cartography 0.93.0rc1__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/models/aws/apigateway/apigatewaymethod.py

@@ -0,0 +1,74 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class APIGatewayMethodNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    httpmethod: PropertyRef = PropertyRef("httpMethod")
+    resource_id: PropertyRef = PropertyRef("resourceId")
+    api_id: PropertyRef = PropertyRef("apiId")
+    authorization_type: PropertyRef = PropertyRef("authorizationType")
+    authorizer_id: PropertyRef = PropertyRef("authorizerId")
+    request_validator_id: PropertyRef = PropertyRef("requestValidatorId")
+    operation_name: PropertyRef = PropertyRef("operationName")
+    api_key_required: PropertyRef = PropertyRef("apiKeyRequired")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class APIGatewayMethodToAPIGatewayResourceRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class APIGatewayMethodToAPIGatewayResourceRel(CartographyRelSchema):
+    target_node_label: str = "APIGatewayResource"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("resourceId")},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "HAS_METHOD"
+    properties: APIGatewayMethodToAPIGatewayResourceRelRelProperties = (
+        APIGatewayMethodToAPIGatewayResourceRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class APIGatewayMethodToAWSAccountRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+# (:APIGatewayMethod)<-[:RESOURCE]-(:AWSAccount)
+class APIGatewayMethodToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: APIGatewayMethodToAWSAccountRelRelProperties = (
+        APIGatewayMethodToAWSAccountRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class APIGatewayMethodSchema(CartographyNodeSchema):
+    label: str = "APIGatewayMethod"
+    properties: APIGatewayMethodNodeProperties = APIGatewayMethodNodeProperties()
+    sub_resource_relationship: APIGatewayMethodToAWSAccountRel = (
+        APIGatewayMethodToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [APIGatewayMethodToAPIGatewayResourceRel()],
+    )

cartography/models/aws/apigateway/apigatewayresource.py

@@ -0,0 +1,70 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class APIGatewayResourceNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    path: PropertyRef = PropertyRef("path")
+    pathpart: PropertyRef = PropertyRef("pathPart")
+    parentid: PropertyRef = PropertyRef("parentId")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class APIGatewayResourceToRestAPIRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+# (:APIGatewayResource)<-[:RESOURCE]-(:APIGatewayRestAPI)
+class APIGatewayResourceToRestAPIRel(CartographyRelSchema):
+    target_node_label: str = "APIGatewayRestAPI"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("apiId")},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: APIGatewayResourceToRestAPIRelRelProperties = (
+        APIGatewayResourceToRestAPIRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class APIGatewayResourceToAWSAccountRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+# (:APIGatewayResource)<-[:RESOURCE]-(:AWSAccount)
+class APIGatewayResourceToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: APIGatewayResourceToAWSAccountRelRelProperties = (
+        APIGatewayResourceToAWSAccountRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class APIGatewayResourceSchema(CartographyNodeSchema):
+    label: str = "APIGatewayResource"
+    properties: APIGatewayResourceNodeProperties = APIGatewayResourceNodeProperties()
+    sub_resource_relationship: APIGatewayResourceToAWSAccountRel = (
+        APIGatewayResourceToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [APIGatewayResourceToRestAPIRel()],
+    )

cartography/models/aws/apigateway/apigatewaystage.py

@@ -0,0 +1,75 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class APIGatewayStageNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("arn")
+    stagename: PropertyRef = PropertyRef("stageName")
+    createddate: PropertyRef = PropertyRef("createdDate")
+    deploymentid: PropertyRef = PropertyRef("deploymentId")
+    clientcertificateid: PropertyRef = PropertyRef("clientCertificateId")
+    cacheclusterenabled: PropertyRef = PropertyRef("cacheClusterEnabled")
+    cacheclusterstatus: PropertyRef = PropertyRef("cacheClusterStatus")
+    tracingenabled: PropertyRef = PropertyRef("tracingEnabled")
+    webaclarn: PropertyRef = PropertyRef("webAclArn")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class APIGatewayStageToRestAPIRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+# (:APIGatewayStage)<-[:ASSOCIATED_WITH]-(:APIGatewayRestAPI)
+class APIGatewayStageToRestAPIRel(CartographyRelSchema):
+    target_node_label: str = "APIGatewayRestAPI"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("apiId")},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "ASSOCIATED_WITH"
+    properties: APIGatewayStageToRestAPIRelRelProperties = (
+        APIGatewayStageToRestAPIRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class APIGatewayStageToAWSAccountRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+# (:APIGatewayStage)<-[:RESOURCE]-(:AWSAccount)
+class APIGatewayStageToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: APIGatewayStageToAWSAccountRelRelProperties = (
+        APIGatewayStageToAWSAccountRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class APIGatewayStageSchema(CartographyNodeSchema):
+    label: str = "APIGatewayStage"
+    properties: APIGatewayStageNodeProperties = APIGatewayStageNodeProperties()
+    sub_resource_relationship: APIGatewayStageToAWSAccountRel = (
+        APIGatewayStageToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [APIGatewayStageToRestAPIRel()],
+    )

