Skip to content

Commit 694d298

Browse files
hjaraujofhjaraujof
committed
fix(elasticSearchDomain): add cloudwatchLogs, cognitoIdentityPool, cognitoUserPool, iamRole connections
1 parent 5c6e272 commit 694d298

9 files changed

Lines changed: 119 additions & 10 deletions

File tree

‎README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -83,10 +83,10 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
8383
| cloudfront | elb, s3 |
8484
| cloudtrail | cloudwatch, cloudwatchLog, kms, s3, sns |
8585
| cloudwatch | cloudtrail, cloudwatchLog, sns |
86-
| cloudwatchLog | cloudtrail, cloudwatch, ecsCluster, kms, managedAirflow, rdsDbInstance |
86+
| cloudwatchLog | cloudtrail, cloudwatch, ecsCluster, elasticSearchDomain, kms, managedAirflow, rdsDbInstance |
8787
| codebuild | iamRole, kms, vpc, securityGroup, subnet |
88-
| cognitoIdentityPool | iamRole, iamOpenIdConnectProvider, iamSamlProvider |
89-
| cognitoUserPool | appSync, lambda |
88+
| cognitoIdentityPool | iamRole, iamOpenIdConnectProvider, iamSamlProvider, elasticSearchDomain |
89+
| cognitoUserPool | appSync, elasticSearchDomain, lambda |
9090
| configurationRecorder | iamRole |
9191
| customerGateway | vpnConnection |
9292
| dynamodb | appSync, iamRole, kms |
@@ -108,7 +108,7 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
108108
| elastiCacheReplicationGroup | kms |
109109
| elasticBeanstalkApp | elasticBeanstalkEnv, iamRole |
110110
| elasticBeanstalkEnv | alb, asg, ec2, elb, elasticBeanstalkApp, iamRole, sqs |
111-
| elasticSearchDomain | kms, securityGroup, subnet, vpc |
111+
| elasticSearchDomain | cloudwatchLog, cognitoIdentityPool, cognitoUserPool, iamRole, kms, securityGroup, subnet, vpc |
112112
| elb | cloudfront, ecsService, elasticBeanstalkEnv, securityGroup, subnet, vpc |
113113
| emrCluster | iamRole, kms, subnet |
114114
| emrInstance | ebs, ec2 |
@@ -124,7 +124,7 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
124124
| iamServerCertificate | |
125125
| iamUser | iamGroup |
126126
| iamPolicy | iamRole, iamGroup |
127-
| iamRole | appSync, asg, cloudformationStackSet, codebuild, cognitoIdentityPool, configurationRecorder, ec2, iamInstanceProfile, iamPolicy, eksCluster, ecsService, emrCluster, flowLog, glueJob, managedAirflow, s3, sageMakerNotebookInstance, systemsManagerInstance, guardDutyDetector, lambda, kinesisFirehose, rdsCluster, rdsDbInstance, elasticBeanstalkApp, elasticBeanstalkEnv |
127+
| iamRole | appSync, asg, cloudformationStackSet, codebuild, cognitoIdentityPool, configurationRecorder, ec2, iamInstanceProfile, iamPolicy, eksCluster, ecsService, emrCluster, flowLog, glueJob, managedAirflow, s3, sageMakerNotebookInstance, systemsManagerInstance, guardDutyDetector, lambda, kinesisFirehose, rdsCluster, rdsDbInstance, elasticBeanstalkApp, elasticBeanstalkEnv, elasticSearchDomain |
128128
| iamGroup | iamUser, iamPolicy |
129129
| igw | vpc |
130130
| iot | |

‎src/services/cloudwatchLogs/schema.graphql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ type awsCloudwatchLog @key(fields: "arn") {
1414
cloudwatch: [awsCloudwatch] @hasInverse(field: cloudwatchLog)
1515
cloudtrail: [awsCloudtrail] @hasInverse(field: cloudwatchLog)
1616
ecsCluster: [awsEcsCluster] @hasInverse(field: cloudwatchLog)
17+
elasticSearchDomains: [awsElasticSearchDomain] @hasInverse(field: cloudwatchLogs)
1718
rdsDbInstance: [awsRdsDbInstance] @hasInverse(field: cloudwatchLogs)
1819
managedAirflows: [awsManagedAirflow] @hasInverse(field: cloudwatchLogs)
1920
}

