cartography 0.93.0rc1__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/intel/aws/s3.py

@@ -16,7 +16,9 @@ from botocore.exceptions import ClientError
 from botocore.exceptions import EndpointConnectionError
 from policyuniverse.policy import Policy
 
+from cartography.client.core.tx import run_write_query
 from cartography.stats import get_stats_client
+from cartography.util import aws_handle_regions
 from cartography.util import merge_module_sync_metadata
 from cartography.util import run_analysis_job
 from cartography.util import run_cleanup_job
@@ -30,16 +32,20 @@ stat_handler = get_stats_client(__name__)
 
 @timeit
 def get_s3_bucket_list(boto3_session: boto3.session.Session) -> List[Dict]:
-    client = boto3_session.client('s3')
+    client = boto3_session.client("s3")
     # NOTE no paginator available for this operation
     buckets = client.list_buckets()
-    for bucket in buckets['Buckets']:
+    for bucket in buckets["Buckets"]:
         try:
-            bucket['Region'] = client.get_bucket_location(Bucket=bucket['Name'])['LocationConstraint']
+            bucket["Region"] = client.get_bucket_location(Bucket=bucket["Name"])[
+                "LocationConstraint"
+            ]
         except ClientError as e:
             if _is_common_exception(e, bucket):
-                bucket['Region'] = None
-                logger.warning("skipping bucket='{}' due to exception.".format(bucket['Name']))
+                bucket["Region"] = None
+                logger.warning(
+                    "skipping bucket='{}' due to exception.".format(bucket["Name"]),
+                )
                 continue
             else:
                 raise
@@ -48,9 +54,9 @@ def get_s3_bucket_list(boto3_session: boto3.session.Session) -> List[Dict]:
 
 @timeit
 def get_s3_bucket_details(
-        boto3_session: boto3.session.Session,
-        bucket_data: Dict,
-) -> Generator[Tuple[str, Dict, Dict, Dict, Dict, Dict], None, None]:
+    boto3_session: boto3.session.Session,
+    bucket_data: Dict,
+) -> Generator[Tuple[str, Dict, Dict, Dict, Dict, Dict, Dict], None, None]:
     """
     Iterates over all S3 buckets. Yields bucket name (string), S3 bucket policies (JSON), ACLs (JSON),
     default encryption policy (JSON), Versioning (JSON), and Public Access Block (JSON)
@@ -58,32 +64,56 @@ def get_s3_bucket_details(
     # a local store for s3 clients so that we may re-use clients for an AWS region
     s3_regional_clients: Dict[Any, Any] = {}
 
-    BucketDetail = Tuple[str, Dict[str, Any], Dict[str, Any], Dict[str, Any], Dict[str, Any], Dict[str, Any]]
+    BucketDetail = Tuple[
+        str,
+        Dict[str, Any],
+        Dict[str, Any],
+        Dict[str, Any],
+        Dict[str, Any],
+        Dict[str, Any],
+        Dict[str, Any],
+        Dict[str, Any],
+    ]
 
     async def _get_bucket_detail(bucket: Dict[str, Any]) -> BucketDetail:
         # Note: bucket['Region'] is sometimes None because
         # client.get_bucket_location() does not return a location constraint for buckets
         # in us-east-1 region
-        client = s3_regional_clients.get(bucket['Region'])
+        client = s3_regional_clients.get(bucket["Region"])
         if not client:
-            client = boto3_session.client('s3', bucket['Region'])
-            s3_regional_clients[bucket['Region']] = client
+            client = boto3_session.client("s3", bucket["Region"])
+            s3_regional_clients[bucket["Region"]] = client
         (
             acl,
             policy,
             encryption,
             versioning,
             public_access_block,
+            bucket_ownership_controls,
+            bucket_logging,
         ) = await asyncio.gather(
             to_asynchronous(get_acl, bucket, client),
             to_asynchronous(get_policy, bucket, client),
             to_asynchronous(get_encryption, bucket, client),
             to_asynchronous(get_versioning, bucket, client),
             to_asynchronous(get_public_access_block, bucket, client),
+            to_asynchronous(get_bucket_ownership_controls, bucket, client),
+            to_asynchronous(get_bucket_logging, bucket, client),
+        )
+        return (
+            bucket["Name"],
+            acl,
+            policy,
+            encryption,
+            versioning,
+            public_access_block,
+            bucket_ownership_controls,
+            bucket_logging,
         )
-        return bucket['Name'], acl, policy, encryption, versioning, public_access_block
 
