cartography 0.98.0rc5__tar.gz → 0.99.0rc1__tar.gz

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/.github/workflows/publish-to-ghcr-and-pypi.yml

@@ -73,10 +73,12 @@ jobs:
           # for more detailed information.
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Get the cartography version from the GitHub release event metadata
-      - name: Extract version
+      # Get the cartography version from the GitHub release event metadata and sleep to wait for PyPI to finish publishing
+      - name: Extract version and sleep
         id: version
-        run: echo "VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
+        run: |
+          echo "VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
+          sleep 10
 
       - name: Build and push
         uses: docker/build-push-action@v3

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: cartography
-Version: 0.98.0rc5
+Version: 0.99.0rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2

cartography-0.99.0rc1/SECURITY.md

@@ -0,0 +1,12 @@
+# Security Policy
+Cartography is a security tool, and its community of course takes security very seriously.
+
+We appreciate your efforts to disclose your findings responsibly and will make every effort to acknowledge your contributions.
+
+## Supported versions
+Security updates will typically only be applied to the latest release (at least until Cartography reaches the first stable major version).
+
+## Reporting a vulnerability
+To report a security issue, email cncf-cartography-maintainers@lists.cncf.io and include the word "SECURITY" in the subject line.
+
+Maintainers will send a response indicating the next steps in handling your report. After the initial reply to your report, we will keep you informed of the progress towards a fix and full announcement and may ask for additional information or guidance.

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/cartography/_version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '0.98.0rc5'
-__version_tuple__ = version_tuple = (0, 98, 0)
+__version__ = version = '0.99.0rc1'
+__version_tuple__ = version_tuple = (0, 99, 0)

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/cartography/client/core/tx.py

@@ -249,6 +249,9 @@ def load(
     :param kwargs: Allows additional keyword args to be supplied to the Neo4j query.
     :return: None
     """
+    if len(dict_list) == 0:
+        # If there is no data to load, save some time.
+        return
     ensure_indexes(neo4j_session, node_schema)
     ingestion_query = build_ingestion_query(node_schema)
     load_graph_data(neo4j_session, ingestion_query, dict_list, **kwargs)

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/cartography/intel/aws/ec2/images.py

@@ -9,6 +9,7 @@ from botocore.exceptions import ClientError
 
 from cartography.client.core.tx import load
 from cartography.graph.job import GraphJob
+from cartography.intel.aws.ec2 import get_ec2_regions
 from cartography.intel.aws.ec2.util import get_botocore_config
 from cartography.models.aws.ec2.images import EC2ImageSchema
 from cartography.util import aws_handle_regions
@@ -48,7 +49,7 @@ def get_images(boto3_session: boto3.session.Session, region: str, image_ids: Lis
         self_images = client.describe_images(Owners=['self'])['Images']
         images.extend(self_images)
     except ClientError as e:
-        logger.warning(f"Failed retrieve images for region - {region}. Error - {e}")
+        logger.warning(f"Failed to retrieve private images for region - {region}. Error - {e}")
     try:
         if image_ids:
             image_ids = [image_id for image_id in image_ids if image_id is not None]
@@ -58,8 +59,25 @@ def get_images(boto3_session: boto3.session.Session, region: str, image_ids: Lis
             for image in images_in_use:
                 if image["ImageId"] not in _ids:
                     images.append(image)
+                    _ids.append(image["ImageId"])
+            # Handle cross region image ids
+            if len(_ids) != len(image_ids):
+                logger.info("Attempting to retrieve images from other regions")
+                pending_ids = [image_id for image_id in image_ids if image_id not in _ids]
+                all_regions = get_ec2_regions(boto3_session)
+                clients = {
+                    other_region: boto3_session.client('ec2', region_name=other_region, config=get_botocore_config())
+                    for other_region in all_regions if other_region != region
+                }
+                for other_region, client in clients.items():
+                    for _id in pending_ids:
+                        try:
+                            pending_image = client.describe_images(ImageIds=[_id])['Images']
+                            images.extend(pending_image)
+                        except ClientError as e:
+                            logger.warning(f"Image {id} could not be found at region - {other_region}. Error - {e}")
     except ClientError as e:
-        logger.warning(f"Failed retrieve images for region - {region}. Error - {e}")
+        logger.warning(f"Failed to retrieve public images for region - {region}. Error - {e}")
     return images
 
