cartography 0.93.0rc1__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/intel/aws/redshift.py

@@ -5,6 +5,7 @@ from typing import List
 import boto3
 import neo4j
 
+from cartography.client.core.tx import run_write_query
 from cartography.util import aws_handle_regions
 from cartography.util import run_cleanup_job
 from cartography.util import timeit
@@ -14,30 +15,52 @@ logger = logging.getLogger(__name__)
 
 @timeit
 @aws_handle_regions
-def get_redshift_cluster_data(boto3_session: boto3.session.Session, region: str) -> List[Dict]:
-    client = boto3_session.client('redshift', region_name=region)
-    paginator = client.get_paginator('describe_clusters')
+def get_redshift_cluster_data(
+    boto3_session: boto3.session.Session,
+    region: str,
+) -> List[Dict]:
+    client = boto3_session.client("redshift", region_name=region)
+    paginator = client.get_paginator("describe_clusters")
     clusters: List[Dict] = []
     for page in paginator.paginate():
-        clusters.extend(page['Clusters'])
+        clusters.extend(page["Clusters"])
     return clusters
 
 
-def _make_redshift_cluster_arn(region: str, aws_account_id: str, cluster_identifier: str) -> str:
+def _make_redshift_cluster_arn(
+    region: str,
+    aws_account_id: str,
+    cluster_identifier: str,
+) -> str:
     """Cluster ARN format: https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html"""
-    return f'arn:aws:redshift:{region}:{aws_account_id}:cluster:{cluster_identifier}'
+    return f"arn:aws:redshift:{region}:{aws_account_id}:cluster:{cluster_identifier}"
 
 
-def transform_redshift_cluster_data(clusters: List[Dict], region: str, current_aws_account_id: str) -> None:
+def transform_redshift_cluster_data(
+    clusters: List[Dict],
+    region: str,
+    current_aws_account_id: str,
+) -> None:
     for cluster in clusters:
-        cluster['arn'] = _make_redshift_cluster_arn(region, current_aws_account_id, cluster["ClusterIdentifier"])
-        cluster['ClusterCreateTime'] = str(cluster['ClusterCreateTime']) if 'ClusterCreateTime' in cluster else None
+        cluster["arn"] = _make_redshift_cluster_arn(
+            region,
+            current_aws_account_id,
+            cluster["ClusterIdentifier"],
+        )
+        cluster["ClusterCreateTime"] = (
+            str(cluster["ClusterCreateTime"])
+            if "ClusterCreateTime" in cluster
+            else None
+        )
 
 
 @timeit
 def load_redshift_cluster_data(
-    neo4j_session: neo4j.Session, clusters: List[Dict], region: str,
-    current_aws_account_id: str, aws_update_tag: int,
+    neo4j_session: neo4j.Session,
+    clusters: List[Dict],
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
 ) -> None:
     ingest_cluster = """
     MERGE (cluster:RedshiftCluster{id: $Arn})
@@ -66,23 +89,24 @@ def load_redshift_cluster_data(
     SET r.lastupdated = $aws_update_tag
     """
     for cluster in clusters:
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             ingest_cluster,
-            Arn=cluster['arn'],
-            AZ=cluster['AvailabilityZone'],
-            ClusterCreateTime=cluster['ClusterCreateTime'],
-            ClusterIdentifier=cluster['ClusterIdentifier'],
-            ClusterRevisionNumber=cluster['ClusterRevisionNumber'],
-            ClusterStatus=cluster['ClusterStatus'],
-            DBName=cluster['DBName'],
-            Encrypted=cluster['Encrypted'],
-            EndpointAddress=cluster.get('Endpoint').get('Address'),    # type: ignore
-            EndpointPort=cluster.get('Endpoint').get('Port'),   # type: ignore
-            MasterUsername=cluster['MasterUsername'],
-            NodeType=cluster['NodeType'],
-            NumberOfNodes=cluster['NumberOfNodes'],
-            PubliclyAccessible=cluster['PubliclyAccessible'],
-            VpcId=cluster.get('VpcId'),
+            Arn=cluster["arn"],
+            AZ=cluster["AvailabilityZone"],
+            ClusterCreateTime=cluster["ClusterCreateTime"],
+            ClusterIdentifier=cluster["ClusterIdentifier"],
+            ClusterRevisionNumber=cluster["ClusterRevisionNumber"],
+            ClusterStatus=cluster["ClusterStatus"],
+            DBName=cluster["DBName"],
+            Encrypted=cluster["Encrypted"],
+            EndpointAddress=cluster.get("Endpoint").get("Address"),  # type: ignore
+            EndpointPort=cluster.get("Endpoint").get("Port"),  # type: ignore
+            MasterUsername=cluster["MasterUsername"],
+            NodeType=cluster["NodeType"],
+            NumberOfNodes=cluster["NumberOfNodes"],
+            PubliclyAccessible=cluster["PubliclyAccessible"],
+            VpcId=cluster.get("VpcId"),
             Region=region,
             AWS_ACCOUNT_ID=current_aws_account_id,
             aws_update_tag=aws_update_tag,
@@ -93,7 +117,11 @@ def load_redshift_cluster_data(
 
