cartography 0.98.0rc4__tar.gz → 0.99.0rc1__tar.gz

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/.github/workflows/publish-to-ghcr-and-pypi.yml

@@ -45,6 +45,7 @@ jobs:
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}
+          skip_existing: true
 
       # 2. Publish to GHCR
       - uses: actions/checkout@v2
@@ -72,10 +73,12 @@ jobs:
           # for more detailed information.
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Get the cartography version from the GitHub release event metadata
-      - name: Extract version
+      # Get the cartography version from the GitHub release event metadata and sleep to wait for PyPI to finish publishing
+      - name: Extract version and sleep
         id: version
-        run: echo "VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
+        run: |
+          echo "VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
+          sleep 10
 
       - name: Build and push
         uses: docker/build-push-action@v3

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: cartography
-Version: 0.98.0rc4
+Version: 0.99.0rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2

cartography-0.99.0rc1/SECURITY.md

@@ -0,0 +1,12 @@
+# Security Policy
+Cartography is a security tool, and its community of course takes security very seriously.
+
+We appreciate your efforts to disclose your findings responsibly and will make every effort to acknowledge your contributions.
+
+## Supported versions
+Security updates will typically only be applied to the latest release (at least until Cartography reaches the first stable major version).
+
+## Reporting a vulnerability
+To report a security issue, email cncf-cartography-maintainers@lists.cncf.io and include the word "SECURITY" in the subject line.
+
+Maintainers will send a response indicating the next steps in handling your report. After the initial reply to your report, we will keep you informed of the progress towards a fix and full announcement and may ask for additional information or guidance.

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/cartography/_version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '0.98.0rc4'
-__version_tuple__ = version_tuple = (0, 98, 0)
+__version__ = version = '0.99.0rc1'
+__version_tuple__ = version_tuple = (0, 99, 0)

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/cartography/client/core/tx.py

@@ -249,6 +249,9 @@ def load(
     :param kwargs: Allows additional keyword args to be supplied to the Neo4j query.
     :return: None
     """
+    if len(dict_list) == 0:
+        # If there is no data to load, save some time.
+        return
     ensure_indexes(neo4j_session, node_schema)
     ingestion_query = build_ingestion_query(node_schema)
     load_graph_data(neo4j_session, ingestion_query, dict_list, **kwargs)

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/cartography/intel/aws/ec2/images.py

@@ -9,6 +9,7 @@ from botocore.exceptions import ClientError
 
 from cartography.client.core.tx import load
 from cartography.graph.job import GraphJob
+from cartography.intel.aws.ec2 import get_ec2_regions
 from cartography.intel.aws.ec2.util import get_botocore_config
 from cartography.models.aws.ec2.images import EC2ImageSchema
 from cartography.util import aws_handle_regions
@@ -48,7 +49,7 @@ def get_images(boto3_session: boto3.session.Session, region: str, image_ids: Lis
         self_images = client.describe_images(Owners=['self'])['Images']
         images.extend(self_images)
     except ClientError as e:
-        logger.warning(f"Failed retrieve images for region - {region}. Error - {e}")
+        logger.warning(f"Failed to retrieve private images for region - {region}. Error - {e}")
     try:
         if image_ids:
             image_ids = [image_id for image_id in image_ids if image_id is not None]
@@ -58,8 +59,25 @@ def get_images(boto3_session: boto3.session.Session, region: str, image_ids: Lis
             for image in images_in_use:
                 if image["ImageId"] not in _ids:
                     images.append(image)
+                    _ids.append(image["ImageId"])
+            # Handle cross region image ids
+            if len(_ids) != len(image_ids):
+                logger.info("Attempting to retrieve images from other regions")
+                pending_ids = [image_id for image_id in image_ids if image_id not in _ids]
+                all_regions = get_ec2_regions(boto3_session)
+                clients = {
+                    other_region: boto3_session.client('ec2', region_name=other_region, config=get_botocore_config())
+                    for other_region in all_regions if other_region != region
+                }
+                for other_region, client in clients.items():
+                    for _id in pending_ids:
+                        try:
+                            pending_image = client.describe_images(ImageIds=[_id])['Images']
+                            images.extend(pending_image)
+                        except ClientError as e:
+                            logger.warning(f"Image {id} could not be found at region - {other_region}. Error - {e}")
     except ClientError as e:
-        logger.warning(f"Failed retrieve images for region - {region}. Error - {e}")
+        logger.warning(f"Failed to retrieve public images for region - {region}. Error - {e}")
     return images
 