-    bucket_details = to_synchronous(*[_get_bucket_detail(bucket) for bucket in bucket_data['Buckets']])
+    bucket_details = to_synchronous(
+        *[_get_bucket_detail(bucket) for bucket in bucket_data["Buckets"]],
+    )
     yield from bucket_details
 
 
@@ -94,7 +124,7 @@ def get_policy(bucket: Dict, client: botocore.client.BaseClient) -> Optional[Dic
     """
     policy = None
     try:
-        policy = client.get_bucket_policy(Bucket=bucket['Name'])
+        policy = client.get_bucket_policy(Bucket=bucket["Name"])
     except ClientError as e:
         if _is_common_exception(e, bucket):
             pass
@@ -114,7 +144,7 @@ def get_acl(bucket: Dict, client: botocore.client.BaseClient) -> Optional[Dict]:
     """
     acl = None
     try:
-        acl = client.get_bucket_acl(Bucket=bucket['Name'])
+        acl = client.get_bucket_acl(Bucket=bucket["Name"])
     except ClientError as e:
         if _is_common_exception(e, bucket):
             pass
@@ -134,7 +164,7 @@ def get_encryption(bucket: Dict, client: botocore.client.BaseClient) -> Optional
     """
     encryption = None
     try:
-        encryption = client.get_bucket_encryption(Bucket=bucket['Name'])
+        encryption = client.get_bucket_encryption(Bucket=bucket["Name"])
     except ClientError as e:
         if _is_common_exception(e, bucket):
             pass
@@ -154,7 +184,7 @@ def get_versioning(bucket: Dict, client: botocore.client.BaseClient) -> Optional
     """
     versioning = None
     try:
-        versioning = client.get_bucket_versioning(Bucket=bucket['Name'])
+        versioning = client.get_bucket_versioning(Bucket=bucket["Name"])
     except ClientError as e:
         if _is_common_exception(e, bucket):
             pass
@@ -168,13 +198,16 @@ def get_versioning(bucket: Dict, client: botocore.client.BaseClient) -> Optional
 
 
 @timeit
-def get_public_access_block(bucket: Dict, client: botocore.client.BaseClient) -> Optional[Dict]:
+def get_public_access_block(
+    bucket: Dict,
+    client: botocore.client.BaseClient,
+) -> Optional[Dict]:
     """
     Gets the S3 bucket public access block configuration.
     """
     public_access_block = None
     try:
-        public_access_block = client.get_public_access_block(Bucket=bucket['Name'])
+        public_access_block = client.get_public_access_block(Bucket=bucket["Name"])
     except ClientError as e:
         if _is_common_exception(e, bucket):
             pass
@@ -188,6 +221,54 @@ def get_public_access_block(bucket: Dict, client: botocore.client.BaseClient) ->
     return public_access_block
 
 
+@timeit
+def get_bucket_ownership_controls(
+    bucket: Dict, client: botocore.client.BaseClient
+) -> Optional[Dict]:
+    """
+    Gets the S3 object ownership controls configuration.
+    """
+    bucket_ownership_controls = None
+    try:
+        bucket_ownership_controls = client.get_bucket_ownership_controls(
+            Bucket=bucket["Name"]
+        )
+    except ClientError as e:
+        if _is_common_exception(e, bucket):
+            pass
+        else:
+            raise
+    except EndpointConnectionError:
+        logger.warning(
+            f"Failed to retrieve S3 bucket ownership controls for {bucket['Name']}"
+            " - Could not connect to the endpoint URL",
+        )
+    return bucket_ownership_controls
+
+
+@timeit
+@aws_handle_regions
+def get_bucket_logging(
+    bucket: Dict, client: botocore.client.BaseClient
+) -> Optional[Dict]:
+    """
+    Gets the S3 bucket logging status configuration.
+    """
+    bucket_logging = None
+    try:
+        bucket_logging = client.get_bucket_logging(Bucket=bucket["Name"])
+    except ClientError as e:
+        if _is_common_exception(e, bucket):
+            pass
+        else:
+            raise
+    except EndpointConnectionError:
+        logger.warning(
+            f"Failed to retrieve S3 bucket logging status for {bucket['Name']} - Could not connect to the endpoint URL",
+        )
+    return bucket_logging
+
+
 @timeit
 def _is_common_exception(e: Exception, bucket: Dict) -> bool:
     error_msg = "Failed to retrieve S3 bucket detail"
@@ -207,26 +288,37 @@ def _is_common_exception(e: Exception, bucket: Dict) -> bool:
         logger.warning(f"{error_msg} for {bucket['Name']} - EndpointConnectionError")
         return True
     elif "ServerSideEncryptionConfigurationNotFoundError" in e.args[0]:
-        logger.warning(f"{error_msg} for {bucket['Name']} - ServerSideEncryptionConfigurationNotFoundError")
+        logger.warning(
+            f"{error_msg} for {bucket['Name']} - ServerSideEncryptionConfigurationNotFoundError",
+        )
         return True
     elif "InvalidToken" in e.args[0]:
         logger.warning(f"{error_msg} for {bucket['Name']} - InvalidToken")
         return True
     elif "NoSuchPublicAccessBlockConfiguration" in e.args[0]:
-        logger.warning(f"{error_msg} for {bucket['Name']} - NoSuchPublicAccessBlockConfiguration")
+        logger.warning(
+            f"{error_msg} for {bucket['Name']} - NoSuchPublicAccessBlockConfiguration",
+        )
         return True
     elif "IllegalLocationConstraintException" in e.args[0]:
-        logger.warning(f"{error_msg} for {bucket['Name']} - IllegalLocationConstraintException")
+        logger.warning(
+            f"{error_msg} for {bucket['Name']} - IllegalLocationConstraintException",
+        )
+        return True
+    elif "OwnershipControlsNotFoundError" in e.args[0]:
+        logger.warning(
+            f"{error_msg} for {bucket['Name']} - OwnershipControlsNotFoundError"
+        )
         return True
     return False
 
