cartography 0.93.0rc1__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/models/aws/iam/policy_statement.py

@@ -0,0 +1,57 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("id")
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM policy statements
+    effect: PropertyRef = PropertyRef("Effect")
+    action: PropertyRef = PropertyRef("Action")
+    notaction: PropertyRef = PropertyRef("NotAction")
+    resource: PropertyRef = PropertyRef("Resource")
+    notresource: PropertyRef = PropertyRef("NotResource")
+    condition: PropertyRef = PropertyRef("Condition")
+    sid: PropertyRef = PropertyRef("Sid")
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementToAWSPolicyRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementToAWSPolicyRel(CartographyRelSchema):
+    target_node_label: str = "AWSPolicy"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("POLICY_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "STATEMENT"
+    properties: AWSPolicyStatementToAWSPolicyRelProperties = (
+        AWSPolicyStatementToAWSPolicyRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSPolicyStatementSchema(CartographyNodeSchema):
+    label: str = "AWSPolicyStatement"
+    properties: AWSPolicyStatementNodeProperties = AWSPolicyStatementNodeProperties()
+    sub_resource_relationship: AWSPolicyStatementToAWSPolicyRel = (
+        AWSPolicyStatementToAWSPolicyRel()
+    )

cartography/models/aws/iam/role.py

@@ -0,0 +1,83 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSRoleNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM roles
+    roleid: PropertyRef = PropertyRef("roleid")
+    name: PropertyRef = PropertyRef("name")
+    path: PropertyRef = PropertyRef("path")
+    createdate: PropertyRef = PropertyRef("createdate")
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSRoleToAWSAccountRelProperties = AWSRoleToAWSAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSPrincipalTrustRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRoleToAWSPrincipalTrustRel(CartographyRelSchema):
+    """
+    Trust relationship with principals of type "AWS".
+    """
+
+    target_node_label: str = "AWSPrincipal"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "arn": PropertyRef("trusted_aws_principals", one_to_many=True),
+        },
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "TRUSTS_AWS_PRINCIPAL"
+    properties: AWSRoleToAWSPrincipalTrustRelProperties = (
+        AWSRoleToAWSPrincipalTrustRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSRoleSchema(CartographyNodeSchema):
+    label: str = "AWSRole"
+    properties: AWSRoleNodeProperties = AWSRoleNodeProperties()
+    sub_resource_relationship: AWSRoleToAWSAccountRel = AWSRoleToAWSAccountRel()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AWSRoleToAWSPrincipalTrustRel(),
+        ]
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])

cartography/models/aws/iam/root_principal.py

@@ -0,0 +1,52 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSRootPrincipalNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRootPrincipalToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSRootPrincipalToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSRootPrincipalToAWSAccountRelProperties = (
+        AWSRootPrincipalToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSRootPrincipalSchema(CartographyNodeSchema):
+    """
+    Represents the AWS root principal for an AWS account
+    """
+
+    label: str = "AWSRootPrincipal"
+    properties: AWSRootPrincipalNodeProperties = AWSRootPrincipalNodeProperties()
+    sub_resource_relationship: AWSRootPrincipalToAWSAccountRel = (
+        AWSRootPrincipalToAWSAccountRel()
+    )
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])

cartography/models/aws/iam/service_principal.py

@@ -0,0 +1,30 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+
+
+@dataclass(frozen=True)
+class AWSServicePrincipalNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM service principals
+    type: PropertyRef = PropertyRef("type")
+
+
+@dataclass(frozen=True)
+class AWSServicePrincipalSchema(CartographyNodeSchema):
+    """
+    Represents a global AWS service principal e.g. "ec2.amazonaws.com"
+    """
+
+    label: str = "AWSServicePrincipal"
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["AWSPrincipal"])
+    properties: AWSServicePrincipalNodeProperties = AWSServicePrincipalNodeProperties()