 
 @timeit
-def _attach_ec2_security_groups(neo4j_session: neo4j.Session, cluster: Dict, aws_update_tag: int) -> None:
+def _attach_ec2_security_groups(
+    neo4j_session: neo4j.Session,
+    cluster: Dict,
+    aws_update_tag: int,
+) -> None:
     attach_cluster_to_group = """
     MATCH (c:RedshiftCluster{id:$ClusterArn})
     MERGE (sg:EC2SecurityGroup{id:$GroupId})
@@ -101,17 +129,22 @@ def _attach_ec2_security_groups(neo4j_session: neo4j.Session, cluster: Dict, aws
     ON CREATE SET m.firstseen = timestamp()
     SET m.lastupdated = $aws_update_tag
     """
-    for group in cluster.get('VpcSecurityGroups', []):
-        neo4j_session.run(
+    for group in cluster.get("VpcSecurityGroups", []):
+        run_write_query(
+            neo4j_session,
             attach_cluster_to_group,
-            ClusterArn=cluster['arn'],
-            GroupId=group['VpcSecurityGroupId'],
+            ClusterArn=cluster["arn"],
+            GroupId=group["VpcSecurityGroupId"],
             aws_update_tag=aws_update_tag,
         )
 
 
 @timeit
-def _attach_iam_roles(neo4j_session: neo4j.Session, cluster: Dict, aws_update_tag: int) -> None:
+def _attach_iam_roles(
+    neo4j_session: neo4j.Session,
+    cluster: Dict,
+    aws_update_tag: int,
+) -> None:
     attach_cluster_to_role = """
     MATCH (c:RedshiftCluster{id:$ClusterArn})
     MERGE (p:AWSPrincipal{arn:$RoleArn})
@@ -119,17 +152,22 @@ def _attach_iam_roles(neo4j_session: neo4j.Session, cluster: Dict, aws_update_ta
     ON CREATE SET s.firstseen = timestamp()
     SET s.lastupdated = $aws_update_tag
     """
-    for role in cluster.get('IamRoles', []):
-        neo4j_session.run(
+    for role in cluster.get("IamRoles", []):
+        run_write_query(
+            neo4j_session,
             attach_cluster_to_role,
-            ClusterArn=cluster['arn'],
-            RoleArn=role['IamRoleArn'],
+            ClusterArn=cluster["arn"],
+            RoleArn=role["IamRoleArn"],
             aws_update_tag=aws_update_tag,
         )
 
 
 @timeit
-def _attach_aws_vpc(neo4j_session: neo4j.Session, cluster: Dict, aws_update_tag: int) -> None:
+def _attach_aws_vpc(
+    neo4j_session: neo4j.Session,
+    cluster: Dict,
+    aws_update_tag: int,
+) -> None:
     attach_cluster_to_vpc = """
     MATCH (c:RedshiftCluster{id:$ClusterArn})
     MERGE (v:AWSVpc{id:$VpcId})
@@ -137,36 +175,64 @@ def _attach_aws_vpc(neo4j_session: neo4j.Session, cluster: Dict, aws_update_tag:
     ON CREATE SET m.firstseen = timestamp()
     SET m.lastupdated = $aws_update_tag
     """
-    if cluster.get('VpcId'):
-        neo4j_session.run(
+    if cluster.get("VpcId"):
+        run_write_query(
+            neo4j_session,
             attach_cluster_to_vpc,
-            ClusterArn=cluster['arn'],
-            VpcId=cluster['VpcId'],
+            ClusterArn=cluster["arn"],
+            VpcId=cluster["VpcId"],
             aws_update_tag=aws_update_tag,
         )
 