 
 @timeit
 def _load_s3_acls(
-        neo4j_session: neo4j.Session,
-        acls: List[Dict[str, Any]],
-        aws_account_id: str,
-        update_tag: int,
+    neo4j_session: neo4j.Session,
+    acls: List[Dict[str, Any]],
+    aws_account_id: str,
+    update_tag: int,
 ) -> None:
     """
     Ingest S3 ACL into neo4j.
@@ -243,7 +335,8 @@ def _load_s3_acls(
     SET r.lastupdated = $UpdateTag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_acls,
         acls=acls,
         UpdateTag=update_tag,
@@ -252,14 +345,19 @@ def _load_s3_acls(
     # implement the acl permission
     # https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions
     run_analysis_job(
-        'aws_s3acl_analysis.json',
+        "aws_s3acl_analysis.json",
         neo4j_session,
-        {'AWS_ID': aws_account_id},
+        {"AWS_ID": aws_account_id},
+        package="cartography.data.jobs.scoped_analysis",
     )
 
 
 @timeit
-def _load_s3_policies(neo4j_session: neo4j.Session, policies: List[Dict], update_tag: int) -> None:
+def _load_s3_policies(
+    neo4j_session: neo4j.Session,
+    policies: List[Dict],
+    update_tag: int,
+) -> None:
     """
     Ingest S3 policy results into neo4j.
     """
@@ -272,7 +370,8 @@ def _load_s3_policies(neo4j_session: neo4j.Session, policies: List[Dict], update
     s.lastupdated = $UpdateTag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_policies,
         policies=policies,
         UpdateTag=update_tag,
@@ -281,7 +380,9 @@ def _load_s3_policies(neo4j_session: neo4j.Session, policies: List[Dict], update
 
 @timeit
 def _load_s3_policy_statements(
-    neo4j_session: neo4j.Session, statements: List[Dict], update_tag: int,
+    neo4j_session: neo4j.Session,
+    statements: List[Dict],
+    update_tag: int,
 ) -> None:
     ingest_policy_statement = """
         UNWIND $Statements as statement_data
@@ -303,15 +404,20 @@ def _load_s3_policy_statements(
         MERGE (bucket)-[r:POLICY_STATEMENT]->(statement)
         SET r.lastupdated = $UpdateTag
         """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_policy_statement,
         Statements=statements,
         UpdateTag=update_tag,
-    ).consume()
+    )
 
 
 @timeit
-def _load_s3_encryption(neo4j_session: neo4j.Session, encryption_configs: List[Dict], update_tag: int) -> None:
+def _load_s3_encryption(
+    neo4j_session: neo4j.Session,
+    encryption_configs: List[Dict],
+    update_tag: int,
+) -> None:
     """
     Ingest S3 default encryption results into neo4j.
     """
@@ -325,7 +431,8 @@ def _load_s3_encryption(neo4j_session: neo4j.Session, encryption_configs: List[D
     s.lastupdated = $UpdateTag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_encryption,
         encryption_configs=encryption_configs,
         UpdateTag=update_tag,
@@ -333,7 +440,11 @@ def _load_s3_encryption(neo4j_session: neo4j.Session, encryption_configs: List[D
 
