-
Notifications
You must be signed in to change notification settings - Fork 418
Open
Labels
module:AWSRelated to cartography's AWS moduleRelated to cartography's AWS module
Description
Description:
What issue is being seen?
- target_label: EC2Instance
permissions:
- ssm:StartSession
- ssm:DescribeSessions
- ssm:GetConnectionStatus
relationship_name: SSM_FULL_ACCESS
Adding the above relationship mapping causes the permission_relationships sync to crash.
To Reproduce:
Steps to reproduce the behavior. Provide all data and inputs required to reproduce the issue.
Add the above policy to relationship_mappings.yaml and run AWS sync with permission-relationships-file flag set.
Logs:
If applicable, copy and paste your console log with the failing stack trace.
Traceback (most recent call last):
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/sync.py", line 144, in run
stage_func(neo4j_session, config)
~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/util.py", line 204, in timed
return method(*args, **kwargs)
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/__init__.py", line 362, in start_aws_ingestion
sync_successful = _sync_multiple_accounts(
neo4j_session,
...<5 lines>...
regions=regions,
)
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/__init__.py", line 212, in _sync_multiple_accounts
_sync_one_account(
~~~~~~~~~~~~~~~~~^
neo4j_session,
^^^^^^^^^^^^^^
...<5 lines>...
aws_requested_syncs=aws_requested_syncs, # Could be replaced later with per-account requested syncs
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/__init__.py", line 89, in _sync_one_account
RESOURCE_FUNCTIONS["permission_relationships"](**sync_args)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/util.py", line 204, in timed
return method(*args, **kwargs)
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/permission_relationships.py", line 455, in sync
allowed_mappings = calculate_permission_relationships(
principals,
resource_arns,
permissions,
)
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/permission_relationships.py", line 206, in calculate_permission_relationships
if principal_allowed_on_resource(policies, resource_arn, permissions):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/permission_relationships.py", line 166, in principal_allowed_on_resource
allowed, explicit_deny = evaluate_policy_for_permissions(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
statements,
^^^^^^^^^^^
permissions,
^^^^^^^^^^^^
resource_arn,
^^^^^^^^^^^^^
)
^
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/permission_relationships.py", line 135, in evaluate_policy_for_permissions
if evaluate_statements_for_permission(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
allow_statements,
^^^^^^^^^^^^^^^^^
permission,
^^^^^^^^^^^
resource_arn,
^^^^^^^^^^^^^
):
^
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/permission_relationships.py", line 96, in evaluate_statements_for_permission
if evaluate_resource_for_permission(statement, resource_arn):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/permission_relationships.py", line 62, in evaluate_resource_for_permission
if evaluate_clause(clause, resource_arn):
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
File "/home/Flarebound/CNCF/cartography-personal/cartography/cartography/intel/aws/permission_relationships.py", line 33, in evaluate_clause
result = compile_regex(clause).fullmatch(match)
TypeError: expected string or bytes-like object, got 'NoneType'
Please complete the following information::
- Cartography release version or commit hash [e.g. 0.12.0 or 95e8e11]
Additional context:
Add any other context about the problem here.
Happening because, arn property of resources used for matching relationships between principals and resources and some resources don't have this property yet ( reference: #1147 , #1024 ).
Metadata
Metadata
Assignees
Labels
module:AWSRelated to cartography's AWS moduleRelated to cartography's AWS module