cartography/models/aws/apigatewayv2/apigatewayv2.py

@@ -0,0 +1,53 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class APIGatewayV2APINodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id", extra_index=True)
+    name: PropertyRef = PropertyRef("name")
+    protocoltype: PropertyRef = PropertyRef("protocolType")
+    routeselectionexpression: PropertyRef = PropertyRef("routeSelectionExpression")
+    apikeyselectionexpression: PropertyRef = PropertyRef("apiKeySelectionExpression")
+    apiendpoint: PropertyRef = PropertyRef("apiEndpoint")
+    version: PropertyRef = PropertyRef("version")
+    createddate: PropertyRef = PropertyRef("createdDate")
+    description: PropertyRef = PropertyRef("description")
+    region: PropertyRef = PropertyRef("region", set_in_kwargs=True)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class APIGatewayV2APIToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+# (:APIGatewayV2API)<-[:RESOURCE]-(:AWSAccount)
+class APIGatewayV2APIToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: APIGatewayV2APIToAWSAccountRelProperties = (
+        APIGatewayV2APIToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class APIGatewayV2APISchema(CartographyNodeSchema):
+    label: str = "APIGatewayV2API"
+    properties: APIGatewayV2APINodeProperties = APIGatewayV2APINodeProperties()
+    sub_resource_relationship: APIGatewayV2APIToAWSAccountRel = (
+        APIGatewayV2APIToAWSAccountRel()
+    )