 

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/cartography/intel/aws/resourcegroupstaggingapi.py

@@ -188,6 +188,9 @@ def load_tags(
     current_aws_account_id: str,
     aws_update_tag: int,
 ) -> None:
+    if len(tag_data) == 0:
+        # If there is no data to load, save some time.
+        return
     for tag_data_batch in batch(tag_data, size=100):
         neo4j_session.write_transaction(
             _load_tags_tx,

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/cartography/models/aws/inspector/findings.py

@@ -61,6 +61,22 @@ class InspectorFindingToAWSAccount(CartographyRelSchema):
     properties: InspectorFindingToAwsAccountRelProperties = InspectorFindingToAwsAccountRelProperties()
 
 
+@dataclass(frozen=True)
+class InspectorFindingToAwsAccountDelegateRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class InspectorFindingToAWSAccountDelegate(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('awsaccount')},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "MEMBER"
+    properties: InspectorFindingToAwsAccountDelegateRelProperties = InspectorFindingToAwsAccountDelegateRelProperties()
+
+
 @dataclass(frozen=True)
 class InspectorFindingToEC2InstanceRelProperties(CartographyRelProperties):
     lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
@@ -120,5 +136,6 @@ class AWSInspectorFindingSchema(CartographyNodeSchema):
             InspectorFindingToEC2Instance(),
             InspectorFindingToECRRepository(),
             InspectorFindingToECRImage(),
+            InspectorFindingToAWSAccountDelegate(),
         ],
     )

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/cartography.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: cartography
-Version: 0.98.0rc4
+Version: 0.99.0rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/cartography.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ LICENSE
 MAINTAINERS.md
 Makefile
 README.md
+SECURITY.md
 dev-entrypoint.sh
 dev.Dockerfile
 docker-compose.yml
@@ -789,6 +790,9 @@ tests/unit/test_hello_world.py
 tests/unit/cartography/__init__.py
 tests/unit/cartography/test_sync.py
 tests/unit/cartography/test_util.py
+tests/unit/cartography/client/__init__.py
+tests/unit/cartography/client/test_core.py
+tests/unit/cartography/client/core/test_tx.py
 tests/unit/cartography/data/__init__.py
 tests/unit/cartography/data/test_graphjob.py
 tests/unit/cartography/data/jobs/__init__.py
@@ -810,6 +814,7 @@ tests/unit/cartography/intel/aws/test_inspector.py
 tests/unit/cartography/intel/aws/test_permission_relationships.py
 tests/unit/cartography/intel/aws/test_resourcegroupstaggingapi.py
 tests/unit/cartography/intel/aws/test_util.py
+tests/unit/cartography/intel/aws/ec2/test_ec2_images.py
 tests/unit/cartography/intel/aws/iam/__init__.py
 tests/unit/cartography/intel/aws/iam/test_iam.py
 tests/unit/cartography/intel/aws/iam/test_principal_policies.py

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/docs/root/modules/aws/schema.md

@@ -192,12 +192,17 @@ Representation of an AWS [Inspector Finding](https://docs.aws.amazon.com/inspect
     ```
     (AWSInspectorFinding)-[:AFFECTS]->(ECRImage)
     ```
-
-- AWSInspectorFindings belong to AWSAccounts.
+- AWSInspectorFindings managed by AWSAccount.
 
