cartography 0.93.0rc1__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/models/azure/network_interface.py

@@ -0,0 +1,112 @@
+import logging
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    name: PropertyRef = PropertyRef("name")
+    location: PropertyRef = PropertyRef("location")
+    mac_address: PropertyRef = PropertyRef("mac_address")
+    private_ip_addresses: PropertyRef = PropertyRef("private_ip_addresses")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceToSubscriptionRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceToSubscriptionRel(CartographyRelSchema):
+    target_node_label: str = "AzureSubscription"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AZURE_SUBSCRIPTION_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AzureNetworkInterfaceToSubscriptionRelProperties = (
+        AzureNetworkInterfaceToSubscriptionRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceToVirtualMachineRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceToVirtualMachineRel(CartographyRelSchema):
+    target_node_label: str = "AzureVirtualMachine"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("VIRTUAL_MACHINE_ID")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ATTACHED_TO"
+    properties: AzureNetworkInterfaceToVirtualMachineRelProperties = (
+        AzureNetworkInterfaceToVirtualMachineRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceToSubnetRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceToSubnetRel(CartographyRelSchema):
+    target_node_label: str = "AzureSubnet"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("SUBNET_IDS", one_to_many=True)},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ATTACHED_TO"
+    properties: AzureNetworkInterfaceToSubnetRelProperties = (
+        AzureNetworkInterfaceToSubnetRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceToPublicIPRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceToPublicIPRel(CartographyRelSchema):
+    target_node_label: str = "AzurePublicIPAddress"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("PUBLIC_IP_IDS", one_to_many=True)},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ASSOCIATED_WITH"
+    properties: AzureNetworkInterfaceToPublicIPRelProperties = (
+        AzureNetworkInterfaceToPublicIPRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureNetworkInterfaceSchema(CartographyNodeSchema):
+    label: str = "AzureNetworkInterface"
+    properties: AzureNetworkInterfaceProperties = AzureNetworkInterfaceProperties()
+    sub_resource_relationship: AzureNetworkInterfaceToSubscriptionRel = (
+        AzureNetworkInterfaceToSubscriptionRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AzureNetworkInterfaceToVirtualMachineRel(),
+            AzureNetworkInterfaceToSubnetRel(),
+            AzureNetworkInterfaceToPublicIPRel(),
+        ],
+    )

cartography/models/azure/network_security_group.py

@@ -0,0 +1,50 @@
+import logging
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class AzureNetworkSecurityGroupProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    name: PropertyRef = PropertyRef("name")
+    location: PropertyRef = PropertyRef("location")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureNetworkSecurityGroupToSubscriptionRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureNetworkSecurityGroupToSubscriptionRel(CartographyRelSchema):
+    target_node_label: str = "AzureSubscription"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AZURE_SUBSCRIPTION_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AzureNetworkSecurityGroupToSubscriptionRelProperties = (
+        AzureNetworkSecurityGroupToSubscriptionRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureNetworkSecurityGroupSchema(CartographyNodeSchema):
+    label: str = "AzureNetworkSecurityGroup"
+    properties: AzureNetworkSecurityGroupProperties = (
+        AzureNetworkSecurityGroupProperties()
+    )
+    sub_resource_relationship: AzureNetworkSecurityGroupToSubscriptionRel = (
+        AzureNetworkSecurityGroupToSubscriptionRel()
+    )

