Skip to content

Commit 13ea0a5

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #19 from cloudgraphdev/feature/CG-1055
feat(appSync): add iamRole/wafV2WebAcl connections
2 parents 3f8f163 + 36b90f2 commit 13ea0a5

File tree

6 files changed

+70
-7
lines changed

6 files changed

+70
-7
lines changed

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
7171
| apiGatewayRestApi | apiGatewayResource, apiGatewayStage, route53Record |
7272
| apiGatewayStage | apiGatewayRestApi |
7373
| apiGatewayResource | apiGatewayRestApi |
74-
| appSync | cognitoUserPool, dynamodb, lambda, rdsCluster |
74+
| appSync | cognitoUserPool, dynamodb, iamRole, lambda, rdsCluster, wafV2WebAcl |
7575
| asg | ebs, ec2, securityGroup, subnet |
7676
| athenaDataCatalog | |
7777
| clientVpnEndpoint | securityGroup |
@@ -122,7 +122,7 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
122122
| iamServerCertificate | |
123123
| iamUser | iamGroup |
124124
| iamPolicy | iamRole, iamGroup |
125-
| iamRole | codebuild, configurationRecorder, ec2, iamInstanceProfile, iamPolicy, eksCluster, ecsService, flowLog, glueJob, managedAirflow, sageMakerNotebookInstance, systemsManagerInstance guardDutyDetector |
125+
| iamRole | appSync, codebuild, configurationRecorder, ec2, iamInstanceProfile, iamPolicy, eksCluster, ecsService, flowLog, glueJob, managedAirflow, sageMakerNotebookInstance, systemsManagerInstance guardDutyDetector |
126126
| iamGroup | iamUser, iamPolicy |
127127
| igw | vpc |
128128
| iot | |
@@ -159,5 +159,5 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
159159
| vpc | alb, codebuild, dmsReplicationInstance, ec2, eip, elb, ecsService, efsMountTarget, eksCluster igw, elastiCacheCluster, elasticSearchDomain, lambda, nacl, natGateway, networkInterface, rdsClusterSnapshot, rdsDbInstance, redshiftCluster, route53HostedZone, routeTable, subnet, flowLog, vpnGateway, transitGatewayAttachment |
160160
| vpnConnection | customerGateway, transitGateway, transitGatewayAttachment, vpnGateway |
161161
| vpnGateway | vpc, vpnConnection |
162-
| wafV2WebAcl | |
162+
| wafV2WebAcl | appSync |
163163

‎src/services/appSync/connections.ts‎

Lines changed: 58 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ import { RawAwsDynamoDbTable } from '../dynamodb/data'
1010
import { RawAwsLambdaFunction } from '../lambda/data'
1111
import { RawAwsCognitoUserPool } from '../cognitoUserPool/data'
1212
import { RawAwsRdsCluster } from '../rdsCluster/data'
13+
import { RawAwsIamRole } from '../iamRole/data'
14+
import { globalRegionName } from '../../enums/regions'
15+
import { RawAwsWafV2WebAcl } from '../wafV2WebAcl/data'
1316

1417
/**
1518
* AppSync
@@ -27,7 +30,7 @@ export default ({
2730
region: string
2831
}): { [key: string]: ServiceConnection[] } => {
2932
const connections: ServiceConnection[] = []
30-
const { apiId: id, awsDataSources, userPoolConfig } = appSync
33+
const { apiId: id, awsDataSources, userPoolConfig, wafWebAclArn } = appSync
3134

3235
/**
3336
* Find cognito user pools
@@ -153,6 +156,60 @@ export default ({
153156
}
154157
}
155158

159+
/**
160+
* Find related IAM Roles
161+
*/
162+
const roles: { name: string; data: { [property: string]: any[] } } =
163+
data.find(({ name }) => name === services.iamRole)
164+
165+
const roleArns = awsDataSources?.map(
166+
({ serviceRoleArn }) => serviceRoleArn
167+
)
168+
169+
if (roles?.data?.[globalRegionName]) {
170+
const dataAtRegion: RawAwsIamRole[] = roles.data[globalRegionName].filter(
171+
role => roleArns.includes(role.Arn)
172+
)
173+
if (!isEmpty(dataAtRegion)) {
174+
for (const instance of dataAtRegion) {
175+
const { Arn: arn }: RawAwsIamRole = instance
176+
177+
connections.push({
178+
id: arn,
179+
resourceType: services.iamRole,
180+
relation: 'child',
181+
field: 'iamRoles',
182+
})
183+
}
184+
}
185+
}
186+
187+
/**
188+
* Find wafV2WebAcls
189+
*/
190+
const acls: {
191+
name: string
192+
data: { [property: string]: RawAwsWafV2WebAcl[] }
193+
} = data.find(({ name }) => name === services.wafV2WebAcl)
194+
195+
if (acls?.data) {
196+
const allAcls = Object.values(acls.data).flat()
197+
const dataInRegion: RawAwsWafV2WebAcl[] = allAcls.filter(
198+
({ ARN }: RawAwsWafV2WebAcl) => ARN === wafWebAclArn
199+
)
200+
201+
if (!isEmpty(dataInRegion)) {
202+
for (const acl of dataInRegion) {
203+
connections.push({
204+
id: acl.Id,
205+
resourceType: services.wafV2WebAcl,
206+
relation: 'child',
207+
field: 'webAcl',
208+
})
209+
}
210+
}
211+
}
212+
156213
const appSyncResult = {
157214
[id]: connections,
158215
}

