session, config.okta_org_id, config.update_tag, config.okta_api_key)
-    awssaml.sync_okta_aws_saml(neo4j_session, config.okta_saml_role_regex, config.update_tag)
+    awssaml.sync_okta_aws_saml(neo4j_session, config.okta_saml_role_regex, config.update_tag, config.okta_org_id)
 
     # need creds with permission
     # soft fail as some won't be able to get such high priv token

cartography-0.92.0/cartography/intel/okta/awssaml.py

@@ -0,0 +1,237 @@
+# Okta intel module - AWS SAML
+import logging
+import re
+from collections import namedtuple
+from typing import Dict
+from typing import List
+from typing import Optional
+
+import neo4j
+
+from cartography.client.core.tx import read_list_of_dicts_tx
+from cartography.client.core.tx import read_single_value_tx
+from cartography.util import timeit
+
+
+AccountRole = namedtuple('AccountRole', ['account_id', 'role_name'])
+OktaGroup = namedtuple('OktaGroup', ['group_id', 'group_name'])
+GroupRole = namedtuple('GroupRole', ['okta_group_id', 'aws_role_arn'])
+
+logger = logging.getLogger(__name__)
+
+
+def _parse_regex(regex_string: str) -> str:
+    return regex_string.replace("{{accountid}}", "P<accountid>").replace("{{role}}", "P<role>").strip()
+
+
+def _parse_okta_group_name(okta_group_name: str, mapping_regex: str) -> AccountRole | None:
+    """
+    Extract AWS account id and AWS role name from the given Okta group name using the given mapping regex.
+    """
+    regex = _parse_regex(mapping_regex)
+    matches = re.search(regex, okta_group_name)
+    if matches:
+        account_id = matches.group("accountid")
+        role_name = matches.group("role")
+        return AccountRole(account_id, role_name)
+    return None
+
+
+def transform_okta_group_to_aws_role(group_id: str, group_name: str, mapping_regex: str) -> Optional[Dict]:
+    account_role = _parse_okta_group_name(group_name, mapping_regex)
+    if account_role:
+        role_arn = f"arn:aws:iam::{account_role.account_id}:role/{account_role.role_name}"
+        return {"groupid": group_id, "role": role_arn}
+    return None
+
+
+@timeit
+def query_for_okta_to_aws_role_mapping(neo4j_session: neo4j.Session, mapping_regex: str) -> List[Dict]:
+    """
+    Query the graph for all groups associated with the amazon_aws application and map them to AWSRoles
+    :param neo4j_session: session from the Neo4j server
+    :param mapping_regex: the regex used by the organization to map groups to aws roles
+    """
+    query = "MATCH (app:OktaApplication{name:'amazon_aws'})--(group:OktaGroup) return group.id, group.name"
+
+    group_to_role_mapping: List[Dict] = []
+    has_results = False
+    results = neo4j_session.run(query)
+
+    for res in results:
+        has_results = True
+        # input: okta group id, okta group name. output: aws role arn.
+        mapping = transform_okta_group_to_aws_role(res["group.id"], res["group.name"], mapping_regex)
+        if mapping:
+            group_to_role_mapping.append(mapping)
+
+    if has_results and not group_to_role_mapping:
+        logger.warn(
+            "AWS Okta Application present, but no mappings were found. "
+            "Please verify the mapping regex is correct",
+        )
+
+    return group_to_role_mapping
+
+
+@timeit
+def _load_okta_group_to_aws_roles(
+    neo4j_session: neo4j.Session, group_to_role: List[Dict],
+    okta_update_tag: int,
+) -> None:
+    """
+    Add the ALLOWED_BY relationship between OktaGroups and the AWSRoles they enable
+    :param neo4j_session: session with the Neo4j server
+    :param group_to_role: the mapping between OktaGroups and the AWSRoles they allow access to
+    :param okta_update_tag: The timestamp value to set our new Neo4j resources with
+    :return: Nothing
+    """
+    ingest_statement = """
+
+    UNWIND $GROUP_TO_ROLE as app_data
+    MATCH (role:AWSRole{arn: app_data.role})
+    MATCH (group:OktaGroup{id: app_data.groupid})
+    MERGE (role)<-[r:ALLOWED_BY]-(group)
+    ON CREATE SET r.firstseen = timestamp()
+    SET r.lastupdated = $okta_update_tag
+    """
+
+    neo4j_session.run(
+        ingest_statement,
+        GROUP_TO_ROLE=group_to_role,
+        okta_update_tag=okta_update_tag,
+    )
+
+
+@timeit
+def _load_human_can_assume_role(neo4j_session: neo4j.Session, okta_update_tag: int) -> None:
+    """
+    Add the CAN_ASSUME_ROLE relationship between Humans and the AWSRoles they can assume
+    :param neo4j_session: session with the Neo4j server
+    :param okta_update_tag: The timestamp value to set our new Neo4j resources with
+    :return: Nothing
+    """
+    ingest_statement = """
+    MATCH (role:AWSRole)<-[:ALLOWED_BY]-(:OktaGroup)<-[:MEMBER_OF_OKTA_GROUP]-(:OktaUser)-[:IDENTITY_OKTA]-(human:Human)
+    MERGE (human)-[r:CAN_ASSUME_ROLE]->(role)
+    SET r.lastupdated = $okta_update_tag
+    """
+
+    neo4j_session.run(
+        ingest_statement,
+        okta_update_tag=okta_update_tag,