 
 @timeit
-def _load_s3_versioning(neo4j_session: neo4j.Session, versioning_configs: List[Dict], update_tag: int) -> None:
+def _load_s3_versioning(
+    neo4j_session: neo4j.Session,
+    versioning_configs: List[Dict],
+    update_tag: int,
+) -> None:
     """
     Ingest S3 versioning results into neo4j.
     """
@@ -345,7 +456,8 @@ def _load_s3_versioning(neo4j_session: neo4j.Session, versioning_configs: List[D
         s.lastupdated = $UpdateTag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_versioning,
         versioning_configs=versioning_configs,
         UpdateTag=update_tag,
@@ -371,19 +483,70 @@ def _load_s3_public_access_block(
         s.lastupdated = $UpdateTag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_public_access_block,
         public_access_block_configs=public_access_block_configs,
         UpdateTag=update_tag,
     )
 
 
+@timeit
+def _load_bucket_ownership_controls(
+    neo4j_session: neo4j.Session,
+    bucket_ownership_controls_configs: List[Dict],
+    update_tag: int,
+) -> None:
+    """
+    Ingest S3 BucketOwnershipControls results into neo4j.
+    """
+    ingest_bucket_ownership_controls = """
+    UNWIND $bucket_ownership_controls_configs AS bucket_ownership_controls
+    MATCH (s:S3Bucket) where s.name = bucket_ownership_controls.bucket
+    SET s.object_ownership = bucket_ownership_controls.object_ownership,
+        s.lastupdated = $UpdateTag
+    """
+
+    run_write_query(
+        neo4j_session,
+        ingest_bucket_ownership_controls,
+        bucket_ownership_controls_configs=bucket_ownership_controls_configs,
+        UpdateTag=update_tag,
+    )
+
+
+@timeit
+def _load_bucket_logging(
+    neo4j_session: neo4j.Session,
+    bucket_logging_configs: List[Dict],
+    update_tag: int,
+) -> None:
+    """
+    Ingest S3 bucket logging status configuration into neo4j.
+    """
+    # Load basic logging status
+    ingest_bucket_logging = """
+    UNWIND $bucket_logging_configs AS bucket_logging
+    MATCH (bucket:S3Bucket{name: bucket_logging.bucket})
+    SET bucket.logging_enabled = bucket_logging.logging_enabled,
+        bucket.logging_target_bucket = bucket_logging.target_bucket,
+        bucket.lastupdated = $update_tag
+    """
+    run_write_query(
+        neo4j_session,
+        ingest_bucket_logging,
+        bucket_logging_configs=bucket_logging_configs,
+        update_tag=update_tag,
+    )
+
+
 def _set_default_values(neo4j_session: neo4j.Session, aws_account_id: str) -> None:
     set_defaults = """
     MATCH (:AWSAccount{id: $AWS_ID})-[:RESOURCE]->(s:S3Bucket) where s.anonymous_actions IS NULL
     SET s.anonymous_access = false, s.anonymous_actions = []
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         set_defaults,
         AWS_ID=aws_account_id,
     )
@@ -392,7 +555,8 @@ def _set_default_values(neo4j_session: neo4j.Session, aws_account_id: str) -> No
     MATCH (:AWSAccount{id: $AWS_ID})-[:RESOURCE]->(s:S3Bucket) where s.default_encryption IS NULL
     SET s.default_encryption = false
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         set_encryption_defaults,
         AWS_ID=aws_account_id,
     )
@@ -400,7 +564,9 @@ def _set_default_values(neo4j_session: neo4j.Session, aws_account_id: str) -> No
 
 @timeit
 def load_s3_details(
-    neo4j_session: neo4j.Session, s3_details_iter: Generator[Any, Any, Any], aws_account_id: str,
+    neo4j_session: neo4j.Session,
+    s3_details_iter: Generator[Any, Any, Any],
+    aws_account_id: str,
     update_tag: int,
 ) -> None:
     """
@@ -412,7 +578,18 @@ def load_s3_details(
     encryption_configs: List[Dict] = []
     versioning_configs: List[Dict] = []
     public_access_block_configs: List[Dict] = []
-    for bucket, acl, policy, encryption, versioning, public_access_block in s3_details_iter:
+    bucket_ownership_controls_configs: List[Dict] = []
+    bucket_logging_configs: List[Dict] = []
+    for (
+        bucket,
+        acl,
+        policy,
+        encryption,
+        versioning,
+        public_access_block,
+        bucket_ownership_controls,
+        bucket_logging,
+    ) in s3_details_iter:
         parsed_acls = parse_acl(acl, bucket, aws_account_id)
         if parsed_acls is not None:
             acls.extend(parsed_acls)
@@ -428,15 +605,26 @@ def load_s3_details(
         parsed_versioning = parse_versioning(bucket, versioning)
         if parsed_versioning is not None:
             versioning_configs.append(parsed_versioning)
-        parsed_public_access_block = parse_public_access_block(bucket, public_access_block)
+        parsed_public_access_block = parse_public_access_block(
+            bucket,
+            public_access_block,
+        )
         if parsed_public_access_block is not None:
             public_access_block_configs.append(parsed_public_access_block)
+        parsed_bucket_ownership_controls = parse_bucket_ownership_controls(
+            bucket, bucket_ownership_controls
+        )
+        if parsed_bucket_ownership_controls is not None:
+            bucket_ownership_controls_configs.append(parsed_bucket_ownership_controls)
+        parsed_bucket_logging = parse_bucket_logging(bucket, bucket_logging)
+        if parsed_bucket_logging is not None:
+            bucket_logging_configs.append(parsed_bucket_logging)
 