cartography/models/azure/permission_relationships.py

@@ -0,0 +1,60 @@
+"""
+Azure permission relationship MatchLink schemas.
+"""
+
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_source_node_matcher
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import SourceNodeMatcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AzurePermissionRelProperties(CartographyRelProperties):
+    """
+    Properties for Azure permission relationships.
+    """
+
+    # Required fields for MatchLinks
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef(
+        "_sub_resource_label", set_in_kwargs=True
+    )
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzurePermissionMatchLink(CartographyRelSchema):
+    """
+    MatchLink schema for Azure permission relationships.
+    Creates relationships like: (EntraUser|EntraGroup|EntraServicePrincipal)-[:CAN_READ]->(AzureResource)
+
+    This MatchLink handles permission relationships between Azure principals and resources
+    based on RBAC assignments and permission evaluations.
+    """
+
+    # MatchLink-specific fields
+    source_node_label: str = (
+        "EntraPrincipal"  # Covers EntraUser, EntraGroup, EntraServicePrincipal
+    )
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher(
+        {"id": PropertyRef("principal_id")},
+    )
+
+    # Standard CartographyRelSchema fields
+    target_node_label: str = (
+        "AzureResource"  # Will be dynamically set based on target_label
+    )
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("resource_id")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = (
+        "HAS_PERMISSION"  # Will be dynamically set based on relationship_name
+    )
+    properties: AzurePermissionRelProperties = AzurePermissionRelProperties()

cartography/models/azure/principal.py

@@ -0,0 +1,41 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AzurePrincipalProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzurePrincipalToTenantRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzurePrincipalToTenantRel(CartographyRelSchema):
+    target_node_label: str = "AzureTenant"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("TENANT_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AzurePrincipalToTenantRelProperties = (
+        AzurePrincipalToTenantRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzurePrincipalSchema(CartographyNodeSchema):
+    label: str = "AzurePrincipal"
+    properties: AzurePrincipalProperties = AzurePrincipalProperties()
+    sub_resource_relationship: AzurePrincipalToTenantRel = AzurePrincipalToTenantRel()

cartography/models/azure/public_ip_address.py

@@ -0,0 +1,50 @@
+import logging
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class AzurePublicIPAddressProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    name: PropertyRef = PropertyRef("name")
+    location: PropertyRef = PropertyRef("location")
+    ip_address: PropertyRef = PropertyRef("ip_address")
+    allocation_method: PropertyRef = PropertyRef("public_ip_allocation_method")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzurePublicIPAddressToSubscriptionRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzurePublicIPAddressToSubscriptionRel(CartographyRelSchema):
+    target_node_label: str = "AzureSubscription"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AZURE_SUBSCRIPTION_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AzurePublicIPAddressToSubscriptionRelProperties = (
+        AzurePublicIPAddressToSubscriptionRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzurePublicIPAddressSchema(CartographyNodeSchema):
+    label: str = "AzurePublicIPAddress"
+    properties: AzurePublicIPAddressProperties = AzurePublicIPAddressProperties()
+    sub_resource_relationship: AzurePublicIPAddressToSubscriptionRel = (
+        AzurePublicIPAddressToSubscriptionRel()
+    )

