cloudg 0.5.2__tar.gz → 0.5.3__tar.gz

{cloudg-0.5.2 → cloudg-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudg
-Version: 0.5.2
+Version: 0.5.3
 Summary: cloudg (cloud graphing) - multi-cloud infrastructure mapping, knowledge graphs and security intelligence for AWS, Azure and GCP
 Project-URL: Homepage, https://github.com/morpheuslord/cloudg
 Project-URL: Repository, https://github.com/morpheuslord/cloudg

{cloudg-0.5.2 → cloudg-0.5.3}/README.md

@@ -5,7 +5,7 @@
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.11%2B-blue.svg" alt="Python 3.11+">
-  <img src="https://img.shields.io/badge/version-0.5.2-4c1.svg" alt="Version 0.5.2">
+  <img src="https://img.shields.io/badge/version-0.5.3-4c1.svg" alt="Version 0.5.3">
   <a href="https://github.com/astral-sh/uv"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json" alt="uv"></a>
 </p>
 

{cloudg-0.5.2 → cloudg-0.5.3}/cloudg/__init__.py

@@ -1,6 +1,6 @@
 """cloudg — cloud graphing: multi-cloud mapping and security intelligence."""
 
-__version__ = "0.5.2"
+__version__ = "0.5.3"
 
 from cloudg.api import (
     AnalysisResult,

{cloudg-0.5.2 → cloudg-0.5.3}/cloudg/inventory/gcp_relations/context.py

@@ -8,7 +8,7 @@ from dataclasses import dataclass, field
 from typing import Any, Callable, Iterable
 
 from cloudg.inventory.aws_services._base import rel
-from cloudg.inventory.gcp_relations.names import kms_refs, sa_email, sa_ref
+from cloudg.inventory.gcp_relations.names import asset_type_service, kms_refs, sa_email, sa_ref
 from cloudg.schema.models import CloudAsset, EdgeType
 
 logger = logging.getLogger(__package__)
@@ -124,7 +124,7 @@ def extract(ctx: GCPContext) -> Extracted:
         except Exception as exc:  # one malformed resource must not stop the sweep
             logger.debug("GCP extractor failed for %s: %s", ctx.name, exc, exc_info=True)
             out.metadata["extraction_error"] = f"{type(exc).__name__}: {exc}"
-    if ctx.asset_type.startswith("cloudkms.googleapis.com/"):
+    if asset_type_service(ctx.asset_type) == "cloudkms":
         return out
     keys = kms_refs(ctx.data)
     if keys:

{cloudg-0.5.2 → cloudg-0.5.3}/cloudg/inventory/gcp_relations/iam.py

@@ -16,6 +16,7 @@ from cloudg.inventory.gcp_relations.names import (
     PUBLIC_MEMBERS,
     _list,
     _num,
+    api_service,
     dig,
     sa_email,
     sa_ref,
@@ -252,7 +253,7 @@ def _mark_public(target: CloudAsset, member: str, role: str) -> None:
 def _is_sa_resource(resource: str) -> bool:
     return (
         "/serviceAccounts/" in resource
-        and resource.startswith("//iam.googleapis.com/")
+        and api_service(resource) == "iam"
         and "/keys/" not in resource
     )
 

{cloudg-0.5.2 → cloudg-0.5.3}/cloudg/inventory/gcp_relations/names.py

@@ -38,6 +38,10 @@ _API_URL_RE = re.compile(
 )
 _BARE_API_RE = re.compile(r"^([a-z0-9-]+)\.googleapis\.com/(.+)$")
 _KEY_VERSION_RE = re.compile(r"/cryptoKeyVersions/[^/]+$")
+# API service of a full resource name ("//<svc>.googleapis.com/...") or of an
+# asset type ("<svc>.googleapis.com/Type"), anchored at the start
+_FULL_NAME_SERVICE_RE = re.compile(r"^//([a-z0-9-]+)\.googleapis\.com/")
+_ASSET_TYPE_SERVICE_RE = re.compile(r"^([a-z0-9-]+)\.googleapis\.com/")
 _CRYPTO_KEY_RE = re.compile(
     r"(projects/[^/\s\"']+/locations/[^/\s\"']+/keyRings/[^/\s\"']+/cryptoKeys/[^/\s\"']+)"
 )
@@ -161,13 +165,26 @@ def _bare_api_full_name(service: str, rest: str) -> str:
     return f"//{svc}.googleapis.com/{rest}"
 