 
 @timeit
 def cleanup(neo4j_session: neo4j.Session, common_job_parameters: Dict) -> None:
-    run_cleanup_job('aws_import_redshift_clusters_cleanup.json', neo4j_session, common_job_parameters)
+    run_cleanup_job(
+        "aws_import_redshift_clusters_cleanup.json",
+        neo4j_session,
+        common_job_parameters,
+    )
 
 
 @timeit
 def sync_redshift_clusters(
-    neo4j_session: neo4j.Session, boto3_session: boto3.session.Session, region: str,
-    current_aws_account_id: str, aws_update_tag: int,
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    region: str,
+    current_aws_account_id: str,
+    aws_update_tag: int,
 ) -> None:
     data = get_redshift_cluster_data(boto3_session, region)
     transform_redshift_cluster_data(data, region, current_aws_account_id)
-    load_redshift_cluster_data(neo4j_session, data, region, current_aws_account_id, aws_update_tag)
+    load_redshift_cluster_data(
+        neo4j_session,
+        data,
+        region,
+        current_aws_account_id,
+        aws_update_tag,
+    )
 
 
 @timeit
 def sync(
-    neo4j_session: neo4j.Session, boto3_session: boto3.session.Session, regions: List[str], current_aws_account_id: str,
-    update_tag: int, common_job_parameters: Dict,
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    regions: List[str],
+    current_aws_account_id: str,
+    update_tag: int,
+    common_job_parameters: Dict,
 ) -> None:
     for region in regions:
-        logger.info("Syncing Redshift clusters for region '%s' in account '%s'.", region, current_aws_account_id)
-        sync_redshift_clusters(neo4j_session, boto3_session, region, current_aws_account_id, update_tag)
+        logger.info(
+            "Syncing Redshift clusters for region '%s' in account '%s'.",
+            region,
+            current_aws_account_id,
+        )
+        sync_redshift_clusters(
+            neo4j_session,
+            boto3_session,
+            region,
+            current_aws_account_id,
+            update_tag,
+        )
     cleanup(neo4j_session, common_job_parameters)

cartography/intel/aws/resourcegroupstaggingapi.py

@@ -1,5 +1,6 @@
 import logging
 from string import Template
+from typing import Any
 from typing import Dict
 from typing import List
 
@@ -22,7 +23,7 @@ def get_short_id_from_ec2_arn(arn: str) -> str:
     :param arn: The ARN
     :return: The resource ID
     """
-    return arn.split('/')[-1]
+    return arn.split("/")[-1]
 
 
 def get_bucket_name_from_arn(bucket_arn: str) -> str:
@@ -32,7 +33,7 @@ def get_bucket_name_from_arn(bucket_arn: str) -> str:
     :param arn: The S3 bucket's full ARN
     :return: The S3 bucket's name
     """
-    return bucket_arn.split(':')[-1]
+    return bucket_arn.split(":")[-1]
 
 
 def get_short_id_from_elb_arn(alb_arn: str) -> str:
@@ -42,7 +43,7 @@ def get_short_id_from_elb_arn(alb_arn: str) -> str:
     :param arn: The ELB's full ARN
     :return: The ELB's name
     """
-    return alb_arn.split('/')[-1]
+    return alb_arn.split("/")[-1]
 