         ```
         (AWSAccount)-[RESOURCE]->(AWSInspectorFinding)
         ```
+- AWSInspectorFinding was found at an AWSAccounts. `MEMBER` accounts are where the finding is attached to, while `RESOURCE` accounts can be a delegated administrator. [Understanding the delegated administrator account and member account in Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/admin-member-relationship.html) .
+
+        ```
+        (AWSAccount)-[MEMBER]->(AWSInspectorFinding)
+        ```
+
 
 ### AWSInspectorPackage
 

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/docs/root/modules/github/config.md

@@ -5,33 +5,45 @@
 Follow these steps to analyze GitHub repos and other objects with Cartography.
 
 1. Prepare your GitHub credentials.
-    1. Prepare a GitHub token; the following scopes are required, at minimum: `repo`, `read:org`, `read:user`, `user:email`
+
+    1. Make a GitHub user. Prepare a token on that user with the following scopes at minimum: `repo`, `read:org`, `read:user`, `user:email`
+
     1. GitHub ingest supports multiple endpoints, such as a public instance and an enterprise instance by taking a base64-encoded config object structured as
-       ```json
-       {
-        "organization": [
+
+        ```python
+        data = {
+          "organization": [
             {
-                "token": "faketoken",
-                "url": "https://api.github.com/graphql",
-                "name": "fakeorg"
+              "token": "faketoken",
+              "url": "https://api.github.com/graphql",
+              "name": "fakeorg",
             },
             {
-                "token": "stillfake",
-                "url": "https://github.example.com/api/graphql",
-                "name": "fakeorg"
-            }]
-       }
-       ```
+              "token": "stillfake",
+              "url": "https://github.example.com/api/graphql",
+              "name": "fakeorg",
+            }
+          ]
+        }
+        ```
+
     1. For each GitHub instance you want to ingest, generate an API token as documented in the [API reference](https://developer.github.com/v3/auth/)
+
     1. Create your auth config as shown above using the token obtained in the previous step. If you are configuring only the public GitHub instance, you can just use the first config block and delete the second. The name field is for the organization name you want to ingest.
+
     1. Base64 encode the auth object. You can encode the above sample in Python using
+
        ```python
        import json
        import base64
-       auth_json = json.dumps({"organization":[{"token":"faketoken","url":"https://api.github.com/graphql","name":"fakeorg"},{"token":"stillfake","url":"https://github.example.com/api/graphql","name":"fakeorg"}]})
+       auth_json = json.dumps(data)
        base64.b64encode(auth_json.encode())
        ```
+
        and the resulting environment variable would be ```eyJvcmdhbml6YXRpb24iOiBbeyJ0b2tlbiI6ICJmYWtldG9rZW4iLCAidXJsIjogImh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vZ3JhcGhxbCIsICJuYW1lIjogImZha2VvcmcifSwgeyJ0b2tlbiI6ICJzdGlsbGZha2UiLCAidXJsIjogImh0dHBzOi8vZ2l0aHViLmV4YW1wbGUuY29tL2FwaS9ncmFwaHFsIiwgIm5hbWUiOiAiZmFrZW9yZyJ9XX0=```
+
 1. Populate an environment variable of your choice with the contents of the base64 output from the previous step.
+
 1. Call the `cartography` CLI with `--github-config-env-var YOUR_ENV_VAR_HERE`.
+
 1. `cartography` will then load your graph with data from all the organizations you specified.

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/tests/data/aws/inspector.py

@@ -191,4 +191,78 @@ LIST_FINDINGS_EC2_PACKAGE = [
         'type': 'PACKAGE_VULNERABILITY',
         'updatedAt': datetime(2022, 5, 4, 16, 23, 3, 692000),
     },
+    {
+        'awsAccountId': '123456789011',