 
+def api_service(name: Any) -> str | None:
+    """API service of a full resource name: ``//compute.googleapis.com/...`` -> ``compute``."""
+    m = _FULL_NAME_SERVICE_RE.match(name) if isinstance(name, str) else None
+    return m.group(1) if m else None
+
+
+def asset_type_service(asset_type: Any) -> str | None:
+    """API service of a CAI asset type: ``cloudkms.googleapis.com/CryptoKey`` -> ``cloudkms``."""
+    m = _ASSET_TYPE_SERVICE_RE.match(asset_type) if isinstance(asset_type, str) else None
+    return m.group(1) if m else None
+
+
 def _canonical_full_name(out: str) -> str:
     """Drop query/fragment and key versions; fold service aliases."""
     out = out.split("?", 1)[0].split("#", 1)[0].rstrip("/")
     out = _KEY_VERSION_RE.sub("", out)
-    if out.startswith("//sqladmin.googleapis.com/"):
-        out = "//cloudsql.googleapis.com/" + out[len("//sqladmin.googleapis.com/") :]
-    if out.startswith("//container.googleapis.com/"):
+    service = api_service(out)
+    if service == "sqladmin":
+        out = "//cloudsql.googleapis.com/" + relative_name(out)
+    elif service == "container":
         out = out.replace("/zones/", "/locations/")
     return out
 

{cloudg-0.5.2 → cloudg-0.5.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cloudg"
-version = "0.5.2"
+version = "0.5.3"
 description = "cloudg (cloud graphing) - multi-cloud infrastructure mapping, knowledge graphs and security intelligence for AWS, Azure and GCP"
 # The PyPI project page renders the full documentation, not the repo README
 readme = "docs/DOCUMENTATION.md"

{cloudg-0.5.2 → cloudg-0.5.3}/tests/test_aws_network_ext.py

@@ -660,7 +660,7 @@ class TestEdgeAndResolver:
         for key in ("status", "domain_name", "origins", "web_acl_id", "viewer_protocol_policy"):
             assert key in cf_asset.metadata, key
         assert cf_asset.metadata["viewer_protocol_policy"] == "redirect-to-https"
-        assert "www.example.com" in cf_asset.metadata["aliases"]
+        assert {"www.example.com"} <= set(cf_asset.metadata["aliases"])
         assert "s3cr3t" not in json.dumps(cf_asset.model_dump(mode="json"))
         bucket, logs_bucket, alb_asset = (
             by_arn["arn:aws:s3:::site-assets"],
@@ -986,7 +986,7 @@ class TestFakeClientCollectors:
         accel = _one(assets, AssetType.GLOBAL_ACCELERATOR)
         assert accel.is_internet_exposed and accel.region == "global"
         assert accel.metadata["ip_addresses"] == ["75.2.0.1", "99.83.0.1"]
-        assert "a1234.awsglobalaccelerator.com" in accel.metadata["aliases"]
+        assert {"a1234.awsglobalaccelerator.com"} <= set(accel.metadata["aliases"])
         alb_asset = next(a for a in assets if a.arn == alb)
         assert _edge(edges, accel, alb_asset, EdgeType.LOAD_BALANCER_TARGET)
         assert ("list_custom_routing_accelerators", {}) in ga.calls

{cloudg-0.5.2 → cloudg-0.5.3}/tests/test_inventory_deep.py

@@ -744,7 +744,7 @@ class TestDeepServiceCollectors:
         assert _edge(edges, bucket, queue, EdgeType.INVOKES)  # S3 notification
         assert _edge(edges, role, queue, EdgeType.GRANTS_ACCESS)  # inline policy grant
         assert role.metadata["trusted_external_accounts"] == ["999999999999"]
-        assert "lambda.amazonaws.com" in role.metadata["trusted_services"]
+        assert {"lambda.amazonaws.com"} <= set(role.metadata["trusted_services"])
 
     def test_disabled_security_services_are_visible(self, aws_credentials):
         session = boto3.Session(region_name="us-east-1")