cartography 0.95.0__py3-none-any.whl → 0.96.0__py3-none-any.whl

cartography/intel/semgrep/dependencies.py

@@ -12,6 +12,7 @@ from requests.exceptions import ReadTimeout
 from cartography.client.core.tx import load
 from cartography.graph.job import GraphJob
 from cartography.models.semgrep.dependencies import SemgrepGoLibrarySchema
+from cartography.models.semgrep.dependencies import SemgrepNpmLibrarySchema
 from cartography.stats import get_stats_client
 from cartography.util import merge_module_sync_metadata
 from cartography.util import timeit
@@ -22,16 +23,38 @@ _PAGE_SIZE = 10000
 _TIMEOUT = (60, 60)
 _MAX_RETRIES = 3
 
+# The keys in this dictionary must be in Semgrep's list of supported ecosystems, defined here:
+# https://semgrep.dev/api/v1/docs/#tag/SupplyChainService/operation/semgrep_app.products.sca.handlers.dependency.list_dependencies_conexxion
+ECOSYSTEM_TO_SCHEMA: Dict = {
+    'gomod': SemgrepGoLibrarySchema,
+    'npm': SemgrepNpmLibrarySchema,
+}
+
+
+def parse_and_validate_semgrep_ecosystems(ecosystems: str) -> List[str]:
+    validated_ecosystems: List[str] = []
+    for ecosystem in ecosystems.split(','):
+        ecosystem = ecosystem.strip().lower()
+
+        if ecosystem in ECOSYSTEM_TO_SCHEMA:
+            validated_ecosystems.append(ecosystem)
+        else:
+            valid_ecosystems: str = ','.join(ECOSYSTEM_TO_SCHEMA.keys())
+            raise ValueError(
+                f'Error parsing `semgrep-dependency-ecosystems`. You specified "{ecosystems}". '
+                f'Please check that your input is formatted as comma-separated values, e.g. "gomod,npm". '
+                f'Full list of supported ecosystems: {valid_ecosystems}.',
+            )
+    return validated_ecosystems
+
 
 @timeit
-def get_dependencies(semgrep_app_token: str, deployment_id: str, ecosystems: List[str]) -> List[Dict[str, Any]]:
+def get_dependencies(semgrep_app_token: str, deployment_id: str, ecosystem: str) -> List[Dict[str, Any]]:
     """
-    Gets all dependencies for the given ecosystems within the given Semgrep deployment ID.
+    Gets all dependencies for the given ecosystem within the given Semgrep deployment ID.
     param: semgrep_app_token: The Semgrep App token to use for authentication.
     param: deployment_id: The Semgrep deployment ID to use for retrieving dependencies.
-    param: ecosystems: One or more ecosystems to import dependencies from, e.g. "gomod" or "pypi".
-    The list of supported ecosystems is defined here:
-    https://semgrep.dev/api/v1/docs/#tag/SupplyChainService/operation/semgrep_app.products.sca.handlers.dependency.list_dependencies_conexxion
+    param: ecosystem: The ecosystem to import dependencies from, e.g. "gomod" or "npm".
     """
     all_deps = []
     deps_url = f"https://semgrep.dev/api/v1/deployments/{deployment_id}/dependencies"
@@ -46,31 +69,31 @@ def get_dependencies(semgrep_app_token: str, deployment_id: str, ecosystems: Lis
     request_data: dict[str, Any] = {
         "pageSize": _PAGE_SIZE,
         "dependencyFilter": {
-            "ecosystem": ecosystems,
+            "ecosystem": [ecosystem],
         },
     }
 
-    logger.info(f"Retrieving Semgrep dependencies for deployment '{deployment_id}'.")
+    logger.info(f"Retrieving Semgrep {ecosystem} dependencies for deployment '{deployment_id}'.")
     while has_more:
         try:
             response = requests.post(deps_url, json=request_data, headers=headers, timeout=_TIMEOUT)
             response.raise_for_status()
             data = response.json()
         except (ReadTimeout, HTTPError):
-            logger.warning(f"Failed to retrieve Semgrep dependencies for page {page}. Retrying...")
+            logger.warning(f"Failed to retrieve Semgrep {ecosystem} dependencies for page {page}. Retrying...")
             retries += 1
             if retries >= _MAX_RETRIES:
                 raise
             continue
         deps = data.get("dependencies", [])
         has_more = data.get("hasMore", False)
-        logger.info(f"Processed page {page} of Semgrep dependencies.")
+        logger.info(f"Processed page {page} of Semgrep {ecosystem} dependencies.")
         all_deps.extend(deps)
         retries = 0
         page += 1
         request_data["cursor"] = data.get("cursor")
 
