Merge branch 'alpha' into feature/CG-1072

m-pizarro · m-pizarro · commit cf037938faf1 · 2022-04-12T11:23:17.000-03:00
diff --git a/README.md b/README.md
diff --git a/src/services/iamRole/schema.graphql b/src/services/iamRole/schema.graphql
@@ -28,4 +28,7 @@ type awsIamRole implements awsBaseService @key(fields: "id") {
   appSync: [awsAppSync] @hasInverse(field: iamRoles)
   lambda: [awsLambda] @hasInverse(field: iamRole)
   kinesisFirehose: [awsKinesisFirehose] @hasInverse(field: iamRole)
+  rdsClusterMonitoringRole: [awsRdsCluster]
+    @hasInverse(field: monitoringIamRole)
+  rdsClusterIamRoles: [awsRdsCluster] @hasInverse(field: iamRoles)
 }
diff --git a/src/services/kms/schema.graphql b/src/services/kms/schema.graphql
@@ -47,4 +47,10 @@ type awsKms implements awsBaseService @key(fields: "id") {
   ecsCluster: [awsEcsCluster] @hasInverse(field: kms)
   dynamodb: [awsDynamoDbTable] @hasInverse(field: kms)
   cognitoUserPools: [awsCognitoUserPool] @hasInverse(field: kms)
+  rdsClusterStorageEncryption: [awsRdsCluster]
+    @hasInverse(field: storageEncryptedKms)
+  rdsClusterActivityStream: [awsRdsCluster]
+    @hasInverse(field: activityStreamKms)
+  rdsClusterPerformanceInsights: [awsRdsCluster]
+    @hasInverse(field: performanceInsightsKms)
 }
diff --git a/src/services/rdsCluster/connections.ts b/src/services/rdsCluster/connections.ts
@@ -5,6 +5,9 @@ import { DBInstance, DBCluster } from 'aws-sdk/clients/rds'
 
 import services from '../../enums/services'
 import { RawAwsRdsClusterSnapshot } from '../rdsClusterSnapshot/data'
+import { RawAwsIamRole } from '../iamRole/data'
+import { AwsKms } from '../kms/data'
+import { globalRegionName } from '../../enums/regions'
 
 export default ({
   service,
@@ -21,6 +24,11 @@ export default ({
   const {
     DBClusterArn: id,
     DBClusterIdentifier: clusterId,
+    MonitoringRoleArn: monitoringRoleArn,
+    AssociatedRoles: associatedRoles = [],
+    KmsKeyId,
+    ActivityStreamKmsKeyId,
+    PerformanceInsightsKMSKeyId,
     VpcSecurityGroups,
   } = service
   const sgIds = VpcSecurityGroups.map(
@@ -55,14 +63,17 @@ export default ({
   /**
    * Find cluster snapshots
    */
-   const snapshots: {
+  const snapshots: {
     name: string
     data: { [property: string]: RawAwsRdsClusterSnapshot[] }
   } = data.find(({ name }) => name === services.rdsClusterSnapshot)
 
   if (snapshots?.data?.[region]) {
-    const dataInRegion: RawAwsRdsClusterSnapshot[] = snapshots.data[region].filter(
-      ({ DBClusterIdentifier }: RawAwsRdsClusterSnapshot) => DBClusterIdentifier === clusterId
+    const dataInRegion: RawAwsRdsClusterSnapshot[] = snapshots.data[
+      region
+    ].filter(
+      ({ DBClusterIdentifier }: RawAwsRdsClusterSnapshot) =>
+        DBClusterIdentifier === clusterId
     )
     if (!isEmpty(dataInRegion)) {
       for (const snapshot of dataInRegion) {
@@ -101,6 +112,102 @@ export default ({
     }
   }
 