 
 def get_short_id_from_lb2_arn(alb_arn: str) -> str:
@@ -53,7 +54,36 @@ def get_short_id_from_lb2_arn(alb_arn: str) -> str:
     :param arn: The (N|A)LB's full ARN
     :return: The (N|A)LB's name
     """
-    return alb_arn.split('/')[-2]
+    return alb_arn.split("/")[-2]
+
+
+def get_resource_type_from_arn(arn: str) -> str:
+    """Return the resource type format expected by the Tagging API.
+
+    The Resource Groups Tagging API requires resource types in the form
+    ``service:resource``. Most ARNs embed the resource type in the fifth segment
+    after the service name. Load balancer ARNs add an extra ``app`` or ``net``
+    component that must be preserved. S3 and SQS ARNs only contain the service
+    name.  This helper extracts the appropriate string so that ARNs can be
+    grouped correctly for API calls.
+    """
+
+    parts = arn.split(":", 5)
+    service = parts[2]
+    if service in {"s3", "sqs"}:
+        return service
+
+    resource = parts[5]
+    if service == "elasticloadbalancing" and resource.startswith("loadbalancer/"):
+        segments = resource.split("/")
+        if len(segments) > 2 and segments[1] in {"app", "net"}:
+            resource_type = f"{segments[0]}/{segments[1]}"
+        else:
+            resource_type = segments[0]
+    else:
+        resource_type = resource.split("/")[0].split(":")[0]
+
+    return f"{service}:{resource_type}" if resource_type else service
 