-    logger.info(f"Retrieved {len(all_deps)} Semgrep dependencies in {page} pages.")
+    logger.info(f"Retrieved {len(all_deps)} Semgrep {ecosystem} dependencies in {page} pages.")
     return all_deps
 
 
@@ -157,19 +180,18 @@ def load_dependencies(
 @timeit
 def cleanup(
     neo4j_session: neo4j.Session,
+    dependency_schema: Callable,
     common_job_parameters: Dict[str, Any],
 ) -> None:
-    logger.info("Running Semgrep Go Library cleanup job.")
-    go_libraries_cleanup_job = GraphJob.from_node_schema(
-        SemgrepGoLibrarySchema(), common_job_parameters,
-    )
-    go_libraries_cleanup_job.run(neo4j_session)
+    logger.info(f"Running Semgrep Dependencies cleanup job for {dependency_schema().label}.")
+    GraphJob.from_node_schema(dependency_schema(), common_job_parameters).run(neo4j_session)
 
 
 @timeit
 def sync_dependencies(
     neo4j_session: neo4j.Session,
     semgrep_app_token: str,
+    ecosystems_str: str,
     update_tag: int,
     common_job_parameters: Dict[str, Any],
 ) -> None:
@@ -177,19 +199,29 @@ def sync_dependencies(
     deployment_id = common_job_parameters.get("DEPLOYMENT_ID")
     if not deployment_id:
         logger.warning(
-            "Missing Semgrep deployment ID, ensure that sync_deployment() has been called."
+            "Missing Semgrep deployment ID, ensure that sync_deployment() has been called. "
             "Skipping Semgrep dependencies sync job.",
         )
         return
 
-    logger.info("Running Semgrep dependencies sync job.")
+    if not ecosystems_str:
+        logger.warning(
+            "Semgrep is not configured to import dependencies for any ecosystems, see docs to configure. "
+            "Skipping Semgrep dependencies sync job.",
+        )
+        return
+
+    # We don't expect an error here since we've already validated the input in cli.py
+    ecosystems = parse_and_validate_semgrep_ecosystems(ecosystems_str)
 
-    # fetch and load dependencies for the Go ecosystem
-    raw_go_deps = get_dependencies(semgrep_app_token, deployment_id, ecosystems=["gomod"])
-    go_deps = transform_dependencies(raw_go_deps)
-    load_dependencies(neo4j_session, SemgrepGoLibrarySchema, go_deps, deployment_id, update_tag)
+    logger.info("Running Semgrep dependencies sync job.")
 
-    cleanup(neo4j_session, common_job_parameters)
+    for ecosystem in ecosystems:
+        schema = ECOSYSTEM_TO_SCHEMA[ecosystem]
+        raw_deps = get_dependencies(semgrep_app_token, deployment_id, ecosystem)
+        deps = transform_dependencies(raw_deps)
+        load_dependencies(neo4j_session, schema, deps, deployment_id, update_tag)
+        cleanup(neo4j_session, schema, common_job_parameters)
 