‎src/services/cognitoIdentityPool/schema.graphql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ type awsCognitoIdentityPool @key(fields: "id") {
3434
cognitoIdentityProviders: [awsCognitoIdentityProviders]
3535
samlProviderARNs: [String] @search
3636
tags: [awsRawTag]
37+
elasticSearchDomains: [awsElasticSearchDomain] @hasInverse(field: cognitoIdentityPool)
3738
iamRoles: [awsIamRole] @hasInverse(field: awsCognitoIdentityPool)
3839
iamOpenIdConnectProviders: [awsIamOpenIdConnectProvider] @hasInverse(field: awsCognitoIdentityPool)
3940
iamSamlProviders: [awsIamSamlProvider] @hasInverse(field: awsCognitoIdentityPool)

‎src/services/cognitoUserPool/schema.graphql‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,4 +124,5 @@ type awsCognitoUserPool implements awsBaseService @key(fields: "id") {
124124
kms: [awsKms] @hasInverse(field: cognitoUserPools)
125125
ses: [awsSes] @hasInverse(field: cognitoUserPools)
126126
iamRole: [awsIamRole] @hasInverse(field: cognitoUserPools)
127-
}
127+
elasticSearchDomains: [awsElasticSearchDomain] @hasInverse(field: cognitoUserPool)
128+
}

‎src/services/elasticSearchDomain/connections.ts‎

Lines changed: 97 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
11
import { ServiceConnection } from '@cloudgraph/sdk'
22

3+
import isEmpty from 'lodash/isEmpty'
34
import services from '../../enums/services'
45
import { RawAwsElasticSearchDomain } from './data'
56
import { AwsSecurityGroup } from '../securityGroup/data'
67
import { AwsKms } from '../kms/data'
8+
import { RawAwsCognitoIdentityPool } from '../cognitoIdentityPool/data'
9+
import { RawAwsCognitoUserPool } from '../cognitoUserPool/data'
10+
import { RawAwsIamRole } from '../iamRole/data'
11+
import { RawAwsLogGroup } from '../cloudwatchLogs/data'
12+
import { globalRegionName } from '../../enums/regions'
713

814
export default ({
915
service: domain,
@@ -20,9 +26,14 @@ export default ({
2026
DomainId,
2127
VPCOptions: { SecurityGroupIds = [] } = {},
2228
EncryptionAtRestOptions: { KmsKeyId } = {},
29+
CognitoOptions: { IdentityPoolId, UserPoolId, RoleArn } = {},
30+
LogPublishingOptions = {},
2331
} = domain
2432
const connections: ServiceConnection[] = []
25-
33+
const logGroupsArns: string[] = Object.entries(LogPublishingOptions).map(
34+
([, value]) => value.CloudWatchLogsLogGroupArn
35+
) || []
36+
2637
/**
2738
* Find any securityGroup related data
2839
*/
@@ -59,6 +70,91 @@ export default ({
5970
}
6071
}
6172