     # cleanup existing policy properties set on S3 Buckets
     run_cleanup_job(
-        'aws_s3_details.json',
+        "aws_s3_details.json",
         neo4j_session,
-        {'UPDATE_TAG': update_tag, 'AWS_ID': aws_account_id},
+        {"UPDATE_TAG": update_tag, "AWS_ID": aws_account_id},
     )
 
     _load_s3_acls(neo4j_session, acls, aws_account_id, update_tag)
@@ -446,6 +634,10 @@ def load_s3_details(
     _load_s3_encryption(neo4j_session, encryption_configs, update_tag)
     _load_s3_versioning(neo4j_session, versioning_configs, update_tag)
     _load_s3_public_access_block(neo4j_session, public_access_block_configs, update_tag)
+    _load_bucket_ownership_controls(
+        neo4j_session, bucket_ownership_controls_configs, update_tag
+    )
+    _load_bucket_logging(neo4j_session, bucket_logging_configs, update_tag)
     _set_default_values(neo4j_session, aws_account_id)
 
 
@@ -492,7 +684,7 @@ def parse_policy(bucket: str, policyDict: Optional[Dict]) -> Optional[Dict]:
     if policyDict is None:
         return None
     # get just the policy element and convert to JSON because boto3 returns this as string
-    policy = Policy(json.loads(policyDict['Policy']))
+    policy = Policy(json.loads(policyDict["Policy"]))
     if policy.is_internet_accessible():
         return {
             "bucket": bucket,
@@ -512,7 +704,7 @@ def parse_policy_statements(bucket: str, policyDict: Policy) -> List[Dict]:
     if policyDict is None:
         return None
 
-    policy = json.loads(policyDict['Policy'])
+    policy = json.loads(policyDict["Policy"])
     statements = []
     stmt_index = 1
     for s in policy["Statement"]:
@@ -544,8 +736,12 @@ def parse_policy_statements(bucket: str, policyDict: Policy) -> List[Dict]:
 
 
 @timeit
-def parse_acl(acl: Optional[Dict], bucket: str, aws_account_id: str) -> Optional[List[Dict]]:
-    """ Parses the AWS ACL object and returns a dict of the relevant data """
+def parse_acl(
+    acl: Optional[Dict],
+    bucket: str,
+    aws_account_id: str,
+) -> Optional[List[Dict]]:
+    """Parses the AWS ACL object and returns a dict of the relevant data"""
     # ACL JSON looks like
     # ...metadata...
     # {
@@ -570,47 +766,47 @@ def parse_acl(acl: Optional[Dict], bucket: str, aws_account_id: str) -> Optional
     if acl is None:
         return None
     acl_list: List[Dict] = []
-    for grant in acl['Grants']:
+    for grant in acl["Grants"]:
         parsed_acl = None
-        if grant['Grantee']['Type'] == 'CanonicalUser':
+        if grant["Grantee"]["Type"] == "CanonicalUser":
             parsed_acl = {
                 "bucket": bucket,
-                "owner": acl['Owner'].get('DisplayName'),
-                "ownerid": acl['Owner'].get('ID'),
-                "type": grant['Grantee']['Type'],
-                "displayname": grant['Grantee'].get('DisplayName'),
-                "granteeid": grant['Grantee'].get('ID'),
+                "owner": acl["Owner"].get("DisplayName"),
+                "ownerid": acl["Owner"].get("ID"),
+                "type": grant["Grantee"]["Type"],
+                "displayname": grant["Grantee"].get("DisplayName"),
+                "granteeid": grant["Grantee"].get("ID"),
                 "uri": None,
-                "permission": grant.get('Permission'),
+                "permission": grant.get("Permission"),
             }
-        elif grant['Grantee']['Type'] == 'Group':
+        elif grant["Grantee"]["Type"] == "Group":
             parsed_acl = {
                 "bucket": bucket,
-                "owner": acl['Owner'].get('DisplayName'),
-                "ownerid": acl['Owner'].get('ID'),
-                "type": grant['Grantee']['Type'],
+                "owner": acl["Owner"].get("DisplayName"),
+                "ownerid": acl["Owner"].get("ID"),
+                "type": grant["Grantee"]["Type"],
                 "displayname": None,
                 "granteeid": None,
-                "uri": grant['Grantee'].get('URI'),
-                "permission": grant.get('Permission'),
+                "uri": grant["Grantee"].get("URI"),
+                "permission": grant.get("Permission"),
             }
         else:
-            logger.warning("Unexpected grant type: %s", grant['Grantee']['Type'])
+            logger.warning("Unexpected grant type: %s", grant["Grantee"]["Type"])
             continue
 