     merge_module_sync_metadata(
         neo4j_session=neo4j_session,

cartography/models/aws/ec2/auto_scaling_groups.py

@@ -0,0 +1,204 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class AutoScalingGroupNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef('AutoScalingGroupARN')
+    arn: PropertyRef = PropertyRef('AutoScalingGroupARN')
+    capacityrebalance: PropertyRef = PropertyRef('CapacityRebalance')
+    createdtime: PropertyRef = PropertyRef('CreatedTime')
+    defaultcooldown: PropertyRef = PropertyRef('DefaultCooldown')
+    desiredcapacity: PropertyRef = PropertyRef('DesiredCapacity')
+    healthcheckgraceperiod: PropertyRef = PropertyRef('HealthCheckGracePeriod')
+    healthchecktype: PropertyRef = PropertyRef('HealthCheckType')
+    launchconfigurationname: PropertyRef = PropertyRef('LaunchConfigurationName')
+    launchtemplatename: PropertyRef = PropertyRef('LaunchTemplateName')
+    launchtemplateid: PropertyRef = PropertyRef('LaunchTemplateId')
+    launchtemplateversion: PropertyRef = PropertyRef('LaunchTemplateVersion')
+    maxinstancelifetime: PropertyRef = PropertyRef('MaxInstanceLifetime')
+    maxsize: PropertyRef = PropertyRef('MaxSize')
+    minsize: PropertyRef = PropertyRef('MinSize')
+    name: PropertyRef = PropertyRef('AutoScalingGroupName')
+    newinstancesprotectedfromscalein: PropertyRef = PropertyRef('NewInstancesProtectedFromScaleIn')
+    region: PropertyRef = PropertyRef('Region', set_in_kwargs=True)
+    status: PropertyRef = PropertyRef('Status')
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+# EC2 to AutoScalingGroup
+@dataclass(frozen=True)
+class EC2InstanceToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2InstanceToAWSAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: EC2InstanceToAwsAccountRelProperties = EC2InstanceToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class EC2InstanceToAutoScalingGroupRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2InstanceToAutoScalingGroup(CartographyRelSchema):
+    target_node_label: str = 'AutoScalingGroup'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AutoScalingGroupARN')},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "MEMBER_AUTO_SCALE_GROUP"
+    properties: EC2InstanceToAutoScalingGroupRelProperties = EC2InstanceToAutoScalingGroupRelProperties()
+
+
+@dataclass(frozen=True)
+class EC2InstanceAutoScalingGroupProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef('InstanceId')
+    instanceid: PropertyRef = PropertyRef('InstanceId', extra_index=True)
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+    region: PropertyRef = PropertyRef('Region', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2InstanceAutoScalingGroupSchema(CartographyNodeSchema):
+    label: str = 'EC2Instance'
+    properties: EC2InstanceAutoScalingGroupProperties = EC2InstanceAutoScalingGroupProperties()
+    sub_resource_relationship: EC2InstanceToAWSAccount = EC2InstanceToAWSAccount()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            EC2InstanceToAutoScalingGroup(),
+        ],
+    )
+
+
+# EC2Subnet to AutoScalingGroup
+@dataclass(frozen=True)
+class EC2SubnetToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2SubnetToAWSAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: EC2SubnetToAwsAccountRelProperties = EC2SubnetToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class EC2SubnetToAutoScalingGroupRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2SubnetToAutoScalingGroup(CartographyRelSchema):
+    target_node_label: str = 'AutoScalingGroup'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AutoScalingGroupARN')},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "VPC_IDENTIFIER"
+    properties: EC2SubnetToAutoScalingGroupRelProperties = EC2SubnetToAutoScalingGroupRelProperties()
+
+
+@dataclass(frozen=True)
+class EC2SubnetAutoScalingGroupNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef('VPCZoneIdentifier')
+    subnetid: PropertyRef = PropertyRef('VPCZoneIdentifier', extra_index=True)
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2SubnetAutoScalingGroupSchema(CartographyNodeSchema):
+    label: str = 'EC2Subnet'
+    properties: EC2SubnetAutoScalingGroupNodeProperties = EC2SubnetAutoScalingGroupNodeProperties()
+    sub_resource_relationship: EC2SubnetToAWSAccount = EC2SubnetToAWSAccount()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            EC2SubnetToAutoScalingGroup(),
+        ],
+    )
+
+
+# AutoScalingGroup
+@dataclass(frozen=True)
+class AutoScalingGroupToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AutoScalingGroupToAWSAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: AutoScalingGroupToAwsAccountRelProperties = AutoScalingGroupToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class AutoScalingGroupToLaunchTemplateRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AutoScalingGroupToLaunchTemplate(CartographyRelSchema):
+    target_node_label: str = 'LaunchTemplate'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('LaunchTemplateId')},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "HAS_LAUNCH_TEMPLATE"
+    properties: AutoScalingGroupToLaunchTemplateRelProperties = AutoScalingGroupToLaunchTemplateRelProperties()
+
+
+@dataclass(frozen=True)
+class AutoScalingGroupToLaunchConfigurationRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class AutoScalingGroupToLaunchConfiguration(CartographyRelSchema):
+    target_node_label: str = 'LaunchConfiguration'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'name': PropertyRef('LaunchConfigurationName')},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "HAS_LAUNCH_CONFIG"
+    properties: AutoScalingGroupToLaunchConfigurationRelProperties = (
+        AutoScalingGroupToLaunchConfigurationRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class AutoScalingGroupSchema(CartographyNodeSchema):
+    label: str = 'AutoScalingGroup'
+    properties: AutoScalingGroupNodeProperties = AutoScalingGroupNodeProperties()
+    sub_resource_relationship: AutoScalingGroupToAWSAccount = AutoScalingGroupToAWSAccount()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            AutoScalingGroupToLaunchTemplate(),
+            AutoScalingGroupToLaunchConfiguration(),
+        ],
+    )