+    )
+
+
+def get_awssso_okta_groups(neo4j_session: neo4j.Session, okta_org_id: str) -> list[OktaGroup]:
+    """
+    Return list of all Okta group ids in the current Okta organization tied to Okta Applications with name
+    "amazon_aws_sso".
+    """
+    query = """
+    MATCH (g:OktaGroup)-[:APPLICATION]->(a:OktaApplication{name:"amazon_aws_sso"})
+           <-[:RESOURCE]-(:OktaOrganization{id: $okta_org_id})
+    RETURN g.id as group_id, g.name as group_name
+    """
+    result = neo4j_session.read_transaction(read_list_of_dicts_tx, query, okta_org_id=okta_org_id)
+    return [OktaGroup(group_name=og['group_name'], group_id=og['group_id']) for og in result]
+
+
+def get_awssso_role_arn(account_id: str, role_hint: str, neo4j_session: neo4j.Session) -> str | None:
+    """
+    Attempt to return the AWS role ARN for the given AWS account ID and role hint string.
+    This function exists to handle that AWS SSO roles have a 'AWSReservedSSO' prefix and a hashed suffix
+    Input:
+    - account_id: AWS account ID
+    - role_hint (str): The `AccountRole.role_name` returned by _parse_okta_group_name(). This is the part of the Okta
+    group name that refers to the AWS role name.
+    Output:
+    - If we are able to find it, returns the matching AWS role ARN.
+    """
+    query = """
+    MATCH (:AWSAccount{id:$account_id})-[:RESOURCE]->(role:AWSRole{path:"/aws-reserved/sso.amazonaws.com/"})
+    WHERE SPLIT(role.name, '_')[1..-1][0] = $role_hint
+    RETURN role.arn AS role_arn
+    """
+    return neo4j_session.read_transaction(read_single_value_tx, query, account_id=account_id, role_hint=role_hint)
+
+
+def query_for_okta_to_awssso_role_mapping(
+        neo4j_session: neo4j.Session,
+        awssso_okta_groups: list[OktaGroup],
+        mapping_regex: str,
+) -> list[GroupRole]:
+    """
+    Input:
+    - neo4j session
+    - str list of Okta group names
+    - str regex that tells us how to find the AWS role name and account when given an Okta group name
+    Output:
+    - list of OktaGroup id to AWSRole arn pairs.
+    """
+    result = []
+    for group in awssso_okta_groups:
+        account_role = _parse_okta_group_name(group.group_name, mapping_regex)
+        if not account_role:
+            logger.info(f"Okta group {group.group_name} has no associated AWS SSO role")
+            continue
+
+        role_arn = get_awssso_role_arn(account_role.account_id, account_role.role_name, neo4j_session)
+        if role_arn:
+            result.append(GroupRole(group.group_id, role_arn))
+    return result
+
+
+def _load_awssso_tx(tx: neo4j.Transaction, group_to_role: list[GroupRole], okta_update_tag: int) -> None:
+    ingest_statement = """
+    UNWIND $GROUP_TO_ROLE as app_data
+        MATCH (role:AWSRole{arn: app_data.aws_role_arn})
+        MATCH (group:OktaGroup{id: app_data.okta_group_id})
+        MERGE (role)<-[r:ALLOWED_BY]-(group)
+        ON CREATE SET r.firstseen = timestamp()
+        SET r.lastupdated = $okta_update_tag
+    """
+    tx.run(
+        ingest_statement,
+        GROUP_TO_ROLE=[g._asdict() for g in group_to_role],
+        okta_update_tag=okta_update_tag,
+    )
+
+
+def _load_okta_group_to_awssso_roles(
+        neo4j_session: neo4j.Session,
+        group_to_role: list[GroupRole],
+        okta_update_tag: int,
+) -> None:
+    neo4j_session.write_transaction(_load_awssso_tx, group_to_role, okta_update_tag)
+
+
+@timeit
+def sync_okta_aws_saml(
+        neo4j_session: neo4j.Session,
+        mapping_regex: str,
+        okta_update_tag: int,
+        okta_org_id: str,
+) -> None:
+    """
+    Sync okta integration with saml. This will link OktaGroups to the AWSRoles they enable.
+    This is for people who use the okta saml provider for AWS
+    https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Amazon-Web-Service#scenarioC
+    If an organization does not use okta as a SAML provider for AWS the query will not return any results
+    and nothing will be added to the graph
+    :param mapping_regex: session from the Neo4j server
+    :param okta_org_id: okta organization id
+    :param okta_update_tag: The timestamp value to set our new Neo4j resources with
+    :param okta_api_key: Okta api key
+    :return: Nothing
+    """
+    logger.info("Syncing Okta SAML Integration")
+
+    # Query for the aws application and its associated groups
+    group_to_role_mapping = query_for_okta_to_aws_role_mapping(neo4j_session, mapping_regex)
+    _load_okta_group_to_aws_roles(neo4j_session, group_to_role_mapping, okta_update_tag)
+    _load_human_can_assume_role(neo4j_session, okta_update_tag)
+
+    sso_okta_groups = get_awssso_okta_groups(neo4j_session, okta_org_id)
+    group_to_ssorole_mapping = query_for_okta_to_awssso_role_mapping(neo4j_session, sso_okta_groups, mapping_regex)
+    _load_okta_group_to_awssso_roles(neo4j_session, group_to_ssorole_mapping, okta_update_tag)

