Skip to content

Commit 57813fc

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #84 from cloudgraphdev/fix/CG-1240
fix(services): Added encryption rules data to s3 service
2 parents f1d4282 + e4ef3ed commit 57813fc

6 files changed

Lines changed: 62 additions & 3 deletions

File tree

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
133133
| iot | |
134134
| kinesisFirehose | kinesisStream, s3, iamRole |
135135
| kinesisStream | kinesisFirehose |
136-
| kms | cloudtrail, cloudwatchLog, codebuild, ecsCluster, efs, eksCluster, elastiCacheReplicationGroup, elasticSearchDomain, emrCluster, managedAirflow, lambda, rdsCluster, rdsClusterSnapshot, rdsDbInstance, sns, sageMakerNotebookInstance, secretsManager, dmsReplicationInstance, redshiftCluster |
136+
| kms | cloudtrail, cloudwatchLog, codebuild, ecsCluster, efs, eksCluster, elastiCacheReplicationGroup, elasticSearchDomain, emrCluster, managedAirflow, lambda, rdsCluster, rdsClusterSnapshot, rdsDbInstance, sns, sageMakerNotebookInstance, secretsManager, dmsReplicationInstance, redshiftCluster, s3 |
137137
| lambda | appSync, cognitoUserPool, kms, s3, secretsManager, securityGroup, subnet, vpc, iamRole |
138138
| managedAirflow | cloudwatchLog, iamRole, kms, securityGroups, subnet, s3 |
139139
| managedPrefixList | |
@@ -151,7 +151,7 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
151151
| sageMakerExperiment | |
152152
| sageMakerNotebookInstance | iamRole, kms, networkInterface, subnet, securityGroup |
153153
| sageMakerProject | |
154-
| s3 | cloudfront, cloudtrail, ecsCluster, iamRole, kinesisFirehose, lambda, managedAirflow, sns, sqs |
154+
| s3 | cloudfront, cloudtrail, ecsCluster, iamRole, kinesisFirehose, kms, lambda, managedAirflow, sns, sqs |
155155
| secretsManager | kms, lambda |
156156
| securityGroup | alb, asg, clientVpnEndpoint, codebuild, dmsReplicationInstance, ecsService, lambda, ec2, elasticSearchDomain, elb, rdsCluster, rdsDbInstance, eksCluster, elastiCacheCluster, managedAirflow, sageMakerNotebookInstance, networkInterface, vpcEndpoint |
157157
| ses | |

‎src/services/kms/schema.graphql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,4 +51,5 @@ type awsKms implements awsBaseService @key(fields: "id") {
5151
rdsCluster: [awsRdsCluster] @hasInverse(field: kms)
5252
rdsDbInstance: [awsRdsDbInstance] @hasInverse(field: kms)
5353
managedAirflows: [awsManagedAirflow] @hasInverse(field: kms)
54+
s3: [awsS3] @hasInverse(field: kms)
5455
}

‎src/services/s3/connections.ts‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ export default ({
3232
TopicConfigurations: topicConfigurations,
3333
QueueConfigurations: queueConfigurations,
3434
},
35+
EncryptionInfo: encryptionInfo,
3536
},
3637
} = service
3738

@@ -144,6 +145,31 @@ export default ({
144145
}
145146
}
146147

148+
/**
149+
* Find KMS
150+
* related to the S3
151+
*/
152+
const kmsKeyIds = encryptionInfo?.Rules?.map(
153+
r => r.ApplyServerSideEncryptionByDefault?.KMSMasterKeyID
154+
)
155+
const kmsKeys = data.find(({ name }) => name === services.kms)
156+
if (kmsKeys?.data?.[region] && kmsKeyIds?.length > 0) {
157+
const kmsKeyInRegion = kmsKeys.data[region].filter(kmsKey =>
158+
kmsKeyIds.includes(kmsKey.Arn)
159+
)
160+
161+
if (!isEmpty(kmsKeyInRegion)) {
162+
for (const kms of kmsKeyInRegion) {
163+
connections.push({
164+
id: kms.KeyId,
165+
resourceType: services.kms,
166+
relation: 'child',
167+
field: 'kms',
168+
})
169+
}
170+
}
171+
}
172+
147173
const s3Result = {
148174
[id]: connections,
149175
}

‎src/services/s3/format.ts‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import {
66
NotificationConfiguration,
77
PolicyStatus,
88
PublicAccessBlockConfiguration,
9+
ServerSideEncryptionConfiguration,
910
} from 'aws-sdk/clients/s3'
1011

1112
import { AwsS3 } from '../../types/generated'
@@ -139,10 +140,19 @@ export default ({
139140
corsAdditions.corsConfiguration = t.yes
140141
}
141142

142-
const encryptionAdditions = { encrypted: t.no }
143+
const encryptionAdditions = { encrypted: t.no, encryptionRules: [] }
143144