         # TODO this can be replaced with a string join
         id_data = "{}:{}:{}:{}:{}:{}:{}:{}".format(
             aws_account_id,
-            parsed_acl['owner'],
-            parsed_acl['ownerid'],
-            parsed_acl['type'],
-            parsed_acl['displayname'],
-            parsed_acl['granteeid'],
-            parsed_acl['uri'],
-            parsed_acl['permission'],
+            parsed_acl["owner"],
+            parsed_acl["ownerid"],
+            parsed_acl["type"],
+            parsed_acl["displayname"],
+            parsed_acl["granteeid"],
+            parsed_acl["uri"],
+            parsed_acl["permission"],
         )
 
-        parsed_acl['id'] = hashlib.sha256(id_data.encode("utf8")).hexdigest()
+        parsed_acl["id"] = hashlib.sha256(id_data.encode("utf8")).hexdigest()
         acl_list.append(parsed_acl)
 
     return acl_list
@@ -618,7 +814,7 @@ def parse_acl(acl: Optional[Dict], bucket: str, aws_account_id: str) -> Optional
 
 @timeit
 def parse_encryption(bucket: str, encryption: Optional[Dict]) -> Optional[Dict]:
-    """ Parses the S3 default encryption object and returns a dict of the relevant data """
+    """Parses the S3 default encryption object and returns a dict of the relevant data"""
     # Encryption object JSON looks like:
     # {
     #     'ServerSideEncryptionConfiguration': {
@@ -635,27 +831,29 @@ def parse_encryption(bucket: str, encryption: Optional[Dict]) -> Optional[Dict]:
     # }
     if encryption is None:
         return None
-    _ssec = encryption.get('ServerSideEncryptionConfiguration', {})
+    _ssec = encryption.get("ServerSideEncryptionConfiguration", {})
     # Rules is a list, but only one rule ever exists
     try:
-        rule = _ssec.get('Rules', []).pop()
+        rule = _ssec.get("Rules", []).pop()
     except IndexError:
         return None
-    algorithm = rule.get('ApplyServerSideEncryptionByDefault', {}).get('SSEAlgorithm')
+    algorithm = rule.get("ApplyServerSideEncryptionByDefault", {}).get("SSEAlgorithm")
     if not algorithm:
         return None
     return {
         "bucket": bucket,
         "default_encryption": True,
         "encryption_algorithm": algorithm,
-        "encryption_key_id": rule.get("ApplyServerSideEncryptionByDefault", {}).get('KMSMasterKeyID'),
-        "bucket_key_enabled": rule.get('BucketKeyEnabled'),
+        "encryption_key_id": rule.get("ApplyServerSideEncryptionByDefault", {}).get(
+            "KMSMasterKeyID",
+        ),
+        "bucket_key_enabled": rule.get("BucketKeyEnabled"),
     }
 
 
 @timeit
 def parse_versioning(bucket: str, versioning: Optional[Dict]) -> Optional[Dict]:
-    """ Parses the S3 versioning object and returns a dict of the relevant data """
+    """Parses the S3 versioning object and returns a dict of the relevant data"""
     # Versioning object JSON looks like:
     # {
     #     'Status': 'Enabled'|'Suspended',
@@ -671,8 +869,11 @@ def parse_versioning(bucket: str, versioning: Optional[Dict]) -> Optional[Dict]:
 
 
 @timeit
-def parse_public_access_block(bucket: str, public_access_block: Optional[Dict]) -> Optional[Dict]:
-    """ Parses the S3 public access block object and returns a dict of the relevant data """
+def parse_public_access_block(
+    bucket: str,
+    public_access_block: Optional[Dict],
+) -> Optional[Dict]:
+    """Parses the S3 public access block object and returns a dict of the relevant data"""
     # Versioning object JSON looks like:
     # {
     #     'PublicAccessBlockConfiguration': {
@@ -695,7 +896,129 @@ def parse_public_access_block(bucket: str, public_access_block: Optional[Dict])
 