cartography/models/azure/rbac.py

@@ -0,0 +1,268 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+# Node Properties - Role Assignment as a Node
+@dataclass(frozen=True)
+class AzureRoleAssignmentProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    name: PropertyRef = PropertyRef("name")
+    type: PropertyRef = PropertyRef("type")
+    principal_id: PropertyRef = PropertyRef("principalId")
+    principal_type: PropertyRef = PropertyRef("principalType")
+    role_definition_id: PropertyRef = PropertyRef("roleDefinitionId")
+    scope: PropertyRef = PropertyRef("scope")
+    scope_type: PropertyRef = PropertyRef("scopeType")
+    created_on: PropertyRef = PropertyRef("createdOn")
+    updated_on: PropertyRef = PropertyRef("updatedOn")
+    created_by: PropertyRef = PropertyRef("createdBy")
+    updated_by: PropertyRef = PropertyRef("updatedBy")
+    condition: PropertyRef = PropertyRef("condition")
+    description: PropertyRef = PropertyRef("description")
+    delegated_managed_identity_resource_id: PropertyRef = PropertyRef(
+        "delegatedManagedIdentityResourceId"
+    )
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    subscription_id: PropertyRef = PropertyRef(
+        "AZURE_SUBSCRIPTION_ID", set_in_kwargs=True
+    )
+
+
+@dataclass(frozen=True)
+class AzureRoleDefinitionProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    name: PropertyRef = PropertyRef("name")
+    type: PropertyRef = PropertyRef("type")
+    role_name: PropertyRef = PropertyRef("roleName")
+    description: PropertyRef = PropertyRef("description")
+    assignable_scopes: PropertyRef = PropertyRef("assignableScopes")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    subscription_id: PropertyRef = PropertyRef(
+        "AZURE_SUBSCRIPTION_ID", set_in_kwargs=True
+    )
+
+
+@dataclass(frozen=True)
+class AzurePermissionsProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    actions: PropertyRef = PropertyRef("actions")
+    not_actions: PropertyRef = PropertyRef("not_actions")
+    data_actions: PropertyRef = PropertyRef("data_actions")
+    not_data_actions: PropertyRef = PropertyRef("not_data_actions")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    subscription_id: PropertyRef = PropertyRef(
+        "AZURE_SUBSCRIPTION_ID", set_in_kwargs=True
+    )
+
+
+# Relationship Properties for standard relationships
+@dataclass(frozen=True)
+class AzureRoleAssignmentToSubscriptionRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureRoleDefinitionToSubscriptionRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureRoleAssignmentToEntraUserRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureRoleAssignmentToEntraGroupRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureRoleAssignmentToEntraServicePrincipalRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureRoleAssignmentToRoleDefinitionRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureRoleDefinitionToPermissionsRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzurePermissionsToSubscriptionRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+# Standard Relationships
+@dataclass(frozen=True)
+class AzureRoleAssignmentToSubscriptionRel(CartographyRelSchema):
+    target_node_label: str = "AzureSubscription"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AZURE_SUBSCRIPTION_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AzureRoleAssignmentToSubscriptionRelProperties = (
+        AzureRoleAssignmentToSubscriptionRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureRoleDefinitionToSubscriptionRel(CartographyRelSchema):
+    target_node_label: str = "AzureSubscription"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AZURE_SUBSCRIPTION_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AzureRoleDefinitionToSubscriptionRelProperties = (
+        AzureRoleDefinitionToSubscriptionRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureRoleAssignmentToRoleDefinitionRel(CartographyRelSchema):
+    target_node_label: str = "AzureRoleDefinition"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("roleDefinitionId"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ROLE_ASSIGNED"
+    properties: AzureRoleAssignmentToRoleDefinitionRelProperties = (
+        AzureRoleAssignmentToRoleDefinitionRelProperties()
+    )
+
+
+# Relationships from Azure Role Assignment to Entra Principals
+@dataclass(frozen=True)
+class AzureRoleAssignmentToEntraUserRel(CartographyRelSchema):
+    target_node_label: str = "EntraUser"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("principalId"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "HAS_ROLE_ASSIGNMENT"
+    properties: AzureRoleAssignmentToEntraUserRelProperties = (
+        AzureRoleAssignmentToEntraUserRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureRoleAssignmentToEntraGroupRel(CartographyRelSchema):
+    target_node_label: str = "EntraGroup"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("principalId"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "HAS_ROLE_ASSIGNMENT"
+    properties: AzureRoleAssignmentToEntraGroupRelProperties = (
+        AzureRoleAssignmentToEntraGroupRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureRoleAssignmentToEntraServicePrincipalRel(CartographyRelSchema):
+    target_node_label: str = "EntraServicePrincipal"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("principalId"),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "HAS_ROLE_ASSIGNMENT"
+    properties: AzureRoleAssignmentToEntraServicePrincipalRelProperties = (
+        AzureRoleAssignmentToEntraServicePrincipalRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureRoleDefinitionToPermissionsRel(CartographyRelSchema):
+    target_node_label: str = "AzurePermissions"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("permission_ids", one_to_many=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "HAS_PERMISSIONS"
+    properties: AzureRoleDefinitionToPermissionsRelProperties = (
+        AzureRoleDefinitionToPermissionsRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzurePermissionsToSubscriptionRel(CartographyRelSchema):
+    target_node_label: str = "AzureSubscription"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {
+            "id": PropertyRef("AZURE_SUBSCRIPTION_ID", set_in_kwargs=True),
+        }
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AzurePermissionsToSubscriptionRelProperties = (
+        AzurePermissionsToSubscriptionRelProperties()
+    )
+
+
+# Node Schemas
+@dataclass(frozen=True)
+class AzureRoleAssignmentSchema(CartographyNodeSchema):
+    label: str = "AzureRoleAssignment"
+    properties: AzureRoleAssignmentProperties = AzureRoleAssignmentProperties()
+    sub_resource_relationship: AzureRoleAssignmentToSubscriptionRel = (
+        AzureRoleAssignmentToSubscriptionRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AzureRoleAssignmentToRoleDefinitionRel(),
+            AzureRoleAssignmentToEntraUserRel(),
+            AzureRoleAssignmentToEntraGroupRel(),
+            AzureRoleAssignmentToEntraServicePrincipalRel(),
+        ]
+    )
+
+
+@dataclass(frozen=True)
+class AzureRoleDefinitionSchema(CartographyNodeSchema):
+    label: str = "AzureRoleDefinition"
+    properties: AzureRoleDefinitionProperties = AzureRoleDefinitionProperties()
+    sub_resource_relationship: AzureRoleDefinitionToSubscriptionRel = (
+        AzureRoleDefinitionToSubscriptionRel()
+    )
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AzureRoleDefinitionToPermissionsRel(),
+        ]
+    )
+
+
+@dataclass(frozen=True)
+class AzurePermissionsSchema(CartographyNodeSchema):
+    label: str = "AzurePermissions"
+    properties: AzurePermissionsProperties = AzurePermissionsProperties()
+    sub_resource_relationship: AzurePermissionsToSubscriptionRel = (
+        AzurePermissionsToSubscriptionRel()
+    )