 

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/cartography/intel/aws/resourcegroupstaggingapi.py

@@ -188,6 +188,9 @@ def load_tags(
     current_aws_account_id: str,
     aws_update_tag: int,
 ) -> None:
+    if len(tag_data) == 0:
+        # If there is no data to load, save some time.
+        return
     for tag_data_batch in batch(tag_data, size=100):
         neo4j_session.write_transaction(
             _load_tags_tx,

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/cartography/models/aws/inspector/findings.py

@@ -61,6 +61,22 @@ class InspectorFindingToAWSAccount(CartographyRelSchema):
     properties: InspectorFindingToAwsAccountRelProperties = InspectorFindingToAwsAccountRelProperties()
 
 
+@dataclass(frozen=True)
+class InspectorFindingToAwsAccountDelegateRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class InspectorFindingToAWSAccountDelegate(CartographyRelSchema):
+    target_node_label: str = 'AWSAccount'
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {'id': PropertyRef('awsaccount')},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "MEMBER"
+    properties: InspectorFindingToAwsAccountDelegateRelProperties = InspectorFindingToAwsAccountDelegateRelProperties()
+
+
 @dataclass(frozen=True)
 class InspectorFindingToEC2InstanceRelProperties(CartographyRelProperties):
     lastupdated: PropertyRef = PropertyRef('lastupdated', set_in_kwargs=True)
@@ -120,5 +136,6 @@ class AWSInspectorFindingSchema(CartographyNodeSchema):
             InspectorFindingToEC2Instance(),
             InspectorFindingToECRRepository(),
             InspectorFindingToECRImage(),
+            InspectorFindingToAWSAccountDelegate(),
         ],
     )

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/cartography.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: cartography
-Version: 0.98.0rc5
+Version: 0.99.0rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/cartography.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ LICENSE
 MAINTAINERS.md
 Makefile
 README.md
+SECURITY.md
 dev-entrypoint.sh
 dev.Dockerfile
 docker-compose.yml
@@ -789,6 +790,9 @@ tests/unit/test_hello_world.py
 tests/unit/cartography/__init__.py
 tests/unit/cartography/test_sync.py
 tests/unit/cartography/test_util.py
+tests/unit/cartography/client/__init__.py
+tests/unit/cartography/client/test_core.py
+tests/unit/cartography/client/core/test_tx.py
 tests/unit/cartography/data/__init__.py
 tests/unit/cartography/data/test_graphjob.py
 tests/unit/cartography/data/jobs/__init__.py
@@ -810,6 +814,7 @@ tests/unit/cartography/intel/aws/test_inspector.py
 tests/unit/cartography/intel/aws/test_permission_relationships.py
 tests/unit/cartography/intel/aws/test_resourcegroupstaggingapi.py
 tests/unit/cartography/intel/aws/test_util.py
+tests/unit/cartography/intel/aws/ec2/test_ec2_images.py
 tests/unit/cartography/intel/aws/iam/__init__.py
 tests/unit/cartography/intel/aws/iam/test_iam.py
 tests/unit/cartography/intel/aws/iam/test_principal_policies.py

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/docs/root/modules/aws/schema.md

@@ -192,12 +192,17 @@ Representation of an AWS [Inspector Finding](https://docs.aws.amazon.com/inspect
     ```
     (AWSInspectorFinding)-[:AFFECTS]->(ECRImage)
     ```
-
-- AWSInspectorFindings belong to AWSAccounts.
+- AWSInspectorFindings managed by AWSAccount.
 
         ```
         (AWSAccount)-[RESOURCE]->(AWSInspectorFinding)
         ```
+- AWSInspectorFinding was found at an AWSAccounts. `MEMBER` accounts are where the finding is attached to, while `RESOURCE` accounts can be a delegated administrator. [Understanding the delegated administrator account and member account in Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/admin-member-relationship.html) .
+
+        ```
+        (AWSAccount)-[MEMBER]->(AWSInspectorFinding)
+        ```
+
 
 ### AWSInspectorPackage
 

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/tests/data/aws/inspector.py