 
 @timeit
-def load_s3_buckets(neo4j_session: neo4j.Session, data: Dict, current_aws_account_id: str, aws_update_tag: int) -> None:
+def parse_bucket_ownership_controls(
+    bucket: str, bucket_ownership_controls: Optional[Dict]
+) -> Optional[Dict]:
+    """Parses the S3 bucket ownership controls object and returns a dict of the relevant data"""
+    # Versioning object JSON looks like:
+    # {
+    #     'OwnershipControls': {
+    #         'Rules': [
+    #             {
+    #                 'ObjectOwnership': 'BucketOwnerPreferred'|'ObjectWriter'|'BucketOwnerEnforced'
+    #             },
+    #         ]
+    #     }
+    # }
+    if bucket_ownership_controls is None:
+        return None
+    return {
+        "bucket": bucket,
+        "object_ownership": bucket_ownership_controls.get("OwnershipControls", {})
+        .get("Rules", [{}])[0]
+        .get("ObjectOwnership"),
+    }
+
+
+def parse_bucket_logging(bucket: str, bucket_logging: Optional[Dict]) -> Optional[Dict]:
+    """Parses the S3 bucket logging status configuration and returns a dict of the relevant data"""
+    # Logging status object JSON looks like:
+    # {
+    #     'LoggingEnabled': {
+    #         'TargetBucket': 'string',
+    #         'TargetGrants': [
+    #             {
+    #                 'Grantee': {
+    #                     'DisplayName': 'string',
+    #                     'EmailAddress': 'string',
+    #                     'ID': 'string',
+    #                     'Type': 'CanonicalUser'|'AmazonCustomerByEmail'|'Group',
+    #                     'URI': 'string'
+    #                 },
+    #                 'Permission': 'FULL_CONTROL'|'READ'|'WRITE'
+    #             },
+    #         ],
+    #         'TargetPrefix': 'string',
+    #         'TargetObjectKeyFormat': {
+    #             'SimplePrefix': {},
+    #             'PartitionedPrefix': {
+    #                 'PartitionDateSource': 'EventTime'|'DeliveryTime'
+    #             }
+    #         }
+    #     }
+    # }
+    # Or empty dict {} if logging is not enabled
+    if bucket_logging is None:
+        return None
+
+    logging_config = bucket_logging.get("LoggingEnabled", {})
+    if not logging_config:
+        return {
+            "bucket": bucket,
+            "logging_enabled": False,
+            "target_bucket": None,
+        }
+
+    return {
+        "bucket": bucket,
+        "logging_enabled": True,
+        "target_bucket": logging_config.get("TargetBucket"),
+    }
+
+
+@timeit
+def parse_notification_configuration(
+    bucket: str, notification_config: Optional[Dict]
+) -> List[Dict]:
+    """
+    Parse S3 bucket notification configuration to extract SNS topic notifications.
+    Returns a list of notification configurations.
+    """
+    if not notification_config or "TopicConfigurations" not in notification_config:
+        return []
+
+    notifications = []
+    for topic_config in notification_config.get("TopicConfigurations", []):
+        notification = {
+            "bucket": bucket,
+            "TopicArn": topic_config["TopicArn"],
+        }
+        notifications.append(notification)
+    return notifications
+
+
+@timeit
+def _load_s3_notifications(
+    neo4j_session: neo4j.Session,
+    notifications: List[Dict],
+    update_tag: int,
+) -> None:
+    """
+    Ingest S3 bucket to SNS topic notification relationships into neo4j.
+    """
+    ingest_notifications = """
+    UNWIND $notifications AS notification
+    MATCH (bucket:S3Bucket{name: notification.bucket})
+    MATCH (topic:SNSTopic{arn: notification.TopicArn})
+    MERGE (bucket)-[r:NOTIFIES]->(topic)
+    ON CREATE SET r.firstseen = timestamp()
+    SET r.lastupdated = $UpdateTag
+    """
+    run_write_query(
+        neo4j_session,
+        ingest_notifications,
+        notifications=notifications,
+        UpdateTag=update_tag,
+    )
+
+
+@timeit
+def load_s3_buckets(
+    neo4j_session: neo4j.Session,
+    data: Dict,
+    current_aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
     ingest_bucket = """
     MERGE (bucket:S3Bucket{id:$BucketName})
     ON CREATE SET bucket.firstseen = timestamp(), bucket.creationdate = $CreationDate
@@ -714,7 +1037,8 @@ def load_s3_buckets(neo4j_session: neo4j.Session, data: Dict, current_aws_accoun
 
     for bucket in data["Buckets"]:
         arn = "arn:aws:s3:::" + bucket["Name"]
-        neo4j_session.run(
+        run_write_query(
+            neo4j_session,
             ingest_bucket,
             BucketName=bucket["Name"],
             BucketRegion=bucket["Region"],
@@ -726,35 +1050,104 @@ def load_s3_buckets(neo4j_session: neo4j.Session, data: Dict, current_aws_accoun
 
