How to use the cartography.intel.aws function in cartography

To help you get started, we’ve selected a few cartography examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github lyft / cartography / tests / integration / cartography / intel / aws / test_ec2.py View on Github external
SET group2.last_updated = {aws_update_tag}
        """,
        ec2_instance_id=ec2_instance_id,
        aws_account_id=TEST_ACCOUNT_ID,
        aws_update_tag=TEST_UPDATE_TAG,
        GROUP_ID_1=sg_group_id,
        GROUP_ID_2=sg_group_id_2,
    )

    # Makes elbv2
    # (aa)-[r:RESOURCE]->(elbv2)
    # also makes
    # (elbv2)->[RESOURCE]->(EC2Subnet)
    # also makes (relationship only, won't create SG)
    # (elbv2)->[MEMBER_OF_SECURITY_GROUP]->(EC2SecurityGroup)
    cartography.intel.aws.ec2.load_load_balancer_v2s(
        neo4j_session,
        dict(LoadBalancers=load_balancer_data),
        TEST_REGION,
        TEST_ACCOUNT_ID,
        TEST_UPDATE_TAG,
    )

    # verify the db has (aa)-[r:RESOURCE]->(elbv2)-[r:ELBV2_LISTENER]->(l)
    nodes = neo4j_session.run(
        """
        MATCH (aa:AWSAccount{id: {AWS_ACCOUNT_ID}})
            -[r1:RESOURCE]->(elbv2:LoadBalancerV2{id: {ID}})
            -[r2:ELBV2_LISTENER]->(l:ELBV2Listener{id: {LISTENER_ARN}})
        RETURN aa.id, elbv2.id, l.id
        """,
        AWS_ACCOUNT_ID=TEST_ACCOUNT_ID,
github lyft / cartography / tests / integration / cartography / intel / aws / test_dynamodb.py View on Github external
def test_load_dynamodb(neo4j_session):
    data = tests.data.aws.dynamodb.LIST_DYNAMODB_TABLES

    cartography.intel.aws.dynamodb.load_dynamodb_tables(
        neo4j_session,
        data,
        TEST_REGION,
        TEST_ACCOUNT_ID,
        TEST_UPDATE_TAG,
    )
    expected_rows = 1000000
    expected_nodes = {
        ("arn:aws:dynamodb:us-east-1:000000000000:table/example-table", expected_rows),
        ("arn:aws:dynamodb:us-east-1:000000000000:table/sample-table", expected_rows),
        ("arn:aws:dynamodb:us-east-1:000000000000:table/model-table", expected_rows),
        ("arn:aws:dynamodb:us-east-1:000000000000:table/basic-table", expected_rows),
    }

    nodes = neo4j_session.run(
        """
github lyft / cartography / tests / integration / cartography / intel / aws / test_ec2.py View on Github external
MERGE (ec2:EC2Instance{instanceid: {ec2_instance_id}})
        ON CREATE SET ec2.firstseen = timestamp()
        SET ec2.lastupdated = {aws_update_tag}

        MERGE (aws:AWSAccount{id: {aws_account_id}})
        ON CREATE SET aws.firstseen = timestamp()
        SET aws.lastupdated = {aws_update_tag}
        """,
        load_balancer_id=load_balancer_id,
        ec2_instance_id=ec2_instance_id,
        aws_account_id=TEST_ACCOUNT_ID,
        aws_update_tag=TEST_UPDATE_TAG,
    )

    cartography.intel.aws.ec2.load_load_balancer_v2_target_groups(
        neo4j_session,
        load_balancer_id,
        target_groups,
        TEST_ACCOUNT_ID,
        TEST_UPDATE_TAG,
    )

    # verify the db has (load_balancer_id)-[r:EXPOSE]->(instance)
    nodes = neo4j_session.run(
        """
        MATCH (elbv2:LoadBalancerV2{id: {ID}})-[r:EXPOSE]->(instance:EC2Instance{instanceid: {INSTANCE_ID}})
        RETURN elbv2.id, instance.instanceid
        """,
        ID=load_balancer_id,
        INSTANCE_ID=ec2_instance_id,
    )
github lyft / cartography / tests / integration / cartography / intel / aws / test_ecr.py View on Github external
def test_load_ecr_repositories(neo4j_session):
    data = tests.data.aws.ecr.DESCRIBE_REPOSITORIES

    cartography.intel.aws.ecr.load_ecr_repositories(
        neo4j_session,
        data,
        TEST_REGION,
        TEST_ACCOUNT_ID,
        TEST_UPDATE_TAG,
    )
    expected_nodes = {
        "arn:aws:ecr:us-east-1:000000000000:repository/example-repository",
        "arn:aws:ecr:us-east-1:000000000000:repository/sample-repository",
        "arn:aws:ecr:us-east-1:000000000000:repository/test-repository",
    }

    nodes = neo4j_session.run(
        """
        MATCH (r:ECRRepository) RETURN r.arn;
        """
github lyft / cartography / tests / integration / cartography / intel / aws / test_ecr.py View on Github external
def test_load_ecr_repository_images(neo4j_session):
    repo_data = tests.data.aws.ecr.DESCRIBE_REPOSITORIES

    cartography.intel.aws.ecr.load_ecr_repositories(
        neo4j_session,
        repo_data,
        TEST_REGION,
        TEST_ACCOUNT_ID,
        TEST_UPDATE_TAG,
    )

    data = tests.data.aws.ecr.LIST_REPOSITORY_IMAGES

    cartography.intel.aws.ecr.load_ecr_images(
        neo4j_session,
        data,
        TEST_REGION,
        TEST_UPDATE_TAG,
    )

    # TODO it's possible to have the same image in multiple repositories -- current code doesn't represent that in the
    #      graph well
    expected_nodes = {
        (
            'arn:aws:ecr:us-east-1:000000000000:repository/example-repository',
            'sha256:0000000000000000000000000000000000000000000000000000000000000000',
            '1',
        ),
        (
            'arn:aws:ecr:us-east-1:000000000000:repository/example-repository',
github lyft / cartography / tests / integration / cartography / intel / aws / test_iam.py View on Github external
def test_load_users(neo4j_session):
    data = tests.data.aws.iam.LIST_USERS['Users']

    cartography.intel.aws.iam.load_users(
        neo4j_session,
        data,
        TEST_ACCOUNT_ID,
        TEST_UPDATE_TAG
    )
github lyft / cartography / tests / integration / cartography / intel / aws / test_iam.py View on Github external
def test_load_groups(neo4j_session):
    data = tests.data.aws.iam.LIST_GROUPS['Groups']

    cartography.intel.aws.iam.load_groups(
        neo4j_session,
        data,
        TEST_ACCOUNT_ID,
        TEST_UPDATE_TAG
    )
github lyft / cartography / cartography / sync.py View on Github external
def build_default_sync():
    """
    Build the default cartography sync, which runs all intelligence modules shipped with the cartography package.

    :rtype: cartography.sync.Sync
    :return: The default cartography sync object.
    """
    sync = Sync()
    sync.add_stages([
        ('create-indexes', cartography.intel.create_indexes.run),
        ('aws', cartography.intel.aws.start_aws_ingestion),
        ('gcp', cartography.intel.gcp.start_gcp_ingestion),
        ('gsuite', cartography.intel.gsuite.start_gsuite_ingestion),
        ('crxcavator', cartography.intel.crxcavator.start_extension_ingestion),
        ('analysis', cartography.intel.analysis.run),
    ])
    return sync