 
 # We maintain a mapping from AWS resource types to their associated labels and unique identifiers.
@@ -64,79 +94,121 @@ def get_short_id_from_lb2_arn(alb_arn: str) -> str:
 # cartography uses.
 # TODO - we should make EC2 and S3 assets query-able by their full ARN so that we don't need this workaround.
 TAG_RESOURCE_TYPE_MAPPINGS: Dict = {
-    'autoscaling:autoScalingGroup': {'label': 'AutoScalingGroup', 'property': 'arn'},
-    'dynamodb:table': {'label': 'DynamoDBTable', 'property': 'id'},
-    'ec2:instance': {'label': 'EC2Instance', 'property': 'id', 'id_func': get_short_id_from_ec2_arn},
-    'ec2:internet-gateway': {'label': 'AWSInternetGateway', 'property': 'id', 'id_func': get_short_id_from_ec2_arn},
-    'ec2:key-pair': {'label': 'EC2KeyPair', 'property': 'id'},
-    'ec2:network-interface': {'label': 'NetworkInterface', 'property': 'id', 'id_func': get_short_id_from_ec2_arn},
-    'ecr:repository': {'label': 'ECRRepository', 'property': 'id'},
-    'ec2:security-group': {'label': 'EC2SecurityGroup', 'property': 'id', 'id_func': get_short_id_from_ec2_arn},
-    'ec2:subnet': {'label': 'EC2Subnet', 'property': 'subnetid', 'id_func': get_short_id_from_ec2_arn},
-    'ec2:transit-gateway': {'label': 'AWSTransitGateway', 'property': 'id'},
-    'ec2:transit-gateway-attachment': {'label': 'AWSTransitGatewayAttachment', 'property': 'id'},
-    'ec2:vpc': {'label': 'AWSVpc', 'property': 'id', 'id_func': get_short_id_from_ec2_arn},
-    'ec2:volume': {'label': 'EBSVolume', 'property': 'id', 'id_func': get_short_id_from_ec2_arn},
-    'ec2:elastic-ip-address': {'label': 'ElasticIPAddress', 'property': 'id', 'id_func': get_short_id_from_ec2_arn},
-    'ecs:cluster': {'label': 'ECSCluster', 'property': 'id'},
-    'ecs:container': {'label': 'ECSContainer', 'property': 'id'},
-    'ecs:container-instance': {'label': 'ECSContainerInstance', 'property': 'id'},
-    'ecs:task': {'label': 'ECSTask', 'property': 'id'},
-    'ecs:task-definition': {'label': 'ECSTaskDefinition', 'property': 'id'},
-    'eks:cluster': {'label': 'EKSCluster', 'property': 'id'},
-    'elasticache:cluster': {'label': 'ElasticacheCluster', 'property': 'arn'},
-    'elasticloadbalancing:loadbalancer': {
-        'label': 'LoadBalancer', 'property':
-        'name', 'id_func': get_short_id_from_elb_arn,
+    "autoscaling:autoScalingGroup": {"label": "AutoScalingGroup", "property": "arn"},
+    "dynamodb:table": {"label": "DynamoDBTable", "property": "id"},
+    "ec2:instance": {
+        "label": "EC2Instance",
+        "property": "id",
+        "id_func": get_short_id_from_ec2_arn,
+    },
+    "ec2:internet-gateway": {
+        "label": "AWSInternetGateway",
+        "property": "id",
+        "id_func": get_short_id_from_ec2_arn,
+    },
+    "ec2:key-pair": {"label": "EC2KeyPair", "property": "id"},
+    "ec2:network-interface": {
+        "label": "NetworkInterface",
+        "property": "id",
+        "id_func": get_short_id_from_ec2_arn,
     },
-    'elasticloadbalancing:loadbalancer/app': {
-        'label': 'LoadBalancerV2',
-        'property': 'name', 'id_func': get_short_id_from_lb2_arn,
+    "ecr:repository": {"label": "ECRRepository", "property": "id"},
+    "ec2:security-group": {
+        "label": "EC2SecurityGroup",
+        "property": "id",
+        "id_func": get_short_id_from_ec2_arn,
     },
-    'elasticloadbalancing:loadbalancer/net': {
-        'label': 'LoadBalancerV2',
-        'property': 'name', 'id_func': get_short_id_from_lb2_arn,
+    "ec2:subnet": {
+        "label": "EC2Subnet",
+        "property": "subnetid",
+        "id_func": get_short_id_from_ec2_arn,
     },
-    'elasticmapreduce:cluster': {'label': 'EMRCluster', 'property': 'arn'},
-    'es:domain': {'label': 'ESDomain', 'property': 'arn'},
-    'kms:key': {'label': 'KMSKey', 'property': 'arn'},
-    'iam:group': {'label': 'AWSGroup', 'property': 'arn'},
-    'iam:role': {'label': 'AWSRole', 'property': 'arn'},
-    'iam:user': {'label': 'AWSUser', 'property': 'arn'},
-    'lambda:function': {'label': 'AWSLambda', 'property': 'id'},
-    'redshift:cluster': {'label': 'RedshiftCluster', 'property': 'id'},
-    'rds:db': {'label': 'RDSInstance', 'property': 'id'},
-    'rds:subgrp': {'label': 'DBSubnetGroup', 'property': 'id'},
-    'rds:cluster': {'label': 'RDSCluster', 'property': 'id'},
-    'rds:snapshot': {'label': 'RDSSnapshot', 'property': 'id'},
+    "ec2:transit-gateway": {"label": "AWSTransitGateway", "property": "id"},
+    "ec2:transit-gateway-attachment": {
+        "label": "AWSTransitGatewayAttachment",
+        "property": "id",
+    },
+    "ec2:vpc": {
+        "label": "AWSVpc",
+        "property": "id",
+        "id_func": get_short_id_from_ec2_arn,
+    },
+    "ec2:volume": {
+        "label": "EBSVolume",
+        "property": "id",
+        "id_func": get_short_id_from_ec2_arn,
+    },
+    "ec2:elastic-ip-address": {
+        "label": "ElasticIPAddress",
+        "property": "id",
+        "id_func": get_short_id_from_ec2_arn,
+    },
+    "ecs:cluster": {"label": "ECSCluster", "property": "id"},
+    "ecs:container": {"label": "ECSContainer", "property": "id"},
+    "ecs:container-instance": {"label": "ECSContainerInstance", "property": "id"},
+    "ecs:task": {"label": "ECSTask", "property": "id"},
+    "ecs:task-definition": {"label": "ECSTaskDefinition", "property": "id"},
+    "eks:cluster": {"label": "EKSCluster", "property": "id"},
+    "elasticache:cluster": {"label": "ElasticacheCluster", "property": "arn"},
+    "elasticloadbalancing:loadbalancer": {
+        "label": "LoadBalancer",
+        "property": "name",
+        "id_func": get_short_id_from_elb_arn,
+    },
+    "elasticloadbalancing:loadbalancer/app": {
+        "label": "LoadBalancerV2",
+        "property": "name",
+        "id_func": get_short_id_from_lb2_arn,
+    },
+    "elasticloadbalancing:loadbalancer/net": {
+        "label": "LoadBalancerV2",
+        "property": "name",
+        "id_func": get_short_id_from_lb2_arn,
+    },
+    "elasticmapreduce:cluster": {"label": "EMRCluster", "property": "arn"},
+    "es:domain": {"label": "ESDomain", "property": "arn"},
+    "kms:key": {"label": "KMSKey", "property": "arn"},
+    "iam:group": {"label": "AWSGroup", "property": "arn"},
+    "iam:role": {"label": "AWSRole", "property": "arn"},
+    "iam:user": {"label": "AWSUser", "property": "arn"},
+    "lambda:function": {"label": "AWSLambda", "property": "id"},
+    "redshift:cluster": {"label": "RedshiftCluster", "property": "id"},
+    "rds:db": {"label": "RDSInstance", "property": "id"},
+    "rds:subgrp": {"label": "DBSubnetGroup", "property": "id"},
+    "rds:cluster": {"label": "RDSCluster", "property": "id"},
+    "rds:snapshot": {"label": "RDSSnapshot", "property": "id"},
     # Buckets are the only objects in the S3 service: https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-arn-format.html
-    's3': {'label': 'S3Bucket', 'property': 'id', 'id_func': get_bucket_name_from_arn},
-    'secretsmanager:secret': {'label': 'SecretsManagerSecret', 'property': 'id'},
-    'sqs': {'label': 'SQSQueue', 'property': 'id'},
+    "s3": {"label": "S3Bucket", "property": "id", "id_func": get_bucket_name_from_arn},
+    "secretsmanager:secret": {"label": "SecretsManagerSecret", "property": "id"},
+    "sqs": {"label": "SQSQueue", "property": "id"},
 }
 