 
 @timeit
-def cleanup_s3_buckets(neo4j_session: neo4j.Session, common_job_parameters: Dict) -> None:
-    run_cleanup_job('aws_import_s3_buckets_cleanup.json', neo4j_session, common_job_parameters)
+def cleanup_s3_buckets(
+    neo4j_session: neo4j.Session,
+    common_job_parameters: Dict,
+) -> None:
+    run_cleanup_job(
+        "aws_import_s3_buckets_cleanup.json",
+        neo4j_session,
+        common_job_parameters,
+    )
 
 
 @timeit
-def cleanup_s3_bucket_acl_and_policy(neo4j_session: neo4j.Session, common_job_parameters: Dict) -> None:
-    run_cleanup_job('aws_import_s3_acl_cleanup.json', neo4j_session, common_job_parameters)
+def cleanup_s3_bucket_acl_and_policy(
+    neo4j_session: neo4j.Session,
+    common_job_parameters: Dict,
+) -> None:
+    run_cleanup_job(
+        "aws_import_s3_acl_cleanup.json",
+        neo4j_session,
+        common_job_parameters,
+    )
+
+
+@timeit
+@aws_handle_regions
+def _sync_s3_notifications(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    bucket_data: Dict,
+    update_tag: int,
+) -> None:
+    """
+    Sync S3 bucket notification configurations to Neo4j.
+    """
+    logger.info("Syncing S3 bucket notifications")
+    s3_client = boto3_session.client("s3")
+    notifications = []
+
+    for bucket in bucket_data["Buckets"]:
+        try:
+            notification_config = s3_client.get_bucket_notification_configuration(
+                Bucket=bucket["Name"]
+            )
+            parsed_notifications = parse_notification_configuration(
+                bucket["Name"], notification_config
+            )
+            notifications.extend(parsed_notifications)
+            logger.debug(
+                f"Found {len(parsed_notifications)} notifications for bucket {bucket['Name']}"
+            )
+        except ClientError as e:
+            logger.warning(
+                f"Failed to retrieve notification configuration for bucket {bucket['Name']}: {e}"
+            )
+            continue
+
+    logger.info(f"Loading {len(notifications)} S3 bucket notifications into Neo4j")
+    _load_s3_notifications(neo4j_session, notifications, update_tag)
 
 
 @timeit
 def sync(
-    neo4j_session: neo4j.Session, boto3_session: boto3.session.Session, regions: List[str], current_aws_account_id: str,
-    update_tag: int, common_job_parameters: Dict,
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    regions: List[str],
+    current_aws_account_id: str,
+    update_tag: int,
+    common_job_parameters: Dict,
 ) -> None:
-    logger.info("Syncing S3 for account '%s'.", current_aws_account_id)
-    bucket_data = get_s3_bucket_list(boto3_session)
+    """
+    Sync S3 buckets and their configurations to Neo4j.
+    This includes:
+    1. Basic bucket information
+    2. ACLs and policies
+    3. Notification configurations
+    """
+    logger.info("Syncing S3 for account '%s'", current_aws_account_id)
 
+    bucket_data = get_s3_bucket_list(boto3_session)
     load_s3_buckets(neo4j_session, bucket_data, current_aws_account_id, update_tag)
     cleanup_s3_buckets(neo4j_session, common_job_parameters)
 
     acl_and_policy_data_iter = get_s3_bucket_details(boto3_session, bucket_data)
-    load_s3_details(neo4j_session, acl_and_policy_data_iter, current_aws_account_id, update_tag)
+    load_s3_details(
+        neo4j_session,
+        acl_and_policy_data_iter,
+        current_aws_account_id,
+        update_tag,
+    )
     cleanup_s3_bucket_acl_and_policy(neo4j_session, common_job_parameters)
 
+    _sync_s3_notifications(neo4j_session, boto3_session, bucket_data, update_tag)
+
     merge_module_sync_metadata(
         neo4j_session,
-        group_type='AWSAccount',
+        group_type="AWSAccount",
         group_id=current_aws_account_id,
-        synced_type='S3Bucket',
+        synced_type="S3Bucket",
         update_tag=update_tag,
         stat_handler=stat_handler,
     )