cartography/models/aws/ec2/launch_configurations.py

@@ -0,0 +1,55 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class LaunchConfigurationNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef('LaunchConfigurationARN')
+    arn: PropertyRef = PropertyRef('LaunchConfigurationARN')
+    created_time = PropertyRef('CreatedTime')
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+    image_id: PropertyRef = PropertyRef('ImageId')
+    key_name: PropertyRef = PropertyRef('KeyName')
+    name: PropertyRef = PropertyRef('LaunchConfigurationName')
+    security_groups: PropertyRef = PropertyRef('SecurityGroups')
+    instance_type: PropertyRef = PropertyRef('InstanceType')
+    kernel_id: PropertyRef = PropertyRef('KernelId')
+    ramdisk_id: PropertyRef = PropertyRef('RamdiskId')
+    instance_monitoring_enabled: PropertyRef = PropertyRef('InstanceMonitoringEnabled')
+    spot_price: PropertyRef = PropertyRef('SpotPrice')
+    iam_instance_profile: PropertyRef = PropertyRef('IamInstanceProfile')
+    ebs_optimized: PropertyRef = PropertyRef('EbsOptimized')
+    associate_public_ip_address: PropertyRef = PropertyRef('AssociatePublicIpAddress')
+    placement_tenancy: PropertyRef = PropertyRef('PlacementTenancy')
+    region: PropertyRef = PropertyRef('Region', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class LaunchConfigurationToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class LaunchConfigurationToAwsAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: LaunchConfigurationToAwsAccountRelProperties = LaunchConfigurationToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class LaunchConfigurationSchema(CartographyNodeSchema):
+    label: str = 'LaunchConfiguration'
+    properties: LaunchConfigurationNodeProperties = LaunchConfigurationNodeProperties()
+    sub_resource_relationship: LaunchConfigurationToAwsAccount = LaunchConfigurationToAwsAccount()