cartography/models/aws/cloudtrail/management_events.py

@@ -0,0 +1,153 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_source_node_matcher
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import SourceNodeMatcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AssumedRoleRelProperties(CartographyRelProperties):
+    """
+    Properties for the ASSUMED_ROLE relationship representing role assumption events.
+    Matches the cloudtrail_management_events spec and adds enhanced temporal precision.
+    """
+
+    # Mandatory fields for MatchLinks
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef(
+        "_sub_resource_label", set_in_kwargs=True
+    )
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+    # CloudTrail-specific relationship properties
+    last_used: PropertyRef = PropertyRef("last_used")
+    times_used: PropertyRef = PropertyRef("times_used")
+    first_seen_in_time_window: PropertyRef = PropertyRef("first_seen_in_time_window")
+
+
+@dataclass(frozen=True)
+class AssumedRoleMatchLink(CartographyRelSchema):
+    """
+    MatchLink schema for ASSUMED_ROLE relationships from CloudTrail events.
+    Creates relationships like: (AWSUser|AWSRole|AWSPrincipal)-[:ASSUMED_ROLE]->(AWSRole)
+
+    This MatchLink handles role assumption relationships discovered via CloudTrail management events.
+    It supports multiple source node types and aggregated relationship properties.
+    """
+
+    # MatchLink-specific fields
+    source_node_label: str = (
+        "AWSPrincipal"  # Base type that covers AWSUser, AWSRole, AWSPrincipal
+    )
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher(
+        {"arn": PropertyRef("source_principal_arn")},
+    )
+
+    # Standard CartographyRelSchema fields
+    target_node_label: str = "AWSRole"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"arn": PropertyRef("destination_principal_arn")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ASSUMED_ROLE"
+    properties: AssumedRoleRelProperties = AssumedRoleRelProperties()
+
+
+@dataclass(frozen=True)
+class AssumedRoleWithSAMLRelProperties(CartographyRelProperties):
+    """
+    Properties for the ASSUMED_ROLE_WITH_SAML relationship representing SAML-based role assumption events.
+    Focuses specifically on SAML federated identity role assumptions.
+    """
+
+    # Mandatory fields for MatchLinks
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef(
+        "_sub_resource_label", set_in_kwargs=True
+    )
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+    # CloudTrail-specific relationship properties
+    last_used: PropertyRef = PropertyRef("last_used")
+    times_used: PropertyRef = PropertyRef("times_used")
+    first_seen_in_time_window: PropertyRef = PropertyRef("first_seen_in_time_window")
+
+
+@dataclass(frozen=True)
+class AssumedRoleWithSAMLMatchLink(CartographyRelSchema):
+    """
+    MatchLink schema for ASSUMED_ROLE_WITH_SAML relationships from CloudTrail SAML events.
+    Creates relationships like: (AWSRole)-[:ASSUMED_ROLE_WITH_SAML]->(AWSRole)
+
+    This MatchLink handles SAML-based role assumption relationships discovered via CloudTrail
+    AssumeRoleWithSAML events. It creates separate relationships from regular AssumeRole events
+    to preserve visibility into authentication methods used.
+    """
+
+    # MatchLink-specific fields
+    source_node_label: str = "AWSSSOUser"  # Match against AWS SSO User nodes
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher(
+        {"user_name": PropertyRef("source_principal_arn")},
+    )
+
+    # Standard CartographyRelSchema fields
+    target_node_label: str = "AWSRole"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"arn": PropertyRef("destination_principal_arn")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ASSUMED_ROLE_WITH_SAML"
+    properties: AssumedRoleWithSAMLRelProperties = AssumedRoleWithSAMLRelProperties()
+
+
+@dataclass(frozen=True)
+class AssumeRoleWithWebIdentityRelProperties(CartographyRelProperties):
+    """
+    Properties for the ASSUMED_ROLE_WITH_WEB_IDENTITY relationship representing web identity-based role assumption events.
+    Focuses specifically on web identity federation role assumptions (Google, Amazon, Facebook, etc.).
+    """
+
+    # Mandatory fields for MatchLinks
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef(
+        "_sub_resource_label", set_in_kwargs=True
+    )
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+    # CloudTrail-specific relationship properties
+    last_used: PropertyRef = PropertyRef("last_used")
+    times_used: PropertyRef = PropertyRef("times_used")
+    first_seen_in_time_window: PropertyRef = PropertyRef("first_seen_in_time_window")
+
+
+@dataclass(frozen=True)
+class GitHubRepoAssumeRoleWithWebIdentityMatchLink(CartographyRelSchema):
+    """
+    MatchLink schema for ASSUMED_ROLE_WITH_WEB_IDENTITY relationships from GitHub Actions to AWS roles.
+    Creates relationships like: (GitHubRepository)-[:ASSUMED_ROLE_WITH_WEB_IDENTITY]->(AWSRole)
+
+    This MatchLink provides granular visibility into which specific GitHub repositories are assuming
+    AWS roles via GitHub Actions OIDC, rather than just showing provider-level relationships.
+    """
+
+    # MatchLink-specific fields for GitHub repositories
+    source_node_label: str = "GitHubRepository"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher(
+        {"fullname": PropertyRef("source_repo_fullname")},
+    )
+
+    # Standard CartographyRelSchema fields
+    target_node_label: str = "AWSRole"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"arn": PropertyRef("destination_principal_arn")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ASSUMED_ROLE_WITH_WEB_IDENTITY"
+    properties: AssumeRoleWithWebIdentityRelProperties = (
+        AssumeRoleWithWebIdentityRelProperties()
+    )

cartography/models/aws/cloudtrail/trail.py

@@ -0,0 +1,106 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("TrailARN")
+    arn: PropertyRef = PropertyRef("TrailARN")
+    name: PropertyRef = PropertyRef("Name")
+    region: PropertyRef = PropertyRef("Region", set_in_kwargs=True)
+    cloudwatch_logs_log_group_arn: PropertyRef = PropertyRef(
+        "CloudWatchLogsLogGroupArn"
+    )
+    cloudwatch_logs_role_arn: PropertyRef = PropertyRef("CloudWatchLogsRoleArn")
+    has_custom_event_selectors: PropertyRef = PropertyRef("HasCustomEventSelectors")
+    has_insight_selectors: PropertyRef = PropertyRef("HasInsightSelectors")
+    home_region: PropertyRef = PropertyRef("HomeRegion")
+    include_global_service_events: PropertyRef = PropertyRef(
+        "IncludeGlobalServiceEvents"
+    )
+    is_multi_region_trail: PropertyRef = PropertyRef("IsMultiRegionTrail")
+    is_organization_trail: PropertyRef = PropertyRef("IsOrganizationTrail")
+    kms_key_id: PropertyRef = PropertyRef("KmsKeyId")
+    log_file_validation_enabled: PropertyRef = PropertyRef("LogFileValidationEnabled")
+    s3_bucket_name: PropertyRef = PropertyRef("S3BucketName")
+    s3_key_prefix: PropertyRef = PropertyRef("S3KeyPrefix")
+    sns_topic_arn: PropertyRef = PropertyRef("SnsTopicARN")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudTrailToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: CloudTrailTrailToAwsAccountRelProperties = (
+        CloudTrailTrailToAwsAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailToS3BucketRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailToS3BucketRel(CartographyRelSchema):
+    target_node_label: str = "S3Bucket"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"name": PropertyRef("S3BucketName")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "LOGS_TO"
+    properties: CloudTrailTrailToS3BucketRelProperties = (
+        CloudTrailTrailToS3BucketRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailToCloudWatchLogGroupRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailToCloudWatchLogGroupRel(CartographyRelSchema):
+    target_node_label: str = "CloudWatchLogGroup"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("CloudWatchLogsLogGroupArn"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "SENDS_LOGS_TO_CLOUDWATCH"
+    properties: CloudTrailTrailToCloudWatchLogGroupRelProperties = (
+        CloudTrailTrailToCloudWatchLogGroupRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class CloudTrailTrailSchema(CartographyNodeSchema):
+    label: str = "CloudTrailTrail"
+    properties: CloudTrailTrailNodeProperties = CloudTrailTrailNodeProperties()
+    sub_resource_relationship: CloudTrailToAWSAccountRel = CloudTrailToAWSAccountRel()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            CloudTrailTrailToS3BucketRel(),
+            CloudTrailTrailToCloudWatchLogGroupRel(),
+        ]
+    )