73+
/**
74+
* Find any cognito identity pool related data
75+
*/
76+
const identityPools = data.find(
77+
({ name }) => name === services.cognitoIdentityPool
78+
)
79+
if (identityPools?.data?.[region]) {
80+
const dataAtRegion: RawAwsCognitoIdentityPool[] = identityPools.data[
81+
region
82+
].filter(
83+
({ IdentityPoolId: poolId }: RawAwsCognitoIdentityPool) =>
84+
poolId === IdentityPoolId
85+
)
86+
for (const identityPool of dataAtRegion) {
87+
connections.push({
88+
id: identityPool.IdentityPoolId,
89+
resourceType: services.cognitoIdentityPool,
90+
relation: 'child',
91+
field: 'cognitoIdentityPool',
92+
})
93+
}
94+
}
95+
96+
/**
97+
* Find any cognito user pool related data
98+
*/
99+
const userPools = data.find(({ name }) => name === services.cognitoUserPool)
100+
if (userPools?.data?.[region]) {
101+
const dataAtRegion: RawAwsCognitoUserPool[] = userPools.data[region].filter(
102+
({ Id }: RawAwsCognitoUserPool) => Id === UserPoolId
103+
)
104+
for (const userPool of dataAtRegion) {
105+
connections.push({
106+
id: userPool.Id,
107+
resourceType: services.cognitoUserPool,
108+
relation: 'child',
109+
field: 'cognitoUserPool',
110+
})
111+
}
112+
}
113+
114+
/**
115+
* Find any IAM role related data
116+
*/
117+
const roles = data.find(({ name }) => name === services.iamRole)
118+
if (roles?.data?.[globalRegionName]) {
119+
const dataAtRegion: RawAwsIamRole[] = roles.data[globalRegionName].filter(
120+
({ Arn }: RawAwsIamRole) => Arn === RoleArn
121+
)
122+
for (const role of dataAtRegion) {
123+
connections.push({
124+
id: role.Arn,
125+
resourceType: services.iamRole,
126+
relation: 'child',
127+
field: 'iamRole',
128+
})
129+
}
130+
}
131+
132+
/**
133+
* Find any cloudwatch log group related data
134+
*/
135+
const cloudwatchLogGroups = data.find(
136+
({ name }) => name === services.cloudwatchLog
137+
)
138+
if (cloudwatchLogGroups?.data?.[region]) {
139+
const dataAtRegion: RawAwsLogGroup[] = cloudwatchLogGroups.data[
140+
region
141+
].filter(
142+
({ arn }: RawAwsLogGroup) =>
143+
!isEmpty(logGroupsArns) &&
144+
logGroupsArns.filter(
145+
str => `${str}:*`.includes(arn) // A small interpolation hack to be able to match the full arn
146+
).length > 0
147+
)
148+
for (const cloudwatchLogGroup of dataAtRegion) {
149+
connections.push({
150+
id: cloudwatchLogGroup.logGroupName,
151+
resourceType: services.cloudwatchLog,
152+
relation: 'child',
153+
field: 'cloudwatchLogs',
154+
})
155+
}
156+
}
157+
62158
const natResult = {
63159
[DomainId]: connections,
64160
}

‎src/services/elasticSearchDomain/format.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,6 @@ export default ({
8787
securityGroupIds: vpcOptions?.SecurityGroupIds
8888
}
8989

90-
// TODO: create connections for cognito and role arn
9190
const formattedCognioOptions = {
9291
enabled: cognitoOptions?.Enabled,
9392
userPoolId: cognitoOptions?.UserPoolId,
@@ -110,7 +109,6 @@ export default ({
110109
value: advancedOptions[key]
111110
}))
112111

113-
// TODO: create connections for cloud watch logs groups
114112
const mappedLogPublishingOptions = Object.keys(logPublishingOptions ?? {}).map(key => ({
115113
id: cuid(),
116114
key,

‎src/services/elasticSearchDomain/schema.graphql‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
#TODO add connection for userPool, identityPool, iamRole, cloudwatchLogs
21
type awsElasticSearchDomain implements awsBaseService @key(fields: "arn") {
32
domainName: String @search(by: [hash, regexp])
43
created: Boolean @search
@@ -28,6 +27,10 @@ type awsElasticSearchDomain implements awsBaseService @key(fields: "arn") {
2827
subnets: [awsSubnet] @hasInverse(field: elasticSearchDomains)
2928
securityGroups: [awsSecurityGroup] @hasInverse(field: elasticSearchDomains)
3029
kms: [awsKms] @hasInverse(field: elasticSearchDomains)
30+
cognitoIdentityPool: [awsCognitoIdentityPool] @hasInverse(field: elasticSearchDomains)
31+
cognitoUserPool: [awsCognitoUserPool] @hasInverse(field: elasticSearchDomains)
32+
iamRole: [awsIamRole] @hasInverse(field: elasticSearchDomains)
33+
cloudwatchLogs: [awsCloudwatchLog] @hasInverse(field: elasticSearchDomains)
3134
}
3235

3336
type awsElasticSearchClusterConfig {

‎src/services/iamRole/schema.graphql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,5 +37,6 @@ type awsIamRole implements awsBaseService @key(fields: "id") {
3737
asg: [awsAsg] @hasInverse(field: iamRole)
3838
awsCognitoIdentityPool: [awsCognitoIdentityPool] @hasInverse(field: iamRoles)
3939
rdsDbInstance: [awsRdsDbInstance] @hasInverse(field: iamRoles)
40+
elasticSearchDomains: [awsElasticSearchDomain] @hasInverse(field: iamRole)
4041
emrCluster: [awsEmrCluster] @hasInverse(field: iamRoles)
4142
}

0 commit comments

Comments
 (0)