cartography-0.92.0/cartography/models/aws/ec2/launch_template_versions.py

@@ -0,0 +1,81 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class LaunchTemplateVersionNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef('Id')
+    name: PropertyRef = PropertyRef('LaunchTemplateName')
+    create_time: PropertyRef = PropertyRef('CreateTime')
+    created_by: PropertyRef = PropertyRef('CreatedBy')
+    default_version: PropertyRef = PropertyRef('DefaultVersion')
+    version_number: PropertyRef = PropertyRef('VersionNumber')
+    version_description: PropertyRef = PropertyRef('VersionDescription')
+    kernel_id: PropertyRef = PropertyRef('KernelId')
+    ebs_optimized: PropertyRef = PropertyRef('EbsOptimized')
+    iam_instance_profile_arn: PropertyRef = PropertyRef('IamInstanceProfileArn')
+    iam_instance_profile_name: PropertyRef = PropertyRef('IamInstanceProfileName')
+    image_id: PropertyRef = PropertyRef('ImageId')
+    instance_type: PropertyRef = PropertyRef('InstanceType')
+    key_name: PropertyRef = PropertyRef('KeyName')
+    monitoring_enabled: PropertyRef = PropertyRef('MonitoringEnabled')
+    ramdisk_id: PropertyRef = PropertyRef('RamdiskId')
+    disable_api_termination: PropertyRef = PropertyRef('DisableApiTermination')
+    instance_initiated_shutdown_behavior: PropertyRef = PropertyRef('InstanceInitiatedShutdownBehavior')
+    security_group_ids: PropertyRef = PropertyRef('SecurityGroupIds')
+    security_groups: PropertyRef = PropertyRef('SecurityGroups')
+    region: PropertyRef = PropertyRef('Region', set_in_kwargs=True)
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class LaunchTemplateVersionToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class LaunchTemplateVersionToAWSAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: LaunchTemplateVersionToAwsAccountRelProperties = LaunchTemplateVersionToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class LaunchTemplateVersionToLTRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class LaunchTemplateVersionToLT(CartographyRelSchema):
+    target_node_label: str = 'LaunchTemplate'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('LaunchTemplateId')},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "VERSION"
+    properties: LaunchTemplateVersionToLTRelProperties = LaunchTemplateVersionToLTRelProperties()
+
+
+@dataclass(frozen=True)
+class LaunchTemplateVersionSchema(CartographyNodeSchema):
+    label: str = 'LaunchTemplateVersion'
+    properties: LaunchTemplateVersionNodeProperties = LaunchTemplateVersionNodeProperties()
+    sub_resource_relationship: LaunchTemplateVersionToAWSAccount = LaunchTemplateVersionToAWSAccount()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            LaunchTemplateVersionToLT(),
+        ],
+    )

cartography-0.92.0/cartography/models/aws/ec2/launch_templates.py

@@ -0,0 +1,46 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class LaunchTemplateNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef('LaunchTemplateId')
+    launch_template_id: PropertyRef = PropertyRef('LaunchTemplateId')
+    name: PropertyRef = PropertyRef('LaunchTemplateName')
+    create_time: PropertyRef = PropertyRef('CreateTime')
+    created_by: PropertyRef = PropertyRef('CreatedBy')
+    default_version_number: PropertyRef = PropertyRef('DefaultVersionNumber')
+    latest_version_number: PropertyRef = PropertyRef('LatestVersionNumber')
+    region: PropertyRef = PropertyRef('Region', set_in_kwargs=True)
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class LaunchTemplateToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class LaunchTemplateToAWSAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: LaunchTemplateToAwsAccountRelProperties = LaunchTemplateToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class LaunchTemplateSchema(CartographyNodeSchema):
+    label: str = 'LaunchTemplate'
+    properties: LaunchTemplateNodeProperties = LaunchTemplateNodeProperties()
+    sub_resource_relationship: LaunchTemplateToAWSAccount = LaunchTemplateToAWSAccount()

