Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
SET group2.last_updated = {aws_update_tag}
""",
ec2_instance_id=ec2_instance_id,
aws_account_id=TEST_ACCOUNT_ID,
aws_update_tag=TEST_UPDATE_TAG,
GROUP_ID_1=sg_group_id,
GROUP_ID_2=sg_group_id_2,
)
# Makes elbv2
# (aa)-[r:RESOURCE]->(elbv2)
# also makes
# (elbv2)->[RESOURCE]->(EC2Subnet)
# also makes (relationship only, won't create SG)
# (elbv2)->[MEMBER_OF_SECURITY_GROUP]->(EC2SecurityGroup)
cartography.intel.aws.ec2.load_load_balancer_v2s(
neo4j_session,
dict(LoadBalancers=load_balancer_data),
TEST_REGION,
TEST_ACCOUNT_ID,
TEST_UPDATE_TAG,
)
# verify the db has (aa)-[r:RESOURCE]->(elbv2)-[r:ELBV2_LISTENER]->(l)
nodes = neo4j_session.run(
"""
MATCH (aa:AWSAccount{id: {AWS_ACCOUNT_ID}})
-[r1:RESOURCE]->(elbv2:LoadBalancerV2{id: {ID}})
-[r2:ELBV2_LISTENER]->(l:ELBV2Listener{id: {LISTENER_ARN}})
RETURN aa.id, elbv2.id, l.id
""",
AWS_ACCOUNT_ID=TEST_ACCOUNT_ID,
def test_load_dynamodb(neo4j_session):
data = tests.data.aws.dynamodb.LIST_DYNAMODB_TABLES
cartography.intel.aws.dynamodb.load_dynamodb_tables(
neo4j_session,
data,
TEST_REGION,
TEST_ACCOUNT_ID,
TEST_UPDATE_TAG,
)
expected_rows = 1000000
expected_nodes = {
("arn:aws:dynamodb:us-east-1:000000000000:table/example-table", expected_rows),
("arn:aws:dynamodb:us-east-1:000000000000:table/sample-table", expected_rows),
("arn:aws:dynamodb:us-east-1:000000000000:table/model-table", expected_rows),
("arn:aws:dynamodb:us-east-1:000000000000:table/basic-table", expected_rows),
}
nodes = neo4j_session.run(
"""
MERGE (ec2:EC2Instance{instanceid: {ec2_instance_id}})
ON CREATE SET ec2.firstseen = timestamp()
SET ec2.lastupdated = {aws_update_tag}
MERGE (aws:AWSAccount{id: {aws_account_id}})
ON CREATE SET aws.firstseen = timestamp()
SET aws.lastupdated = {aws_update_tag}
""",
load_balancer_id=load_balancer_id,
ec2_instance_id=ec2_instance_id,
aws_account_id=TEST_ACCOUNT_ID,
aws_update_tag=TEST_UPDATE_TAG,
)
cartography.intel.aws.ec2.load_load_balancer_v2_target_groups(
neo4j_session,
load_balancer_id,
target_groups,
TEST_ACCOUNT_ID,
TEST_UPDATE_TAG,
)
# verify the db has (load_balancer_id)-[r:EXPOSE]->(instance)
nodes = neo4j_session.run(
"""
MATCH (elbv2:LoadBalancerV2{id: {ID}})-[r:EXPOSE]->(instance:EC2Instance{instanceid: {INSTANCE_ID}})
RETURN elbv2.id, instance.instanceid
""",
ID=load_balancer_id,
INSTANCE_ID=ec2_instance_id,
)
def test_load_ecr_repositories(neo4j_session):
data = tests.data.aws.ecr.DESCRIBE_REPOSITORIES
cartography.intel.aws.ecr.load_ecr_repositories(
neo4j_session,
data,
TEST_REGION,
TEST_ACCOUNT_ID,
TEST_UPDATE_TAG,
)
expected_nodes = {
"arn:aws:ecr:us-east-1:000000000000:repository/example-repository",
"arn:aws:ecr:us-east-1:000000000000:repository/sample-repository",
"arn:aws:ecr:us-east-1:000000000000:repository/test-repository",
}
nodes = neo4j_session.run(
"""
MATCH (r:ECRRepository) RETURN r.arn;
"""
def test_load_ecr_repository_images(neo4j_session):
repo_data = tests.data.aws.ecr.DESCRIBE_REPOSITORIES
cartography.intel.aws.ecr.load_ecr_repositories(
neo4j_session,
repo_data,
TEST_REGION,
TEST_ACCOUNT_ID,
TEST_UPDATE_TAG,
)
data = tests.data.aws.ecr.LIST_REPOSITORY_IMAGES
cartography.intel.aws.ecr.load_ecr_images(
neo4j_session,
data,
TEST_REGION,
TEST_UPDATE_TAG,
)
# TODO it's possible to have the same image in multiple repositories -- current code doesn't represent that in the
# graph well
expected_nodes = {
(
'arn:aws:ecr:us-east-1:000000000000:repository/example-repository',
'sha256:0000000000000000000000000000000000000000000000000000000000000000',
'1',
),
(
'arn:aws:ecr:us-east-1:000000000000:repository/example-repository',
def test_load_users(neo4j_session):
data = tests.data.aws.iam.LIST_USERS['Users']
cartography.intel.aws.iam.load_users(
neo4j_session,
data,
TEST_ACCOUNT_ID,
TEST_UPDATE_TAG
)
def test_load_groups(neo4j_session):
data = tests.data.aws.iam.LIST_GROUPS['Groups']
cartography.intel.aws.iam.load_groups(
neo4j_session,
data,
TEST_ACCOUNT_ID,
TEST_UPDATE_TAG
)
def build_default_sync():
"""
Build the default cartography sync, which runs all intelligence modules shipped with the cartography package.
:rtype: cartography.sync.Sync
:return: The default cartography sync object.
"""
sync = Sync()
sync.add_stages([
('create-indexes', cartography.intel.create_indexes.run),
('aws', cartography.intel.aws.start_aws_ingestion),
('gcp', cartography.intel.gcp.start_gcp_ingestion),
('gsuite', cartography.intel.gsuite.start_gsuite_ingestion),
('crxcavator', cartography.intel.crxcavator.start_extension_ingestion),
('analysis', cartography.intel.analysis.run),
])
return sync