+        'description': 'A buffer overflow vulnerability in OpenSSL allows remote attackers '
+        'to execute arbitrary code or cause a denial of service via crafted '
+        'SSL/TLS handshake messages.',
+        'findingArn': 'arn:aws:test789',
+        'firstObservedAt': datetime(2022, 5, 4, 16, 23, 3, 692000),
+        'inspectorScore': 7.5,
+        'inspectorScoreDetails': {
+            'adjustedCvss': {
+                'adjustments': [],
+                'cvssSource': 'NVD',
+                'score': 7.5,
+                'scoreSource': 'NVD',
+                'scoringVector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+                'version': '3.1',
+            },
+        },
+        'lastObservedAt': datetime(2022, 5, 4, 16, 23, 3, 692000),
+        'packageVulnerabilityDetails': {
+            'cvss': [
+                {
+                    'baseScore': 7.5,
+                    'scoringVector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+                    'source': 'NVD',
+                    'version': '3.1',
+                },
+            ],
+            'referenceUrls': ['https://nvd.nist.gov/vuln/detail/CVE-2023-1234'],
+            'relatedVulnerabilities': [],
+            'source': 'NVD',
+            'sourceUrl': 'https://nvd.nist.gov/vuln/detail/CVE-2023-1234',
+            'vendorCreatedAt': datetime(2023, 1, 15, 10, 0),
+            'vendorSeverity': 'High',
+            'vulnerabilityId': 'CVE-2023-1234',
+            'vulnerablePackages': [
+                {
+                    'arch': 'X86_64',
+                    'epoch': 0,
+                    'name': 'openssl',
+                    'packageManager': 'OS',
+                    'release': '1.amzn2',
+                    'version': '1.0.2k',
+                },
+            ],
+        },
+        'remediation': {'recommendation': {'text': 'Update to the latest version of OpenSSL'}},
+        'resources': [{
+            'details': {
+                'awsEc2Instance': {
+                    'iamInstanceProfileArn': 'arn:aws:iam::123456789011:instance-profile/InspectorTestingRole',
+                    'imageId': 'ami-00800800',
+                    'ipV4Addresses': ['10.0.1.4'],
+                    'ipV6Addresses': [],
+                    'keyName': 'InspectorTest',
+                    'launchedAt': datetime(2022, 5, 4, 16, 15, 41),
+                    'platform': 'AMAZON_LINUX_2',
+                    'subnetId': 'subnet-11203981029833100',
+                    'type': 't2.micro',
+                    'vpcId': 'vpc-11203981029822100',
+                },
+            },
+            'id': 'i-88503981029833101',
+            'partition': 'aws',
+            'region': 'us-west-2',
+            'tags': {},
+            'type': 'AWS_EC2_INSTANCE',
+        }],
+        'severity': 'HIGH',
+        'status': 'ACTIVE',
+        'title': 'CVE-2023-1234 - openssl',
+        'type': 'PACKAGE_VULNERABILITY',
+        'updatedAt': datetime(2022, 5, 4, 16, 23, 3, 692000),
+    },
 ]

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/tests/integration/cartography/intel/aws/inspector/test_inspector_sync.py

@@ -89,6 +89,7 @@ def test_sync_inspector_ec2_package_findings(mock_get, neo4j_session):
     neo4j_session.run(
         """
         MERGE (:EC2Instance{id: 'i-88503981029833100', instanceid: 'i-88503981029833100'})
+        MERGE (:EC2Instance{id: 'i-88503981029833101', instanceid: 'i-88503981029833101'})
         """,
     )
 
@@ -113,6 +114,7 @@ def test_sync_inspector_ec2_package_findings(mock_get, neo4j_session):
         rel_direction_right=True,
     ) == {
         ('arn:aws:test456', 'i-88503981029833100'),
+        ('arn:aws:test789', 'i-88503981029833101'),
     }
 
     assert check_rels(
@@ -126,9 +128,10 @@ def test_sync_inspector_ec2_package_findings(mock_get, neo4j_session):
