Added support for AWS KMS

README.md

@@ -35,7 +35,7 @@ You can learn more about the story behind Cartography in our [presentation at BS
 Start [here](docs/setup/install.md).
 
 ## Supported platforms
-- [Amazon Web Services](docs/setup/config/aws.md) -  EC2, Elasticsearch, Elastic Kubernetes Service, DynamoDB, IAM, Lambda, RDS, Redshift, Route53, S3, STS, Tags
+- [Amazon Web Services](docs/setup/config/aws.md) -  EC2, Elasticsearch, Elastic Kubernetes Service, DynamoDB, IAM, Lambda, RDS, Redshift, Route53, S3, STS, Tags, KMS
 - [Google Cloud Platform](docs/setup/config/gcp.md) - Cloud Resource Manager, Compute, DNS, Storage, Google Kubernetes Engine
 - [Google GSuite](docs/setup/config/gsuite.md) - users, groups
 - [Duo CRXcavator](docs/setup/config/crxcavator.md) - Chrome extensions, GSuite users

cartography/data/indexes.cypher

@@ -84,6 +84,9 @@ CREATE INDEX ON :IpPermissionsEgress(ruleid);
 CREATE INDEX ON :IpRange(id);
 CREATE INDEX ON :IpRule(ruleid);
 CREATE INDEX ON :JamfComputerGroup(id);
+CREATE INDEX ON :KMSKey(id);
+CREATE INDEX ON :KMSAlias(id);
+CREATE INDEX ON :KMSGrant(id);
 CREATE INDEX ON :LoadBalancer(dnsname);
 CREATE INDEX ON :LoadBalancer(id);
 CREATE INDEX ON :LoadBalancerV2(dnsname);

cartography/data/jobs/cleanup/aws_import_kms_cleanup.json

@@ -0,0 +1,35 @@
+{
+  "statements": [
+    {
+      "query": "MATCH (n:KMSKey)<-[:RESOURCE]-(:AWSAccount{id: {AWS_ID}}) WHERE n.lastupdated <> {UPDATE_TAG} WITH n LIMIT {LIMIT_SIZE} DETACH DELETE (n) return COUNT(*) as TotalCompleted",
+      "iterative": true,
+      "iterationsize": 100
+    },
+    {
+      "query": "MATCH (:KMSKey)<-[r:RESOURCE]-(:AWSAccount{id: {AWS_ID}}) WHERE r.lastupdated <> {UPDATE_TAG} WITH r LIMIT {LIMIT_SIZE} DELETE (r) return COUNT(*) as TotalCompleted",
+      "iterative": true,
+      "iterationsize": 100
+    },
+    {
+      "query": "MATCH (n:KMSGrant)-[:APPLIED_ON]->(:KMSKey)<-[:RESOURCE]-(:AWSAccount{id: {AWS_ID}}) WHERE n.lastupdated <> {UPDATE_TAG} WITH n LIMIT {LIMIT_SIZE} DETACH DELETE (n) return COUNT(*) as TotalCompleted",
+      "iterative": true,
+      "iterationsize": 100
+    },
+    {
+      "query": "MATCH (:KMSGrant)-[r:APPLIED_ON]->(:KMSKey)<-[:RESOURCE]-(:AWSAccount{id: {AWS_ID}}) WHERE r.lastupdated <> {UPDATE_TAG} WITH r LIMIT {LIMIT_SIZE} DELETE (r) return COUNT(*) as TotalCompleted",
+      "iterative": true,
+      "iterationsize": 100
+    },
+    {
+      "query": "MATCH (n:KMSAlias)-[:KNOWN_AS]->(:KMSKey)<-[:RESOURCE]-(:AWSAccount{id: {AWS_ID}}) WHERE n.lastupdated <> {UPDATE_TAG} WITH n LIMIT {LIMIT_SIZE} DETACH DELETE (n) return COUNT(*) as TotalCompleted",
+      "iterative": true,
+      "iterationsize": 100
+    },
+    {
+      "query": "MATCH (:KMSAlias)-[r:KNOWN_AS]->(:KMSKey)<-[:RESOURCE]-(:AWSAccount{id: {AWS_ID}}) WHERE r.lastupdated <> {UPDATE_TAG} WITH r LIMIT {LIMIT_SIZE} DELETE (r) return COUNT(*) as TotalCompleted",
+      "iterative": true,
+      "iterationsize": 100
+    }
+  ],
+  "name": "cleanup KMS"
+}

cartography/data/jobs/cleanup/aws_kms_details.json

@@ -0,0 +1,10 @@
+{
+  "statements": [
+    {
+      "query": "MATCH (:AWSAccount{id: {AWS_ID}})-[:RESOURCE]->(s:KMSKey) WHERE EXISTS(s.anonymous_access)\n WITH s LIMIT {LIMIT_SIZE}\nREMOVE s.anonymous_access, s.anonymous_actions return COUNT(*) as TotalCompleted",
+      "iterative": true,
+      "iterationsize": 100
+    }
+  ],
+  "name": "AWS KMS Key Exposure Details"
+}

cartography/intel/aws/__init__.py

@@ -9,6 +9,7 @@
 from . import eks
 from . import elasticsearch
 from . import iam
+from . import kms
 from . import lambda_function
 from . import organizations
 from . import permission_relationships
@@ -48,6 +49,7 @@ def _sync_one_account(neo4j_session, boto3_session, account_id, sync_tag, common
     lambda_function.sync(neo4j_session, boto3_session, regions, account_id, sync_tag, common_job_parameters)
     rds.sync(neo4j_session, boto3_session, regions, account_id, sync_tag, common_job_parameters)
     redshift.sync(neo4j_session, boto3_session, regions, account_id, sync_tag, common_job_parameters)
+    kms.sync(neo4j_session, boto3_session, regions, account_id, sync_tag, common_job_parameters)
 
     # NOTE each of the below will generate DNS records
     route53.sync(neo4j_session, boto3_session, account_id, sync_tag)