cartography/models/aws/iam/sts_assumerole_allow.py

@@ -0,0 +1,38 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_source_node_matcher
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import SourceNodeMatcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class STSAssumeRoleAllowRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef(
+        "_sub_resource_label", set_in_kwargs=True
+    )
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class STSAssumeRoleAllowMatchLink(CartographyRelSchema):
+    rel_label: str = "STS_ASSUMEROLE_ALLOW"
+    direction: LinkDirection = LinkDirection.OUTWARD
+    properties: STSAssumeRoleAllowRelProperties = STSAssumeRoleAllowRelProperties()
+
+    # Target node (the role being assumed)
+    target_node_label: str = "AWSRole"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"arn": PropertyRef("target_arn")},
+    )
+
+    # Source node (the principal that can assume the role)
+    source_node_label: str = "AWSPrincipal"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher(
+        {"arn": PropertyRef("source_arn")},
+    )

cartography/models/aws/iam/user.py

@@ -0,0 +1,59 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSUserNodeProperties(CartographyNodeProperties):
+    # Required unique identifier
+    id: PropertyRef = PropertyRef("arn")
+    arn: PropertyRef = PropertyRef("arn", extra_index=True)
+
+    # Automatic fields (set by cartography)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+    # Business fields from AWS IAM users
+    userid: PropertyRef = PropertyRef("userid")
+    name: PropertyRef = PropertyRef("name")
+    path: PropertyRef = PropertyRef("path")
+    createdate: PropertyRef = PropertyRef("createdate")
+    passwordlastused: PropertyRef = PropertyRef("passwordlastused")
+
+
+@dataclass(frozen=True)
+class AWSUserToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSUserToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AWS_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSUserToAWSAccountRelProperties = AWSUserToAWSAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class AWSUserSchema(CartographyNodeSchema):
+    label: str = "AWSUser"
+    properties: AWSUserNodeProperties = AWSUserNodeProperties()
+    sub_resource_relationship: AWSUserToAWSAccountRel = AWSUserToAWSAccountRel()
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(
+        [
+            "AWSPrincipal",
+            "UserAccount",
+        ]  # UserAccount label is used for ontology mapping
+    )

cartography/models/aws/identitycenter/awsidentitycenter.py

@@ -0,0 +1,49 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class IdentityCenterInstanceProperties(CartographyNodeProperties):
+    identity_store_id: PropertyRef = PropertyRef("IdentityStoreId")
+    arn: PropertyRef = PropertyRef("InstanceArn")
+    created_date: PropertyRef = PropertyRef("CreatedDate")
+    id: PropertyRef = PropertyRef("InstanceArn")
+    status: PropertyRef = PropertyRef("Status")
+    region: PropertyRef = PropertyRef("Region", set_in_kwargs=True)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class IdentityCenterToAWSAccountRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+# (:IdentityCenter)<-[:RESOURCE]-(:AWSAccount)
+class IdentityCenterToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: IdentityCenterToAWSAccountRelRelProperties = (
+        IdentityCenterToAWSAccountRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSIdentityCenterInstanceSchema(CartographyNodeSchema):
+    label: str = "AWSIdentityCenter"
+    properties: IdentityCenterInstanceProperties = IdentityCenterInstanceProperties()
+    sub_resource_relationship: IdentityCenterToAWSAccountRel = (
+        IdentityCenterToAWSAccountRel()
+    )