@@ -191,4 +191,78 @@ LIST_FINDINGS_EC2_PACKAGE = [
         'type': 'PACKAGE_VULNERABILITY',
         'updatedAt': datetime(2022, 5, 4, 16, 23, 3, 692000),
     },
+    {
+        'awsAccountId': '123456789011',
+        'description': 'A buffer overflow vulnerability in OpenSSL allows remote attackers '
+        'to execute arbitrary code or cause a denial of service via crafted '
+        'SSL/TLS handshake messages.',
+        'findingArn': 'arn:aws:test789',
+        'firstObservedAt': datetime(2022, 5, 4, 16, 23, 3, 692000),
+        'inspectorScore': 7.5,
+        'inspectorScoreDetails': {
+            'adjustedCvss': {
+                'adjustments': [],
+                'cvssSource': 'NVD',
+                'score': 7.5,
+                'scoreSource': 'NVD',
+                'scoringVector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+                'version': '3.1',
+            },
+        },
+        'lastObservedAt': datetime(2022, 5, 4, 16, 23, 3, 692000),
+        'packageVulnerabilityDetails': {
+            'cvss': [
+                {
+                    'baseScore': 7.5,
+                    'scoringVector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+                    'source': 'NVD',
+                    'version': '3.1',
+                },
+            ],
+            'referenceUrls': ['https://nvd.nist.gov/vuln/detail/CVE-2023-1234'],
+            'relatedVulnerabilities': [],
+            'source': 'NVD',
+            'sourceUrl': 'https://nvd.nist.gov/vuln/detail/CVE-2023-1234',
+            'vendorCreatedAt': datetime(2023, 1, 15, 10, 0),
+            'vendorSeverity': 'High',
+            'vulnerabilityId': 'CVE-2023-1234',
+            'vulnerablePackages': [
+                {
+                    'arch': 'X86_64',
+                    'epoch': 0,
+                    'name': 'openssl',
+                    'packageManager': 'OS',
+                    'release': '1.amzn2',
+                    'version': '1.0.2k',
+                },
+            ],
+        },
+        'remediation': {'recommendation': {'text': 'Update to the latest version of OpenSSL'}},
+        'resources': [{
+            'details': {
+                'awsEc2Instance': {
+                    'iamInstanceProfileArn': 'arn:aws:iam::123456789011:instance-profile/InspectorTestingRole',
+                    'imageId': 'ami-00800800',
+                    'ipV4Addresses': ['10.0.1.4'],
+                    'ipV6Addresses': [],
+                    'keyName': 'InspectorTest',
+                    'launchedAt': datetime(2022, 5, 4, 16, 15, 41),
+                    'platform': 'AMAZON_LINUX_2',
+                    'subnetId': 'subnet-11203981029833100',
+                    'type': 't2.micro',
+                    'vpcId': 'vpc-11203981029822100',
+                },
+            },
+            'id': 'i-88503981029833101',
+            'partition': 'aws',
+            'region': 'us-west-2',
+            'tags': {},
+            'type': 'AWS_EC2_INSTANCE',
+        }],
+        'severity': 'HIGH',
+        'status': 'ACTIVE',
+        'title': 'CVE-2023-1234 - openssl',
+        'type': 'PACKAGE_VULNERABILITY',
+        'updatedAt': datetime(2022, 5, 4, 16, 23, 3, 692000),
+    },
 ]

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/tests/integration/cartography/intel/aws/inspector/test_inspector_sync.py

@@ -89,6 +89,7 @@ def test_sync_inspector_ec2_package_findings(mock_get, neo4j_session):
     neo4j_session.run(
         """
         MERGE (:EC2Instance{id: 'i-88503981029833100', instanceid: 'i-88503981029833100'})
+        MERGE (:EC2Instance{id: 'i-88503981029833101', instanceid: 'i-88503981029833101'})
         """,
     )
 
@@ -113,6 +114,7 @@ def test_sync_inspector_ec2_package_findings(mock_get, neo4j_session):
         rel_direction_right=True,
     ) == {
         ('arn:aws:test456', 'i-88503981029833100'),
+        ('arn:aws:test789', 'i-88503981029833101'),
     }
 
     assert check_rels(
@@ -126,9 +128,10 @@ def test_sync_inspector_ec2_package_findings(mock_get, neo4j_session):
     ) == {
         ('arn:aws:test456', 'kernel-tools|X86_64|4.9.17|6.29.amzn1|0'),
         ('arn:aws:test456', 'kernel|X86_64|4.9.17|6.29.amzn1|0'),
+        ('arn:aws:test789', 'openssl|X86_64|1.0.2k|1.amzn2|0'),
     }
 
