Adding support for determining the last used date of an access keys #1101

csanders-git · 2023-01-30T19:09:45Z

No description provided.

cartography/intel/aws/iam.py

ramonpetgrave64 · 2023-01-30T20:28:52Z

cartography/data/jobs/cleanup/aws_import_account_access_key_cleanup.json

+      "iterative": true,
+      "iterationsize": 100
+    }
+  ],


cleanup the relationship as well

Suggested change

],

{

"query": "MATCH (UserAccessKey)<-[r:AWS_ACCESS_KEY]-(:AWSUser)<-[:RESOURCE]-(:AWSAccount{id: $AWS_ID}) WHERE r.lastupdated <> $UPDATE_TAG WITH n LIMIT $LIMIT_SIZE DELETE (r)",

"iterative": true,

"iterationsize": 100

}

],

not really sure what the changes being outlined here are

This is just the standard for cartography.

cleanup stale nodes

cleanup stale relationships that are still attached to fresh nodes

This shouldn't really be needed for access keys, since a given access key should only ever relate to one user in its lifetime. But you never know.

ramonpetgrave64 · 2023-01-30T20:34:12Z

cartography/data/indexes.cypher

@@ -65,8 +65,8 @@ CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSVpc) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSVpc) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AccountAccessKey) ON (n.accesskeyid);
-CREATE INDEX IF NOT EXISTS FOR (n:AccountAccessKey) ON (n.lastupdated);
+CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.accesskeyid);


Add an additional property id, which is will be equivalent to accesskeyid

I think this might be on a previous version of the code - as it currently stands the following is the code

CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.accesskeyid); CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.lastupdated);

this is what I mean, along with another suggestion below upon MERGE

Suggested change

CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.accesskeyid);

CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.id);

CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.accesskeyid);

Co-authored-by: Ramon Petgrave <[email protected]>

ramonpetgrave64

Looks alright. Just a few comments. Also try to add an integration test.

ramonpetgrave64 · 2023-02-15T00:37:52Z

cartography/data/jobs/cleanup/aws_import_account_access_key_cleanup.json

+      "iterative": true,
+      "iterationsize": 100
+    }
+  ],


This is just the standard for cartography.

cleanup stale nodes

cleanup stale relationships that are still attached to fresh nodes

This shouldn't really be needed for access keys, since a given access key should only ever relate to one user in its lifetime. But you never know.

ramonpetgrave64 · 2023-02-15T00:42:26Z

cartography/intel/aws/iam.py

    MATCH (user:AWSUser{arn: $UserARN})
    WITH user
-    MERGE (key:AccountAccessKey{accesskeyid: $AccessKeyId})
+    MERGE (key:UserAccessKey{accesskeyid: $AccessKeyId})


Suggested change

MERGE (key:UserAccessKey{accesskeyid: $AccessKeyId})

MERGE (key:UserAccessKey{accesskeyid: $AccessKeyId, id:$AccessKeyId})

ramonpetgrave64 · 2023-02-15T00:43:49Z

cartography/data/indexes.cypher

@@ -65,8 +65,8 @@ CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSVpc) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSVpc) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AccountAccessKey) ON (n.accesskeyid);
-CREATE INDEX IF NOT EXISTS FOR (n:AccountAccessKey) ON (n.lastupdated);
+CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.accesskeyid);


this is what I mean, along with another suggestion below upon MERGE

Suggested change

CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.accesskeyid);

CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.id);

CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.accesskeyid);

ramonpetgrave64 · 2023-02-15T01:48:13Z

Also, about the CLA check. It looks like you need to go back and edit the first two commits' authors to be explicitly set to @csanders-git. And then force-push.

…1169) Redo of #1101 1. Add access keys last used data 2. cleanup unattached AccessKey nodes. This happens when the associated User no longer exists. ### Testing No unit tests, but I did test manually.

…artography-cncf#1169) Redo of cartography-cncf#1101 1. Add access keys last used data 2. cleanup unattached AccessKey nodes. This happens when the associated User no longer exists. ### Testing No unit tests, but I did test manually.

Adding support for access keys last used

9b50e35

csanders-git requested a review from ramonpetgrave64 January 30, 2023 19:09

Updating cleanup jobs for new key name

bce38a9

ramonpetgrave64 reviewed Jan 30, 2023

View reviewed changes

cartography/intel/aws/iam.py Outdated Show resolved Hide resolved

ramonpetgrave64 requested changes Jan 30, 2023

View reviewed changes

ramonpetgrave64 reviewed Jan 30, 2023

View reviewed changes

csanders-git and others added 2 commits January 31, 2023 20:54

Update cartography/intel/aws/iam.py

27bbc25

Co-authored-by: Ramon Petgrave <[email protected]>

Adding support for most recent service and region

bc585c5

csanders-git requested a review from ramonpetgrave64 February 1, 2023 05:11

ramonpetgrave64 requested changes Feb 15, 2023

View reviewed changes

Merge branch 'master' into iam_last_accessed

ed8d4af

ramonpetgrave64 mentioned this pull request May 8, 2023

AWS: IAM: Add access keys last used data, cleanup unattached nodes #1169

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding support for determining the last used date of an access keys #1101

Adding support for determining the last used date of an access keys #1101

csanders-git commented Jan 30, 2023

ramonpetgrave64 Jan 30, 2023

csanders-git Feb 1, 2023

ramonpetgrave64 Feb 15, 2023

ramonpetgrave64 Jan 30, 2023

csanders-git Feb 1, 2023

ramonpetgrave64 Feb 15, 2023

ramonpetgrave64 left a comment

ramonpetgrave64 Feb 15, 2023

ramonpetgrave64 Feb 15, 2023

ramonpetgrave64 Feb 15, 2023

ramonpetgrave64 commented Feb 15, 2023

	CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.accesskeyid);
	CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.id);
	CREATE INDEX IF NOT EXISTS FOR (n:UserAccessKey) ON (n.accesskeyid);

	MERGE (key:UserAccessKey{accesskeyid: $AccessKeyId})
	MERGE (key:UserAccessKey{accesskeyid: $AccessKeyId, id:$AccessKeyId})

Adding support for determining the last used date of an access keys #1101

Are you sure you want to change the base?

Adding support for determining the last used date of an access keys #1101

Conversation

csanders-git commented Jan 30, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ramonpetgrave64 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ramonpetgrave64 commented Feb 15, 2023