+  /**
+   * Find KMS
+   * related to this RDS Cluster
+   */
+  const kms: {
+    name: string
+    data: { [property: string]: AwsKms[] }
+  } = data.find(({ name }) => name === services.kms)
+
+  if (kms?.data?.[region]) {
+    // set storage encryption kms key
+    let kmsInRegion: AwsKms[] = kms.data[region].filter(
+      ({ Arn }: AwsKms) => Arn === KmsKeyId
+    )
+    if (!isEmpty(kmsInRegion)) {
+      for (const instance of kmsInRegion) {
+        connections.push({
+          id: instance.KeyId,
+          resourceType: services.kms,
+          relation: 'child',
+          field: 'storageEncryptedKms',
+        })
+      }
+    }
+
+    // set activity stream kms key
+    kmsInRegion = kms.data[region].filter(
+      ({ Arn }: AwsKms) => Arn === ActivityStreamKmsKeyId
+    )
+    if (!isEmpty(kmsInRegion)) {
+      for (const instance of kmsInRegion) {
+        connections.push({
+          id: instance.KeyId,
+          resourceType: services.kms,
+          relation: 'child',
+          field: 'activityStreamKms',
+        })
+      }
+    }
+
+    // set performance insights kms key
+    kmsInRegion = kms.data[region].filter(
+      ({ Arn }: AwsKms) => Arn === PerformanceInsightsKMSKeyId
+    )
+    if (!isEmpty(kmsInRegion)) {
+      for (const instance of kmsInRegion) {
+        connections.push({
+          id: instance.KeyId,
+          resourceType: services.kms,
+          relation: 'child',
+          field: 'performanceInsightsKms',
+        })
+      }
+    }
+  }
+
+  /**
+   * Find IAM Role
+   * related to this RDS Cluster
+   */
+  const iamRoles: {
+    name: string
+    data: { [property: string]: RawAwsIamRole[] }
+  } = data.find(({ name }) => name === services.iamRole)
+
+  if (iamRoles?.data?.[globalRegionName]) {
+    let iamRolesInRegion: RawAwsIamRole[] = iamRoles.data[
+      globalRegionName
+    ].filter(({ Arn }: RawAwsIamRole) =>
+      associatedRoles.find(r => r.RoleArn === Arn)
+    )
+    if (!isEmpty(iamRolesInRegion)) {
+      for (const instance of iamRolesInRegion) {
+        connections.push({
+          id: instance.Arn,
+          resourceType: services.iamRole,
+          relation: 'child',
+          field: 'iamRoles',
+        })
+      }
+    }
+    iamRolesInRegion = iamRoles.data[globalRegionName].filter(
+      ({ Arn }: RawAwsIamRole) => Arn === monitoringRoleArn
+    )
+    if (!isEmpty(iamRolesInRegion)) {
+      for (const instance of iamRolesInRegion) {
+        connections.push({
+          id: instance.Arn,
+          resourceType: services.iamRole,
+          relation: 'child',
+          field: 'monitoringIamRole',
+        })
+      }
+    }
+  }
+
   const rdsClusterResult = {
     [id]: connections,
   }
diff --git a/src/services/rdsCluster/format.ts b/src/services/rdsCluster/format.ts
@@ -1,15 +1,12 @@
 import { RawAwsRdsCluster } from './data'
-import { 
-  AwsRdsCluster, 
-} from '../../types/generated'
+import { AwsRdsCluster } from '../../types/generated'
 import { formatTagsFromMap } from '../../utils/format'
 