     ) == {
         ('arn:aws:test456', 'kernel-tools|X86_64|4.9.17|6.29.amzn1|0'),
         ('arn:aws:test456', 'kernel|X86_64|4.9.17|6.29.amzn1|0'),
+        ('arn:aws:test789', 'openssl|X86_64|1.0.2k|1.amzn2|0'),
     }
 
-    # Assert AWSAccount to Finding exists
+    # Assert AWSAccount RESOURCE to Finding exists
     assert check_rels(
         neo4j_session,
         'AWSAccount',
@@ -139,4 +142,19 @@ def test_sync_inspector_ec2_package_findings(mock_get, neo4j_session):
         rel_direction_right=True,
     ) == {
         ('123456789012', 'arn:aws:test456'),
+        ('123456789012', 'arn:aws:test789'),
+    }
+
+    # Assert AWSAccount MEMBER to Finding exists
+    assert check_rels(
+        neo4j_session,
+        'AWSAccount',
+        'id',
+        'AWSInspectorFinding',
+        'id',
+        'MEMBER',
+        rel_direction_right=True,
+    ) == {
+        ('123456789011', 'arn:aws:test789'),
+        ('123456789012', 'arn:aws:test456'),
     }

cartography-0.99.0rc1/tests/unit/cartography/client/test_core.py

@@ -0,0 +1,19 @@
+from unittest.mock import MagicMock
+
+from cartography.client.core.tx import load
+from cartography.models.core.nodes import CartographyNodeSchema
+
+
+def test_load_empty_dict_list():
+    # Setup
+    mock_session = MagicMock()
+    mock_schema = MagicMock(spec=CartographyNodeSchema)
+    empty_dict_list = []
+
+    # Execute
+    load(mock_session, mock_schema, empty_dict_list)
+
+    # Assert
+    mock_session.run.assert_not_called()  # Ensure no database calls were made
+    # Verify that ensure_indexes was not called since we short-circuit on empty list
+    mock_session.write_transaction.assert_not_called()

cartography-0.99.0rc1/tests/unit/cartography/intel/aws/ec2/test_ec2_images.py

@@ -0,0 +1,72 @@
+from unittest.mock import MagicMock
+from unittest.mock import patch
+
+from botocore.exceptions import ClientError
+
+from cartography.intel.aws.ec2.images import get_images
+
+
+@patch('cartography.intel.aws.ec2.images.get_botocore_config')
+@patch('cartography.intel.aws.ec2.images.get_ec2_regions')
+@patch('boto3.session.Session')
+def test_get_images_all_sources(mock_boto3_session, mock_get_ec2_regions, mock_get_botocore_config):
+    region = 'us-east-1'
+    image_ids = ['ami-55555555', 'ami-12345678', 'ami-87654321']
+
+    mock_client = MagicMock()
+    mock_boto3_session.client.return_value = mock_client
+    mock_client.describe_images.side_effect = [
+        {'Images': [{'ImageId': 'ami-55555555'}]},
+        {'Images': [{'ImageId': 'ami-12345678'}]},
+        {'Images': [{'ImageId': 'ami-87654321'}]},
+    ]
+
+    mock_get_ec2_regions.return_value = ['us-east-1', 'us-west-2']
+    mock_get_botocore_config.return_value = {}
+
+    result = get_images(mock_boto3_session, region, image_ids)
+
+    assert len(result) == 3
+    assert result[0]['ImageId'] == 'ami-55555555'
+    assert result[1]['ImageId'] == 'ami-12345678'
+    assert result[2]['ImageId'] == 'ami-87654321'
+
+
+@patch('cartography.intel.aws.ec2.images.get_botocore_config')
+@patch('boto3.session.Session')
+def test_get_images_not_found(mock_boto3_session, mock_get_botocore_config):
+    region = 'us-west-2'
+    image_ids = ['ami-12345678', 'ami-87654321']
+
+    mock_client = MagicMock()
+    mock_boto3_session.return_value = mock_client
+    mock_client.describe_images.side_effect = ClientError(
+        error_response={'Error': {'Code': 'InvalidAMIID.NotFound', 'Message': 'The image id does not exist'}},
+        operation_name='DescribeImages',
+    )
+
+    mock_get_botocore_config.return_value = {}
+
+    result = get_images(mock_boto3_session, region, image_ids)
+
+    assert result == []
+
+
+@patch('cartography.intel.aws.ec2.images.get_botocore_config')
+@patch('boto3.session.Session')
+def test_get_images_no_image_ids(mock_boto3_session, mock_get_botocore_config):