‎src/services/appSync/schema.graphql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -124,9 +124,7 @@ type awsAdditionalAuthenticationProvider
124124
userPoolAwsRegion: String @search(by: [hash, regexp])
125125
userPoolAppIdClientRegex: String @search(by: [hash, regexp])
126126
}
127-
# TODO: add iam role connection
128-
# TODO: waf web acl connection
129-
# TODO: add cloudwatchLog connection
127+
130128
type awsAppSync implements awsBaseService @key(fields: "arn") {
131129
name: String @search(by: [hash, regexp])
132130
authenticationType: String @search(by: [hash, regexp])
@@ -158,4 +156,6 @@ type awsAppSync implements awsBaseService @key(fields: "arn") {
158156
dynamodb: [awsDynamoDbTable] @hasInverse(field: appSync)
159157
lambda: [awsLambda] @hasInverse(field: appSync)
160158
rdsCluster: [awsRdsCluster] @hasInverse(field: appSync)
159+
iamRoles: [awsIamRole] @hasInverse(field: appSync)
160+
webAcl: [awsWafV2WebAcl] @hasInverse(field: appSync)
161161
}

‎src/services/iamRole/schema.graphql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,5 @@ type awsIamRole implements awsBaseService @key(fields: "id") {
2424
iamInstanceProfiles: [awsIamInstanceProfile] @hasInverse(field: iamRole)
2525
ec2Instances: [awsEc2] @hasInverse(field: iamRole)
2626
cognitoUserPools: [awsCognitoUserPool] @hasInverse(field: iamRole)
27+
appSync: [awsAppSync] @hasInverse(field: iamRoles)
2728
}

‎src/services/wafV2WebAcl/schema.graphql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ type awsWafV2WebAcl implements awsBaseService @key(fields: "arn") {
1212
customResponseBodies: [awsWafV2CustomResponseBody]
1313
loggingConfiguration: awsWafV2LoggingConfig
1414
cloudfront: [awsCloudfront] @hasInverse(field: webAcl)
15+
appSync: [awsAppSync] @hasInverse(field: webAcl)
1516
}
1617

1718
type awsWafV2Rule {

‎src/types/generated.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -354,6 +354,7 @@ export type AwsAppSync = AwsBaseService & {
354354
dataSources?: Maybe<Array<Maybe<AwsAppSyncDataSource>>>;
355355
dynamodb?: Maybe<Array<Maybe<AwsDynamoDbTable>>>;
356356
functions?: Maybe<Array<Maybe<AwsAppSyncFunction>>>;
357+
iamRoles?: Maybe<Array<Maybe<AwsIamRole>>>;
357358
lambda?: Maybe<Array<Maybe<AwsLambda>>>;
358359
lambdaAuthorizerIdentityValidationExpression?: Maybe<Scalars['String']>;
359360
lambdaAuthorizerResultTtlInSeconds?: Maybe<Scalars['Int']>;
@@ -375,6 +376,7 @@ export type AwsAppSync = AwsBaseService & {
375376
userPoolDefaultAction?: Maybe<Scalars['String']>;
376377
userPoolId?: Maybe<Scalars['String']>;
377378
wafWebAclArn?: Maybe<Scalars['String']>;
379+
webAcl?: Maybe<Array<Maybe<AwsWafV2WebAcl>>>;
378380
xrayEnabled?: Maybe<Scalars['String']>;
379381
};
380382

@@ -3017,6 +3019,7 @@ export type AwsIamPolicy = AwsBaseService & {
30173019
};
30183020

30193021
export type AwsIamRole = AwsBaseService & {
3022+
appSync?: Maybe<Array<Maybe<AwsAppSync>>>;
30203023
assumeRolePolicy?: Maybe<AwsIamJsonPolicy>;
30213024
cloudFormationStack?: Maybe<Array<Maybe<AwsCloudFormationStack>>>;
30223025
codebuilds?: Maybe<Array<Maybe<AwsCodebuild>>>;
@@ -4418,6 +4421,7 @@ export type AwsWafV2VisibilityConfig = {
44184421

44194422
export type AwsWafV2WebAcl = AwsBaseService & {
44204423
ManagedByFirewallManager?: Maybe<Scalars['Boolean']>;
4424+
appSync?: Maybe<Array<Maybe<AwsAppSync>>>;
44214425
capacity?: Maybe<Scalars['Int']>;
44224426
cloudfront?: Maybe<Array<Maybe<AwsCloudfront>>>;
44234427
customResponseBodies?: Maybe<Array<Maybe<AwsWafV2CustomResponseBody>>>;

0 commit comments

Comments
 (0)