 
 @timeit
 @aws_handle_regions
-def get_tags(boto3_session: boto3.session.Session, resource_type: str, region: str) -> List[Dict]:
-    """
-    Create boto3 client and retrieve tag data.
-    """
-    # this is a temporary workaround to populate AWS tags for IAM roles.
-    # resourcegroupstaggingapi does not support IAM roles and no ETA is provided
-    # TODO: when resourcegroupstaggingapi supports iam:role, remove this condition block
-    if resource_type == 'iam:role':
-        return get_role_tags(boto3_session)
-
-    client = boto3_session.client('resourcegroupstaggingapi', region_name=region)
-    paginator = client.get_paginator('get_resources')
-    resources: List[Dict] = []
-    for page in paginator.paginate(
-        # Only ingest tags for resources that Cartography supports.
-        # This is just a starting list; there may be others supported by this API.
-        ResourceTypeFilters=[resource_type],
-    ):
-        resources.extend(page['ResourceTagMappingList'])
+def get_tags(
+    boto3_session: boto3.session.Session,
+    resource_types: list[str],
+    region: str,
+) -> list[dict[str, Any]]:
+    """Retrieve tag data for the provided resource types."""
+    resources: list[dict[str, Any]] = []
+
+    if "iam:role" in resource_types:
+        resources.extend(get_role_tags(boto3_session))
+        resource_types = [rt for rt in resource_types if rt != "iam:role"]
+
+    if not resource_types:
+        return resources
+
+    client = boto3_session.client("resourcegroupstaggingapi", region_name=region)
+    paginator = client.get_paginator("get_resources")
+
+    # Batch resource types into groups of 100
+    # (https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetResources.html)
+    for resource_types_batch in batch(resource_types, size=100):
+        for page in paginator.paginate(ResourceTypeFilters=resource_types_batch):
+            resources.extend(page["ResourceTagMappingList"])
     return resources
 
 
@@ -148,7 +220,8 @@ def _load_tags_tx(
     current_aws_account_id: str,
     aws_update_tag: int,
 ) -> None:
-    INGEST_TAG_TEMPLATE = Template("""
+    INGEST_TAG_TEMPLATE = Template(
+        """
     UNWIND $TagData as tag_mapping
         UNWIND tag_mapping.Tags as input_tag
             MATCH
@@ -165,10 +238,14 @@ def _load_tags_tx(
             MERGE (resource)-[r:TAGGED]->(aws_tag)
             SET r.lastupdated = $UpdateTag,
             r.firstseen = timestamp()
-    """)
+    """,
+    )
+    if not tag_data:
+        return
+
     query = INGEST_TAG_TEMPLATE.safe_substitute(
-        resource_label=TAG_RESOURCE_TYPE_MAPPINGS[resource_type]['label'],
-        property=TAG_RESOURCE_TYPE_MAPPINGS[resource_type]['property'],
+        resource_label=TAG_RESOURCE_TYPE_MAPPINGS[resource_type]["label"],
+        property=TAG_RESOURCE_TYPE_MAPPINGS[resource_type]["property"],
     )
     tx.run(
         query,
@@ -176,7 +253,7 @@ def _load_tags_tx(
         UpdateTag=aws_update_tag,
         Region=region,
         Account=current_aws_account_id,
-    )
+    ).consume()
 