{cartography-0.91.0 → cartography-0.92.0}/cartography/models/aws/ec2/subnet_instance.py

@@ -15,7 +15,7 @@ from cartography.models.core.relationships import TargetNodeMatcher
 class EC2SubnetInstanceNodeProperties(CartographyNodeProperties):
     # arn: PropertyRef = PropertyRef('Arn', extra_index=True) TODO use arn; issue #1024
     id: PropertyRef = PropertyRef('SubnetId')
-    subnet_id: PropertyRef = PropertyRef('SubnetId', extra_index=True)
+    subnetid: PropertyRef = PropertyRef('SubnetId', extra_index=True)
     region: PropertyRef = PropertyRef('Region', set_in_kwargs=True)
     lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
 

{cartography-0.91.0 → cartography-0.92.0/cartography.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cartography
-Version: 0.91.0
+Version: 0.92.0
 Summary: Explore assets and their relationships across your technical infrastructure.
 Home-page: https://www.github.com/lyft/cartography
 Maintainer: Lyft

{cartography-0.91.0 → cartography-0.92.0}/cartography.egg-info/SOURCES.txt

@@ -47,7 +47,6 @@ cartography/data/jobs/cleanup/aws_import_account_access_key_cleanup.json
 cartography/data/jobs/cleanup/aws_import_apigateway_cleanup.json
 cartography/data/jobs/cleanup/aws_import_config_cleanup.json
 cartography/data/jobs/cleanup/aws_import_ec2_launch_configurations_cleanup.json
-cartography/data/jobs/cleanup/aws_import_ec2_launch_templates_cleanup.json
 cartography/data/jobs/cleanup/aws_import_ec2_security_groupinfo_cleanup.json
 cartography/data/jobs/cleanup/aws_import_ecr_cleanup.json
 cartography/data/jobs/cleanup/aws_import_ecs_cleanup.json
@@ -294,6 +293,8 @@ cartography/models/aws/ec2/__init__.py
 cartography/models/aws/ec2/images.py
 cartography/models/aws/ec2/instances.py
 cartography/models/aws/ec2/keypairs.py
+cartography/models/aws/ec2/launch_template_versions.py
+cartography/models/aws/ec2/launch_templates.py
 cartography/models/aws/ec2/loadbalancerv2.py
 cartography/models/aws/ec2/networkinterface_instance.py
 cartography/models/aws/ec2/networkinterfaces.py

{cartography-0.91.0 → cartography-0.92.0}/setup.cfg

@@ -68,6 +68,11 @@ ignore_errors = true
 [coverage:report]
 fail_under = 30
 
+[tool:pytest]
+addopts = --cov-config=setup.cfg --no-cov-on-fail --cov-report=term-missing:skip-covered --strict-markers
+markers = 
+	flaky: mark test as flaky
+
 [egg_info]
 tag_build = 
 tag_date = 0

{cartography-0.91.0 → cartography-0.92.0}/setup.py

@@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup
 
-__version__ = '0.91.0'
+__version__ = '0.92.0'
 
 
 setup(

cartography-0.91.0/cartography/data/jobs/cleanup/aws_import_ec2_launch_templates_cleanup.json

@@ -1,13 +0,0 @@
-{
-  "statements": [{
-    "query": "MATCH (n:LaunchTemplateVersion)<-[:VERSION]-(:LaunchTemplate)<-[:RESOURCE]-(:AWSAccount{id: $AWS_ID}) WHERE n.lastupdated <> $UPDATE_TAG WITH n LIMIT $LIMIT_SIZE DETACH DELETE (n)",
-    "iterative": true,
-    "iterationsize": 100
-  },
-  {
-    "query": "MATCH (n:LaunchTemplate)<-[:RESOURCE]-(:AWSAccount{id: $AWS_ID}) WHERE n.lastupdated <> $UPDATE_TAG WITH n LIMIT $LIMIT_SIZE DETACH DELETE (n)",
-    "iterative": true,
-    "iterationsize": 100
-  }],
-  "name": "cleanup LaunchTemplate"
-}