144145
if (!isEmpty(encryptionInfo)) {
146+
const { Rules } = encryptionInfo as ServerSideEncryptionConfiguration
145147
encryptionAdditions.encrypted = t.yes
148+
encryptionAdditions.encryptionRules = Rules.map(r => ({
149+
id: generateUniqueId({
150+
arn,
151+
...r,
152+
}),
153+
sseAlgorithm: r.ApplyServerSideEncryptionByDefault?.SSEAlgorithm,
154+
kmsMasterKeyID: r.ApplyServerSideEncryptionByDefault?.KMSMasterKeyID,
155+
}))
146156
}
147157

148158
const replicationAdditions = { crossRegionReplication: t.disabled }

‎src/services/s3/schema.graphql‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,17 @@ type awsS3AclGrant
6565
permission: String @search(by: [hash])
6666
}
6767

68+
type awsS3ServerSideEncryptionConfiguration
69+
@generate(
70+
query: { get: false, query: true, aggregate: false }
71+
mutation: { add: false, delete: false }
72+
subscription: false
73+
) {
74+
id: String! @id
75+
sseAlgorithm: String @search(by: [hash])
76+
kmsMasterKeyID: String @search(by: [hash])
77+
}
78+
6879
type awsS3 implements awsBaseService @key(fields: "arn") {
6980
access: String @search(by: [hash, regexp])
7081
bucketOwnerName: String @search(by: [hash, regexp])
@@ -74,6 +85,7 @@ type awsS3 implements awsBaseService @key(fields: "arn") {
7485
transferAcceleration: String @search(by: [hash, regexp])
7586
corsConfiguration: String @search(by: [hash, regexp])
7687
encrypted: String @search(by: [hash, regexp])
88+
encryptionRules: [awsS3ServerSideEncryptionConfiguration]
7789
lifecycle: String @search(by: [hash, regexp])
7890
logging: String @search(by: [hash, regexp])
7991
blockPublicAcls: String @search(by: [hash, regexp])
@@ -98,4 +110,5 @@ type awsS3 implements awsBaseService @key(fields: "arn") {
98110
sns: [awsSns] @hasInverse(field: s3)
99111
sqs: [awsSqs] @hasInverse(field: s3)
100112
ecsCluster: [awsEcsCluster] @hasInverse(field: s3)
113+
kms: [awsKms] @hasInverse(field: s3)
101114
}

‎src/types/generated.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3328,6 +3328,7 @@ export type AwsKms = AwsBaseService & {
33283328
rdsClusterSnapshots?: Maybe<Array<Maybe<AwsRdsClusterSnapshot>>>;
33293329
rdsDbInstance?: Maybe<Array<Maybe<AwsRdsDbInstance>>>;
33303330
redshiftCluster?: Maybe<Array<Maybe<AwsRedshiftCluster>>>;
3331+
s3?: Maybe<Array<Maybe<AwsS3>>>;
33313332
sageMakerNotebookInstances?: Maybe<Array<Maybe<AwsSageMakerNotebookInstance>>>;
33323333
secretsManager?: Maybe<Array<Maybe<AwsSecretsManager>>>;
33333334
sns?: Maybe<Array<Maybe<AwsSns>>>;
@@ -3869,9 +3870,11 @@ export type AwsS3 = AwsBaseService & {
38693870
crossRegionReplication?: Maybe<Scalars['String']>;
38703871
ecsCluster?: Maybe<Array<Maybe<AwsEcsCluster>>>;
38713872
encrypted?: Maybe<Scalars['String']>;
3873+
encryptionRules?: Maybe<Array<Maybe<AwsS3ServerSideEncryptionConfiguration>>>;
38723874
iamRole?: Maybe<Array<Maybe<AwsIamRole>>>;
38733875
ignorePublicAcls?: Maybe<Scalars['String']>;
38743876
kinesisFirehose?: Maybe<Array<Maybe<AwsKinesisFirehose>>>;
3877+
kms?: Maybe<Array<Maybe<AwsKms>>>;
38753878
lambdas?: Maybe<Array<Maybe<AwsLambda>>>;
38763879
lifecycle?: Maybe<Scalars['String']>;
38773880
logging?: Maybe<Scalars['String']>;
@@ -3925,6 +3928,12 @@ export type AwsS3QueueConfiguration = AwsS3ConfigurationBase & {
39253928
queueArn?: Maybe<Scalars['String']>;
39263929
};
39273930

3931+
export type AwsS3ServerSideEncryptionConfiguration = {
3932+
id: Scalars['String'];
3933+
kmsMasterKeyID?: Maybe<Scalars['String']>;
3934+
sseAlgorithm?: Maybe<Scalars['String']>;
3935+
};
3936+
39283937
export type AwsS3TopicConfiguration = AwsS3ConfigurationBase & {
39293938
topicArn?: Maybe<Scalars['String']>;
39303939
};

0 commit comments

Comments
 (0)