-    # Assert AWSAccount to Finding exists
+    # Assert AWSAccount RESOURCE to Finding exists
     assert check_rels(
         neo4j_session,
         'AWSAccount',
@@ -139,4 +142,19 @@ def test_sync_inspector_ec2_package_findings(mock_get, neo4j_session):
         rel_direction_right=True,
     ) == {
         ('123456789012', 'arn:aws:test456'),
+        ('123456789012', 'arn:aws:test789'),
+    }
+
+    # Assert AWSAccount MEMBER to Finding exists
+    assert check_rels(
+        neo4j_session,
+        'AWSAccount',
+        'id',
+        'AWSInspectorFinding',
+        'id',
+        'MEMBER',
+        rel_direction_right=True,
+    ) == {
+        ('123456789011', 'arn:aws:test789'),
+        ('123456789012', 'arn:aws:test456'),
     }

cartography-0.99.0rc1/tests/unit/cartography/client/test_core.py

@@ -0,0 +1,19 @@
+from unittest.mock import MagicMock
+
+from cartography.client.core.tx import load
+from cartography.models.core.nodes import CartographyNodeSchema
+
+
+def test_load_empty_dict_list():
+    # Setup
+    mock_session = MagicMock()
+    mock_schema = MagicMock(spec=CartographyNodeSchema)
+    empty_dict_list = []
+
+    # Execute
+    load(mock_session, mock_schema, empty_dict_list)
+
+    # Assert
+    mock_session.run.assert_not_called()  # Ensure no database calls were made
+    # Verify that ensure_indexes was not called since we short-circuit on empty list
+    mock_session.write_transaction.assert_not_called()

cartography-0.99.0rc1/tests/unit/cartography/intel/aws/ec2/test_ec2_images.py

@@ -0,0 +1,72 @@
+from unittest.mock import MagicMock
+from unittest.mock import patch
+
+from botocore.exceptions import ClientError
+
+from cartography.intel.aws.ec2.images import get_images
+
+
+@patch('cartography.intel.aws.ec2.images.get_botocore_config')
+@patch('cartography.intel.aws.ec2.images.get_ec2_regions')
+@patch('boto3.session.Session')
+def test_get_images_all_sources(mock_boto3_session, mock_get_ec2_regions, mock_get_botocore_config):
+    region = 'us-east-1'
+    image_ids = ['ami-55555555', 'ami-12345678', 'ami-87654321']
+
+    mock_client = MagicMock()
+    mock_boto3_session.client.return_value = mock_client
+    mock_client.describe_images.side_effect = [
+        {'Images': [{'ImageId': 'ami-55555555'}]},
+        {'Images': [{'ImageId': 'ami-12345678'}]},
+        {'Images': [{'ImageId': 'ami-87654321'}]},
+    ]
+
+    mock_get_ec2_regions.return_value = ['us-east-1', 'us-west-2']
+    mock_get_botocore_config.return_value = {}
+
+    result = get_images(mock_boto3_session, region, image_ids)
+
+    assert len(result) == 3
+    assert result[0]['ImageId'] == 'ami-55555555'
+    assert result[1]['ImageId'] == 'ami-12345678'
+    assert result[2]['ImageId'] == 'ami-87654321'
+
+
+@patch('cartography.intel.aws.ec2.images.get_botocore_config')
+@patch('boto3.session.Session')
+def test_get_images_not_found(mock_boto3_session, mock_get_botocore_config):
+    region = 'us-west-2'
+    image_ids = ['ami-12345678', 'ami-87654321']
+
+    mock_client = MagicMock()
+    mock_boto3_session.return_value = mock_client
+    mock_client.describe_images.side_effect = ClientError(
+        error_response={'Error': {'Code': 'InvalidAMIID.NotFound', 'Message': 'The image id does not exist'}},
+        operation_name='DescribeImages',
+    )
+
+    mock_get_botocore_config.return_value = {}
+
+    result = get_images(mock_boto3_session, region, image_ids)
+
+    assert result == []
+
+
+@patch('cartography.intel.aws.ec2.images.get_botocore_config')
+@patch('boto3.session.Session')
+def test_get_images_no_image_ids(mock_boto3_session, mock_get_botocore_config):
+    region = 'us-west-2'
+    image_ids = []
+
+    mock_client = MagicMock()
+    mock_boto3_session.client.return_value = mock_client
+    mock_client.describe_images.side_effect = [
+        {'Images': [{'ImageId': 'ami-12345678'}]},
+    ]
+
+    mock_get_botocore_config.return_value = {}
+
+    result = get_images(mock_boto3_session, region, image_ids)
+
+    assert len(result) == 1
+    assert result[0]['ImageId'] == 'ami-12345678'