cartography/models/aws/identitycenter/awspermissionset.py

@@ -0,0 +1,162 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_source_node_matcher
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import SourceNodeMatcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class PermissionSetProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("PermissionSetArn")
+    name: PropertyRef = PropertyRef("Name")
+    arn: PropertyRef = PropertyRef("PermissionSetArn")
+    description: PropertyRef = PropertyRef("Description")
+    session_duration: PropertyRef = PropertyRef("SessionDuration")
+    instance_arn: PropertyRef = PropertyRef("InstanceArn", set_in_kwargs=True)
+    region: PropertyRef = PropertyRef("Region", set_in_kwargs=True)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class PermissionSetToInstanceRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class PermissionSetToInstanceRel(CartographyRelSchema):
+    target_node_label: str = "AWSIdentityCenter"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"arn": PropertyRef("InstanceArn", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "HAS_PERMISSION_SET"
+    properties: PermissionSetToInstanceRelRelProperties = (
+        PermissionSetToInstanceRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class PermissionSetToAWSRoleRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class PermissionSetToAWSRoleRel(CartographyRelSchema):
+    target_node_label: str = "AWSRole"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"arn": PropertyRef("RoleHint", fuzzy_and_ignore_case=True)},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ASSIGNED_TO_ROLE"
+    properties: PermissionSetToAWSRoleRelRelProperties = (
+        PermissionSetToAWSRoleRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSPermissionSetToAWSAccountRelRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+# (:IdentityCenter)<-[:RESOURCE]-(:AWSAccount)
+class AWSPermissionSetToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSPermissionSetToAWSAccountRelRelProperties = (
+        AWSPermissionSetToAWSAccountRelRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class RoleAssignmentAllowedByRelProperties(CartographyRelProperties):
+    """
+    Properties for the ALLOWED_BY relationship between AWSRole and AWSSSO principals.
+    """
+
+    # Mandatory fields for MatchLinks
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef(
+        "_sub_resource_label", set_in_kwargs=True
+    )
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+    # Role assignment specific properties
+    permission_set_arn: PropertyRef = PropertyRef("PermissionSetArn")
+
+
+@dataclass(frozen=True)
+class AWSRoleToSSOUserMatchLink(CartographyRelSchema):
+    """
+    MatchLink for (AWSRole)-[:ALLOWED_BY]->(AWSSSOUser).
+
+    See schema documentation for details.
+    """
+
+    # MatchLink-specific fields for AWSRole as source
+    source_node_label: str = "AWSRole"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher(
+        {"arn": PropertyRef("RoleArn")},
+    )
+
+    # Standard CartographyRelSchema fields for AWSSSOUser as target
+    target_node_label: str = "AWSSSOUser"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("UserId")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ALLOWED_BY"
+    properties: RoleAssignmentAllowedByRelProperties = (
+        RoleAssignmentAllowedByRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSRoleToSSOGroupMatchLink(CartographyRelSchema):
+    """
+    MatchLink for (AWSRole)-[:ALLOWED_BY]->(AWSSSOGroup).
+
+    See schema documentation for details.
+    """
+
+    source_node_label: str = "AWSRole"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher(
+        {"arn": PropertyRef("RoleArn")},
+    )
+
+    target_node_label: str = "AWSSSOGroup"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("GroupId")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ALLOWED_BY"
+    properties: RoleAssignmentAllowedByRelProperties = (
+        RoleAssignmentAllowedByRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSPermissionSetSchema(CartographyNodeSchema):
+    label: str = "AWSPermissionSet"
+    properties: PermissionSetProperties = PermissionSetProperties()
+    sub_resource_relationship: AWSPermissionSetToAWSAccountRel = (
+        AWSPermissionSetToAWSAccountRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            PermissionSetToInstanceRel(),
+            PermissionSetToAWSRoleRel(),
+        ],
+    )

cartography/models/aws/identitycenter/awssogroup.py

@@ -0,0 +1,70 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AWSSSOGroupProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("GroupId")
+    display_name: PropertyRef = PropertyRef("DisplayName")
+    description: PropertyRef = PropertyRef("Description")
+    identity_store_id: PropertyRef = PropertyRef("IdentityStoreId")
+    external_id: PropertyRef = PropertyRef("ExternalId", extra_index=True)
+    region: PropertyRef = PropertyRef("Region", set_in_kwargs=True)
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSSSOGroupToAWSAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSSSOGroupToAWSAccountRel(CartographyRelSchema):
+    target_node_label: str = "AWSAccount"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AWS_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AWSSSOGroupToAWSAccountRelProperties = (
+        AWSSSOGroupToAWSAccountRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSSSOGroupToPermissionSetRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AWSSSOGroupToPermissionSetRel(CartographyRelSchema):
+    target_node_label: str = "AWSPermissionSet"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"arn": PropertyRef("AssignedPermissionSets", one_to_many=True)},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "HAS_PERMISSION_SET"
+    properties: AWSSSOGroupToPermissionSetRelProperties = (
+        AWSSSOGroupToPermissionSetRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AWSSSOGroupSchema(CartographyNodeSchema):
+    label: str = "AWSSSOGroup"
+    properties: AWSSSOGroupProperties = AWSSSOGroupProperties()
+    sub_resource_relationship: AWSSSOGroupToAWSAccountRel = AWSSSOGroupToAWSAccountRel()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AWSSSOGroupToPermissionSetRel(),
+        ]
+    )