 
 @timeit
@@ -188,6 +265,9 @@ def load_tags(
     current_aws_account_id: str,
     aws_update_tag: int,
 ) -> None:
+    if len(tag_data) == 0:
+        # If there is no data to load, save some time.
+        return
     for tag_data_batch in batch(tag_data, size=100):
         neo4j_session.write_transaction(
             _load_tags_tx,
@@ -202,20 +282,46 @@ def load_tags(
 @timeit
 def transform_tags(tag_data: Dict, resource_type: str) -> None:
     for tag_mapping in tag_data:
-        tag_mapping['resource_id'] = compute_resource_id(tag_mapping, resource_type)
+        tag_mapping["resource_id"] = compute_resource_id(tag_mapping, resource_type)
 
 
 def compute_resource_id(tag_mapping: Dict, resource_type: str) -> str:
-    resource_id = tag_mapping['ResourceARN']
-    if 'id_func' in TAG_RESOURCE_TYPE_MAPPINGS[resource_type]:
-        parse_resource_id_from_arn = TAG_RESOURCE_TYPE_MAPPINGS[resource_type]['id_func']
-        resource_id = parse_resource_id_from_arn(tag_mapping['ResourceARN'])
+    resource_id = tag_mapping["ResourceARN"]
+    if "id_func" in TAG_RESOURCE_TYPE_MAPPINGS[resource_type]:
+        parse_resource_id_from_arn = TAG_RESOURCE_TYPE_MAPPINGS[resource_type][
+            "id_func"
+        ]
+        resource_id = parse_resource_id_from_arn(tag_mapping["ResourceARN"])
     return resource_id
 
 
+def _group_tag_data_by_resource_type(
+    tag_data: List[Dict],
+    tag_resource_type_mappings: Dict,
+) -> Dict[str, List[Dict]]:
+    """Group raw tag data by the resource types Cartography supports."""
+
+    grouped: Dict[str, List[Dict]] = {rtype: [] for rtype in tag_resource_type_mappings}
+    for mapping in tag_data:
+        rtype = get_resource_type_from_arn(mapping["ResourceARN"])
+        if rtype in grouped:
+            grouped[rtype].append(mapping)
+        else:
+            logger.debug(
+                "Unknown tag resource type %s from ARN %s",
+                rtype,
+                mapping["ResourceARN"],
+            )
+    return grouped
+
+
 @timeit
 def cleanup(neo4j_session: neo4j.Session, common_job_parameters: Dict) -> None:
-    run_cleanup_job('aws_import_tags_cleanup.json', neo4j_session, common_job_parameters)
+    run_cleanup_job(
+        "aws_import_tags_cleanup.json",
+        neo4j_session,
+        common_job_parameters,
+    )
 
 
 @timeit
@@ -229,11 +335,21 @@ def sync(
     tag_resource_type_mappings: Dict = TAG_RESOURCE_TYPE_MAPPINGS,
 ) -> None:
     for region in regions:
-        logger.info(f"Syncing AWS tags for account {current_aws_account_id} and region {region}")
+        logger.info(
+            f"Syncing AWS tags for account {current_aws_account_id} and region {region}",
+        )
+        all_tag_data = get_tags(
+            boto3_session, list(tag_resource_type_mappings.keys()), region
+        )
+        grouped = _group_tag_data_by_resource_type(
+            all_tag_data, tag_resource_type_mappings
+        )
         for resource_type in tag_resource_type_mappings.keys():
-            tag_data = get_tags(boto3_session, resource_type, region)
+            tag_data = grouped.get(resource_type, [])
             transform_tags(tag_data, resource_type)  # type: ignore
-            logger.info(f"Loading {len(tag_data)} tags for resource type {resource_type}")
+            logger.info(
+                f"Loading {len(tag_data)} tags for resource type {resource_type}",
+            )
             load_tags(
                 neo4j_session=neo4j_session,
                 tag_data=tag_data,  # type: ignore