Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AWS: Extend aws_handle_regions to cover IAM get functions #1227

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

AWS: Extend aws_handle_regions to cover IAM get functions #1227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions cartography/intel/aws/iam.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
from cartography.intel.aws.permission_relationships import parse_statement_node
from cartography.intel.aws.permission_relationships import principal_allowed_on_resource
from cartography.stats import get_stats_client
from cartography.util import aws_handle_regions
from cartography.util import merge_module_sync_metadata
from cartography.util import run_cleanup_job
from cartography.util import timeit
Expand All @@ -33,6 +34,7 @@ def get_policy_name_from_arn(arn: str) -> str:


@timeit
@aws_handle_regions
def get_group_policies(boto3_session: boto3.session.Session, group_name: str) -> Dict:
client = boto3_session.client('iam')
paginator = client.get_paginator('list_group_policies')
Expand All @@ -43,6 +45,7 @@ def get_group_policies(boto3_session: boto3.session.Session, group_name: str) ->


@timeit
@aws_handle_regions
def get_group_policy_info(
boto3_session: boto3.session.Session, group_name: str, policy_name: str,
) -> Any:
Expand All @@ -51,6 +54,7 @@ def get_group_policy_info(


@timeit
@aws_handle_regions
def get_group_membership_data(boto3_session: boto3.session.Session, group_name: str) -> Dict:
client = boto3_session.client('iam')
try:
Expand All @@ -63,6 +67,7 @@ def get_group_membership_data(boto3_session: boto3.session.Session, group_name:


@timeit
@aws_handle_regions
def get_group_policy_data(boto3_session: boto3.session.Session, group_list: List[Dict]) -> Dict:
resource_client = boto3_session.resource('iam')
policies = {}
Expand All @@ -75,6 +80,7 @@ def get_group_policy_data(boto3_session: boto3.session.Session, group_list: List


@timeit
@aws_handle_regions
def get_group_managed_policy_data(boto3_session: boto3.session.Session, group_list: List[Dict]) -> Dict:
resource_client = boto3_session.resource('iam')
policies = {}
Expand All @@ -90,6 +96,7 @@ def get_group_managed_policy_data(boto3_session: boto3.session.Session, group_li


@timeit
@aws_handle_regions
def get_user_policy_data(boto3_session: boto3.session.Session, user_list: List[Dict]) -> Dict:
resource_client = boto3_session.resource('iam')
policies = {}
Expand All @@ -107,6 +114,7 @@ def get_user_policy_data(boto3_session: boto3.session.Session, user_list: List[D


@timeit
@aws_handle_regions
def get_user_managed_policy_data(boto3_session: boto3.session.Session, user_list: List[Dict]) -> Dict:
resource_client = boto3_session.resource('iam')
policies = {}
Expand All @@ -127,6 +135,7 @@ def get_user_managed_policy_data(boto3_session: boto3.session.Session, user_list


@timeit
@aws_handle_regions
def get_role_policy_data(boto3_session: boto3.session.Session, role_list: List[Dict]) -> Dict:
resource_client = boto3_session.resource('iam')
policies = {}
Expand All @@ -144,6 +153,7 @@ def get_role_policy_data(boto3_session: boto3.session.Session, role_list: List[D


@timeit
@aws_handle_regions
def get_role_managed_policy_data(boto3_session: boto3.session.Session, role_list: List[Dict]) -> Dict:
resource_client = boto3_session.resource('iam')
policies = {}
Expand All @@ -164,6 +174,7 @@ def get_role_managed_policy_data(boto3_session: boto3.session.Session, role_list


@timeit
@aws_handle_regions
def get_role_tags(boto3_session: boto3.session.Session) -> List[Dict]:
role_list = get_role_list_data(boto3_session)['Roles']
resource_client = boto3_session.resource('iam')
Expand All @@ -186,6 +197,7 @@ def get_role_tags(boto3_session: boto3.session.Session) -> List[Dict]:


@timeit
@aws_handle_regions
def get_user_list_data(boto3_session: boto3.session.Session) -> Dict:
client = boto3_session.client('iam')

Expand All @@ -197,6 +209,7 @@ def get_user_list_data(boto3_session: boto3.session.Session) -> Dict:


@timeit
@aws_handle_regions
def get_group_list_data(boto3_session: boto3.session.Session) -> Dict:
client = boto3_session.client('iam')
paginator = client.get_paginator('list_groups')
Expand All @@ -207,6 +220,7 @@ def get_group_list_data(boto3_session: boto3.session.Session) -> Dict:


@timeit
@aws_handle_regions
def get_role_list_data(boto3_session: boto3.session.Session) -> Dict:
client = boto3_session.client('iam')
paginator = client.get_paginator('list_roles')
Expand All @@ -217,6 +231,7 @@ def get_role_list_data(boto3_session: boto3.session.Session) -> Dict:


@timeit
@aws_handle_regions
def get_account_access_key_data(boto3_session: boto3.session.Session, username: str) -> Dict:
client = boto3_session.client('iam')
# NOTE we can get away without using a paginator here because users are limited to two access keys
Expand Down Expand Up @@ -426,6 +441,7 @@ def load_group_memberships(neo4j_session: neo4j.Session, group_memberships: Dict


@timeit
@aws_handle_regions
def get_policies_for_principal(neo4j_session: neo4j.Session, principal_arn: str) -> Dict:
get_policy_query = """
MATCH
Expand Down
8 changes: 6 additions & 2 deletions cartography/util.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,14 @@
import re
import sys
from functools import wraps
from inspect import signature
from string import Template
from typing import Any
from typing import BinaryIO
from typing import Callable
from typing import cast
from typing import Dict
from typing import get_origin
from typing import Iterable
from typing import List
from typing import Optional
Expand Down Expand Up @@ -193,7 +195,7 @@ def aws_paginate(
return items


AWSGetFunc = TypeVar('AWSGetFunc', bound=Callable[..., List])
AWSGetFunc = TypeVar('AWSGetFunc', bound=Union[Callable[..., List], Callable[..., Dict[Any, Any]]])

# fix for AWS TooManyRequestsException
# https://github.com/lyft/cartography/issues/297
Expand Down Expand Up @@ -249,7 +251,9 @@ def inner_function(*args, **kwargs): # type: ignore
# so we can continue without raising an exception
if e.response['Error']['Code'] in ERROR_CODES:
logger.warning("{} in this region. Skipping...".format(e.response['Error']['Message']))
return []
return_type = signature(func).return_annotation
return_type_base = get_origin(return_type)
return return_type_base.__new__(cast(Any, return_type_base))
else:
raise
return cast(AWSGetFunc, inner_function)
Expand Down
Loading