cartography/models/azure/resource_groups.py

@@ -0,0 +1,52 @@
+import logging
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+logger = logging.getLogger(__name__)
+
+
+# --- Node Definitions ---
+@dataclass(frozen=True)
+class AzureResourceGroupProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    name: PropertyRef = PropertyRef("name")
+    location: PropertyRef = PropertyRef("location")
+    provisioning_state: PropertyRef = PropertyRef("provisioning_state")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+# --- Relationship Definitions ---
+@dataclass(frozen=True)
+class AzureResourceGroupToSubscriptionRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureResourceGroupToSubscriptionRel(CartographyRelSchema):
+    target_node_label: str = "AzureSubscription"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AZURE_SUBSCRIPTION_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AzureResourceGroupToSubscriptionRelProperties = (
+        AzureResourceGroupToSubscriptionRelProperties()
+    )
+
+
+# --- Main Schema ---
+@dataclass(frozen=True)
+class AzureResourceGroupSchema(CartographyNodeSchema):
+    label: str = "AzureResourceGroup"
+    properties: AzureResourceGroupProperties = AzureResourceGroupProperties()
+    sub_resource_relationship: AzureResourceGroupToSubscriptionRel = (
+        AzureResourceGroupToSubscriptionRel()
+    )

cartography/models/azure/security_center.py

@@ -0,0 +1,50 @@
+import logging
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class AzureSecurityAssessmentProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    name: PropertyRef = PropertyRef("name")
+    display_name: PropertyRef = PropertyRef("display_name")
+    description: PropertyRef = PropertyRef("description")
+    remediation_description: PropertyRef = PropertyRef("remediation_description")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureSubscriptionToAssessmentRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AzureSubscriptionToAssessmentRel(CartographyRelSchema):
+    target_node_label: str = "AzureSubscription"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("AZURE_SUBSCRIPTION_ID", set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "HAS_ASSESSMENT"
+    properties: AzureSubscriptionToAssessmentRelProperties = (
+        AzureSubscriptionToAssessmentRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AzureSecurityAssessmentSchema(CartographyNodeSchema):
+    label: str = "AzureSecurityAssessment"
+    properties: AzureSecurityAssessmentProperties = AzureSecurityAssessmentProperties()
+    sub_resource_relationship: AzureSubscriptionToAssessmentRel = (
+        AzureSubscriptionToAssessmentRel()
+    )