+    region = 'us-west-2'
+    image_ids = []
+
+    mock_client = MagicMock()
+    mock_boto3_session.client.return_value = mock_client
+    mock_client.describe_images.side_effect = [
+        {'Images': [{'ImageId': 'ami-12345678'}]},
+    ]
+
+    mock_get_botocore_config.return_value = {}
+
+    result = get_images(mock_boto3_session, region, image_ids)
+
+    assert len(result) == 1
+    assert result[0]['ImageId'] == 'ami-12345678'

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/tests/unit/cartography/intel/aws/test_inspector.py

@@ -67,6 +67,34 @@ def test_transform_inspector_findings_package():
                 'kernel|X86_64|4.9.17|6.29.amzn1|0',
             ],
         },
+        {
+            'id': 'arn:aws:test789',
+            'arn': 'arn:aws:test789',
+            'vulnerabilityid': 'CVE-2023-1234',
+            'instanceid': 'i-88503981029833101',
+            'severity': 'HIGH',
+            'name': 'CVE-2023-1234 - openssl',
+            'firstobservedat': datetime(2022, 5, 4, 16, 23, 3, 692000),
+            'updatedat': datetime(2022, 5, 4, 16, 23, 3, 692000),
+            'awsaccount': '123456789011',
+            'description': 'A buffer overflow vulnerability in OpenSSL allows remote attackers '
+            'to execute arbitrary code or cause a denial of service via crafted '
+            'SSL/TLS handshake messages.',
+            'cvssscore': 7.5,
+            'type': 'PACKAGE_VULNERABILITY',
+            'referenceurls': ['https://nvd.nist.gov/vuln/detail/CVE-2023-1234'],
+            'relatedvulnerabilities': [],
+            'source': 'NVD',
+            'vendorcreatedat': datetime(2023, 1, 15, 10, 0),
+            'vendorupdatedat': None,
+            'vendorseverity': 'High',
+            'sourceurl': 'https://nvd.nist.gov/vuln/detail/CVE-2023-1234',
+            'status': 'ACTIVE',
+
+            'vulnerablepackageids': [
+                'openssl|X86_64|1.0.2k|1.amzn2|0',
+            ],
+        },
     ]
     assert packages == [
         {
@@ -97,4 +125,18 @@ def test_transform_inspector_findings_package():
             'sourcelayerhash': None,
             'version': '4.9.17',
         },
+        {
+            'arch': 'X86_64',
+            'awsaccount': '123456789011',
+            'epoch': 0,
+            'filepath': None,
+            'findingarn': 'arn:aws:test789',
+            'fixedinversion': None,
+            'id': 'openssl|X86_64|1.0.2k|1.amzn2|0',
+            'manager': 'OS',
+            'name': 'openssl',
+            'release': '1.amzn2',
+            'sourcelayerhash': None,
+            'version': '1.0.2k',
+        },
     ]

{cartography-0.98.0rc4 → cartography-0.99.0rc1}/tests/unit/cartography/intel/aws/test_resourcegroupstaggingapi.py

@@ -1,4 +1,5 @@
 import copy
+from unittest.mock import MagicMock
 
 import cartography.intel.aws.resourcegroupstaggingapi as rgta
 import tests.data.aws.resourcegroupstaggingapi as test_data
@@ -44,3 +45,28 @@ def test_transform_tags():
     assert 'resource_id' not in get_resources_response[0]
     rgta.transform_tags(get_resources_response, 'ec2:instance')
     assert 'resource_id' in get_resources_response[0]
+
+
+def test_load_tags_empty_data():
+    """
+    Ensure that the load_tags function returns early if the tag_data is empty
+    """
+    # Arrange
+    mock_neo4j_session = MagicMock()
+    resource_type = 'ec2:instance'
+    region = 'us-east-1'
+    account_id = '123456789012'
+    update_tag = 123456789
+
+    # Act
+    rgta.load_tags(
+        neo4j_session=mock_neo4j_session,
+        tag_data={},
+        resource_type=resource_type,
+        region=region,
+        current_aws_account_id=account_id,
+        aws_update_tag=update_tag,
+    )
+
+    # Assert
+    mock_neo4j_session.write_transaction.assert_not_called()