cartography/models/aws/ec2/network_acl_rules.py

@@ -0,0 +1,98 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclRuleNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef('Id')
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+    network_acl_id: PropertyRef = PropertyRef('NetworkAclId')
+    protocol: PropertyRef = PropertyRef('Protocol')
+    fromport: PropertyRef = PropertyRef('FromPort')
+    toport: PropertyRef = PropertyRef('ToPort')
+    cidrblock: PropertyRef = PropertyRef('CidrBlock')
+    ipv6cidrblock: PropertyRef = PropertyRef('Ipv6CidrBlock')
+    egress: PropertyRef = PropertyRef('Egress')
+    rulenumber: PropertyRef = PropertyRef('RuleNumber')
+    ruleaction: PropertyRef = PropertyRef('RuleAction')
+    region: PropertyRef = PropertyRef('Region', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclRuleAclRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclRuleToAcl(CartographyRelSchema):
+    target_node_label: str = 'EC2NetworkAcl'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'network_acl_id': PropertyRef('NetworkAclId')},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "MEMBER_OF_NACL"
+    properties: EC2NetworkAclRuleAclRelProperties = EC2NetworkAclRuleAclRelProperties()
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclRuleToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclRuleToAWSAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: EC2NetworkAclRuleToAwsAccountRelProperties = EC2NetworkAclRuleToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclInboundRuleSchema(CartographyNodeSchema):
+    """
+    Network interface as known by describe-network-interfaces.
+    """
+    label: str = 'EC2NetworkAclRule'
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(
+        ['IpPermissionInbound'],
+    )
+    properties: EC2NetworkAclRuleNodeProperties = EC2NetworkAclRuleNodeProperties()
+    sub_resource_relationship: EC2NetworkAclRuleToAWSAccount = EC2NetworkAclRuleToAWSAccount()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            EC2NetworkAclRuleToAcl(),
+        ],
+    )
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclEgressRuleSchema(CartographyNodeSchema):
+    """
+    Network interface as known by describe-network-interfaces.
+    """
+    label: str = 'EC2NetworkAclRule'
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(
+        [
+            'IpPermissionEgress',
+        ],
+    )
+    properties: EC2NetworkAclRuleNodeProperties = EC2NetworkAclRuleNodeProperties()
+    sub_resource_relationship: EC2NetworkAclRuleToAWSAccount = EC2NetworkAclRuleToAWSAccount()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            EC2NetworkAclRuleToAcl(),
+        ],
+    )

cartography/models/aws/ec2/network_acls.py

@@ -0,0 +1,86 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef('Arn')
+    arn: PropertyRef = PropertyRef('Arn')
+    network_acl_id: PropertyRef = PropertyRef('Id')
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+    is_default: PropertyRef = PropertyRef('IsDefault')
+    region: PropertyRef = PropertyRef('Region', set_in_kwargs=True)
+    vpc_id: PropertyRef = PropertyRef('VpcId')
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclToVpcRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclToVpc(CartographyRelSchema):
+    target_node_label: str = 'AWSVpc'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'vpcid': PropertyRef('VpcId')},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "MEMBER_OF_AWS_VPC"
+    properties: EC2NetworkAclToVpcRelProperties = EC2NetworkAclToVpcRelProperties()
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclToSubnetRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclToSubnet(CartographyRelSchema):
+    target_node_label: str = 'EC2Subnet'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'subnetid': PropertyRef('SubnetId')},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "PART_OF_SUBNET"
+    properties: EC2NetworkAclToSubnetRelProperties = EC2NetworkAclToSubnetRelProperties()
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclToAWSAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: EC2NetworkAclToAwsAccountRelProperties = EC2NetworkAclToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class EC2NetworkAclSchema(CartographyNodeSchema):
+    """
+    Network interface as known by describe-network-interfaces.
+    """
+    label: str = 'EC2NetworkAcl'
+    properties: EC2NetworkAclNodeProperties = EC2NetworkAclNodeProperties()
+    sub_resource_relationship: EC2NetworkAclToAWSAccount = EC2NetworkAclToAWSAccount()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            EC2NetworkAclToVpc(),
+            EC2NetworkAclToSubnet(),
+        ],
+    )

cartography/models/aws/identitycenter/awsidentitycenter.py

@@ -0,0 +1,44 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class IdentityCenterInstanceProperties(CartographyNodeProperties):
+    identity_store_id: PropertyRef = PropertyRef('IdentityStoreId')
+    arn: PropertyRef = PropertyRef('InstanceArn')
+    created_date: PropertyRef = PropertyRef('CreatedDate')
+    id: PropertyRef = PropertyRef('InstanceArn')
+    status: PropertyRef = PropertyRef('Status')
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class IdentityCenterToAwsAccountRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+# (:IdentityCenter)<-[:RESOURCE]-(:AWSAccount)
+class IdentityCenterToAWSAccount(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('AWS_ID', set_in_kwargs=True)},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "RESOURCE"
+    properties: IdentityCenterToAwsAccountRelProperties = IdentityCenterToAwsAccountRelProperties()
+
+
+@dataclass(frozen=True)
+class AWSIdentityCenterInstanceSchema(CartographyNodeSchema):
+    label: str = 'AWSIdentityCenter'
+    properties: IdentityCenterInstanceProperties = IdentityCenterInstanceProperties()
+    sub_resource_relationship: IdentityCenterToAWSAccount = IdentityCenterToAWSAccount()