cartography/models/aws/cloudwatch/log_metric_filter.py

@@ -0,0 +1,79 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class CloudWatchLogMetricFilterNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    arn: PropertyRef = PropertyRef("filterName", extra_index=True)
+    region: PropertyRef = PropertyRef("Region", set_in_kwargs=True)
+    filter_name: PropertyRef = PropertyRef("filterName")
+    filter_pattern: PropertyRef = PropertyRef("filterPattern")
+    log_group_name: PropertyRef = PropertyRef("logGroupName")
+    metric_name: PropertyRef = PropertyRef("metricName")
+    metric_namespace: PropertyRef = PropertyRef("metricNamespace")
+    metric_value: PropertyRef = PropertyRef("metricValue")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudWatchLogMetricFilterToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudWatchLogMetricFilterToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: CloudWatchLogMetricFilterToAwsAccountRelProperties = (
+        CloudWatchLogMetricFilterToAwsAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class CloudWatchLogMetricFilterToCloudWatchLogGroupRelProperties(
+    CartographyRelProperties
+):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudWatchLogMetricFilterToCloudWatchLogGroupRel(CartographyRelSchema):
+    target_node_label: str = "CloudWatchLogGroup"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"log_group_name": PropertyRef("logGroupName")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "METRIC_FILTER_OF"
+    properties: CloudWatchLogMetricFilterToCloudWatchLogGroupRelProperties = (
+        CloudWatchLogMetricFilterToCloudWatchLogGroupRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class CloudWatchLogMetricFilterSchema(CartographyNodeSchema):
+    label: str = "CloudWatchLogMetricFilter"
+    properties: CloudWatchLogMetricFilterNodeProperties = (
+        CloudWatchLogMetricFilterNodeProperties()
+    )
+    sub_resource_relationship: CloudWatchLogMetricFilterToAWSAccountRel = (
+        CloudWatchLogMetricFilterToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            CloudWatchLogMetricFilterToCloudWatchLogGroupRel(),
+        ]
+    )

cartography/models/aws/cloudwatch/loggroup.py

@@ -0,0 +1,52 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class CloudWatchLogGroupNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("logGroupArn")
+    arn: PropertyRef = PropertyRef("logGroupArn", extra_index=True)
+    creation_time: PropertyRef = PropertyRef("creationTime")
+    data_protection_status: PropertyRef = PropertyRef("dataProtectionStatus")
+    inherited_properties: PropertyRef = PropertyRef("inheritedProperties")
+    kms_key_id: PropertyRef = PropertyRef("kmsKeyId")
+    log_group_arn: PropertyRef = PropertyRef("logGroupArn")
+    log_group_class: PropertyRef = PropertyRef("logGroupClass")
+    log_group_name: PropertyRef = PropertyRef("logGroupName")
+    metric_filter_count: PropertyRef = PropertyRef("metricFilterCount")
+    retention_in_days: PropertyRef = PropertyRef("retentionInDays")
+    stored_bytes: PropertyRef = PropertyRef("storedBytes")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudWatchLogGroupToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class CloudWatchToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: CloudWatchLogGroupToAwsAccountRelProperties = (
+        CloudWatchLogGroupToAwsAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class CloudWatchLogGroupSchema(CartographyNodeSchema):
+    label: str = "CloudWatchLogGroup"
+    properties: CloudWatchLogGroupNodeProperties = CloudWatchLogGroupNodeProperties()
+    sub_resource_relationship: CloudWatchToAWSAccountRel = CloudWatchToAWSAccountRel()