 export default ({
   service,
   account,
-  region
-}: 
-{
+  region,
+}: {
   service: RawAwsRdsCluster
   account: string
   region: string
diff --git a/src/services/rdsCluster/schema.graphql b/src/services/rdsCluster/schema.graphql
@@ -33,7 +33,10 @@ type awsRdsCluster implements awsBaseService @key(fields: "arn") {
   snapshots: [awsRdsClusterSnapshot] @hasInverse(field: cluster)
   securityGroups: [awsSecurityGroup] @hasInverse(field: rdsCluster)
   appSync: [awsAppSync] @hasInverse(field: rdsCluster)
+  monitoringIamRole: [awsIamRole] @hasInverse(field: rdsClusterMonitoringRole)
+  iamRoles: [awsIamRole] @hasInverse(field: rdsClusterIamRoles)
+  storageEncryptedKms: [awsKms] @hasInverse(field: rdsClusterStorageEncryption)
+  activityStreamKms: [awsKms] @hasInverse(field: rdsClusterActivityStream)
+  performanceInsightsKms: [awsKms]
+    @hasInverse(field: rdsClusterPerformanceInsights)
 }
-
-# TODO: create connection to iam roles using AssociatedRoles property AND DomainMemberships AND MonitoringRole
-# TODO: create connection to kms using all kms related fields
diff --git a/src/types/generated.ts b/src/types/generated.ts
@@ -3070,6 +3070,8 @@ export type AwsIamRole = AwsBaseService & {
   maxSessionDuration?: Maybe<Scalars['Int']>;
   name?: Maybe<Scalars['String']>;
   path?: Maybe<Scalars['String']>;
+  rdsClusterIamRoles?: Maybe<Array<Maybe<AwsRdsCluster>>>;
+  rdsClusterMonitoringRole?: Maybe<Array<Maybe<AwsRdsCluster>>>;
   sageMakerNotebookInstances?: Maybe<Array<Maybe<AwsSageMakerNotebookInstance>>>;
   systemsManagerInstances?: Maybe<Array<Maybe<AwsSystemsManagerInstance>>>;
   tags?: Maybe<Array<Maybe<AwsRawTag>>>;
@@ -3200,7 +3202,10 @@ export type AwsKms = AwsBaseService & {
   lambda?: Maybe<Array<Maybe<AwsLambda>>>;
   origin?: Maybe<Scalars['String']>;
   policy?: Maybe<AwsIamJsonPolicy>;
+  rdsClusterActivityStream?: Maybe<Array<Maybe<AwsRdsCluster>>>;
+  rdsClusterPerformanceInsights?: Maybe<Array<Maybe<AwsRdsCluster>>>;
   rdsClusterSnapshots?: Maybe<Array<Maybe<AwsRdsClusterSnapshot>>>;
+  rdsClusterStorageEncryption?: Maybe<Array<Maybe<AwsRdsCluster>>>;
   redshiftCluster?: Maybe<Array<Maybe<AwsRedshiftCluster>>>;
   sageMakerNotebookInstances?: Maybe<Array<Maybe<AwsSageMakerNotebookInstance>>>;
   secretsManager?: Maybe<Array<Maybe<AwsSecretsManager>>>;
@@ -3485,6 +3490,7 @@ export type AwsRawTag = {
 };
 
 export type AwsRdsCluster = AwsBaseService & {
+  activityStreamKms?: Maybe<Array<Maybe<AwsKms>>>;
   allocatedStorage?: Maybe<Scalars['Int']>;
   appSync?: Maybe<Array<Maybe<AwsAppSync>>>;
   backupRetentionPeriod?: Maybe<Scalars['Int']>;
@@ -3505,17 +3511,21 @@ export type AwsRdsCluster = AwsBaseService & {
   hostedZoneId?: Maybe<Scalars['String']>;
   httpEndpointEnabled?: Maybe<Scalars['Boolean']>;
   iamDbAuthenticationEnabled?: Maybe<Scalars['Boolean']>;
+  iamRoles?: Maybe<Array<Maybe<AwsIamRole>>>;
   instances?: Maybe<Array<Maybe<AwsRdsDbInstance>>>;
   kmsKey?: Maybe<Scalars['String']>;
+  monitoringIamRole?: Maybe<Array<Maybe<AwsIamRole>>>;
   multiAZ?: Maybe<Scalars['Boolean']>;
   percentProgress?: Maybe<Scalars['String']>;
+  performanceInsightsKms?: Maybe<Array<Maybe<AwsKms>>>;
   port?: Maybe<Scalars['Int']>;
   readerEndpoint?: Maybe<Scalars['String']>;
   replicationSourceIdentifier?: Maybe<Scalars['String']>;
   resourceId?: Maybe<Scalars['String']>;
   securityGroups?: Maybe<Array<Maybe<AwsSecurityGroup>>>;
   snapshots?: Maybe<Array<Maybe<AwsRdsClusterSnapshot>>>;
   status?: Maybe<Scalars['String']>;
+  storageEncryptedKms?: Maybe<Array<Maybe<AwsKms>>>;
   subnets?: Maybe<Scalars['String']>;
   tags?: Maybe<Array<Maybe<AwsRawTag>>>;
   username?: Maybe<Scalars['String']>;

Original file line number	Diff line number	Diff line change
`@@ -28,4 +28,7 @@ type awsIamRole implements awsBaseService @key(fields: "id") {`
`28`	`28`	`appSync: [awsAppSync] @hasInverse(field: iamRoles)`
`29`	`29`	`lambda: [awsLambda] @hasInverse(field: iamRole)`
`30`	`30`	`kinesisFirehose: [awsKinesisFirehose] @hasInverse(field: iamRole)`
	`31`	`+ rdsClusterMonitoringRole: [awsRdsCluster]`
	`32`	`+ @hasInverse(field: monitoringIamRole)`
	`33`	`+ rdsClusterIamRoles: [awsRdsCluster] @hasInverse(field: iamRoles)`
`31`	`34`	`}`