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/tests/unit/cartography/intel/aws/test_inspector.py

@@ -67,6 +67,34 @@ def test_transform_inspector_findings_package():
                 'kernel|X86_64|4.9.17|6.29.amzn1|0',
             ],
         },
+        {
+            'id': 'arn:aws:test789',
+            'arn': 'arn:aws:test789',
+            'vulnerabilityid': 'CVE-2023-1234',
+            'instanceid': 'i-88503981029833101',
+            'severity': 'HIGH',
+            'name': 'CVE-2023-1234 - openssl',
+            'firstobservedat': datetime(2022, 5, 4, 16, 23, 3, 692000),
+            'updatedat': datetime(2022, 5, 4, 16, 23, 3, 692000),
+            'awsaccount': '123456789011',
+            'description': 'A buffer overflow vulnerability in OpenSSL allows remote attackers '
+            'to execute arbitrary code or cause a denial of service via crafted '
+            'SSL/TLS handshake messages.',
+            'cvssscore': 7.5,
+            'type': 'PACKAGE_VULNERABILITY',
+            'referenceurls': ['https://nvd.nist.gov/vuln/detail/CVE-2023-1234'],
+            'relatedvulnerabilities': [],
+            'source': 'NVD',
+            'vendorcreatedat': datetime(2023, 1, 15, 10, 0),
+            'vendorupdatedat': None,
+            'vendorseverity': 'High',
+            'sourceurl': 'https://nvd.nist.gov/vuln/detail/CVE-2023-1234',
+            'status': 'ACTIVE',
+
+            'vulnerablepackageids': [
+                'openssl|X86_64|1.0.2k|1.amzn2|0',
+            ],
+        },
     ]
     assert packages == [
         {
@@ -97,4 +125,18 @@ def test_transform_inspector_findings_package():
             'sourcelayerhash': None,
             'version': '4.9.17',
         },
+        {
+            'arch': 'X86_64',
+            'awsaccount': '123456789011',
+            'epoch': 0,
+            'filepath': None,
+            'findingarn': 'arn:aws:test789',
+            'fixedinversion': None,
+            'id': 'openssl|X86_64|1.0.2k|1.amzn2|0',
+            'manager': 'OS',
+            'name': 'openssl',
+            'release': '1.amzn2',
+            'sourcelayerhash': None,
+            'version': '1.0.2k',
+        },
     ]

{cartography-0.98.0rc5 → cartography-0.99.0rc1}/tests/unit/cartography/intel/aws/test_resourcegroupstaggingapi.py

@@ -1,4 +1,5 @@
 import copy
+from unittest.mock import MagicMock
 
 import cartography.intel.aws.resourcegroupstaggingapi as rgta
 import tests.data.aws.resourcegroupstaggingapi as test_data
@@ -44,3 +45,28 @@ def test_transform_tags():
     assert 'resource_id' not in get_resources_response[0]
     rgta.transform_tags(get_resources_response, 'ec2:instance')
     assert 'resource_id' in get_resources_response[0]
+
+
+def test_load_tags_empty_data():
+    """
+    Ensure that the load_tags function returns early if the tag_data is empty
+    """
+    # Arrange
+    mock_neo4j_session = MagicMock()
+    resource_type = 'ec2:instance'
+    region = 'us-east-1'
+    account_id = '123456789012'
+    update_tag = 123456789
+
+    # Act
+    rgta.load_tags(
+        neo4j_session=mock_neo4j_session,
+        tag_data={},
+        resource_type=resource_type,
+        region=region,
+        current_aws_account_id=account_id,
+        aws_update_tag=update_tag,
+    )
+
+    # Assert
+    mock_neo4j_session.write_transaction.assert_not_called()