Skip to content

Glue Job Edge #119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: v1.2.0-dev
Choose a base branch
from
Open

Glue Job Edge #119

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eda8eaf
Adding in query for Glue Jobs
wdahlenburg Sep 5, 2022
6fd9e23
Identify all Glue edges via an update permission
wdahlenburg Sep 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
94 changes: 75 additions & 19 deletions principalmapper/graphing/glue_edges.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,22 @@ def return_edges(self, nodes: List[Node], region_allow_list: Optional[List[str]]
f'devEndpoint/{endpoint["EndpointName"]}'
endpoint_role_list.append((endpoint_arn, role_node))

# paginate thru existing Glue Jobs
for page in glue_client.get_paginator('get_jobs').paginate():
for job in page['Jobs']:
role_node = None
if 'Role' in job:
for node in nodes:
if node.arn == job['Role']:
role_node = node
break

if len(nodes) == 0:
break # causes false-negatives if there's no users/roles in the account
job_arn = f'arn:{partition}:glue:{current_region}:{arns.get_account_id(nodes[0].arn)}:' \
f'job/{job["Name"]}'
endpoint_role_list.append((job_arn, role_node))

except ClientError as ex:
logger.warning('Unable to search region {} for projects. The region may be disabled, or the error may '
'be caused by an authorization issue. Continuing.'.format(glue_client.meta.region_name))
Expand Down Expand Up @@ -132,26 +148,46 @@ def generate_edges_locally(nodes: List[Node], scps: Optional[List[List[dict]]] =

# check if source can use existing endpoints to access destination
if node_destination in node_endpoint_map:
for target_endpoint in node_endpoint_map[node_destination]:
update_ep_auth, update_ep_needs_mfa = query_interface.local_check_authorization_handling_mfa(
node_source,
'glue:UpdateDevEndpoint',
target_endpoint,
{},
service_control_policy_groups=scps
)
if update_ep_auth:
if update_ep_needs_mfa:
reason = f'(requires MFA) can use the Glue resource {target_endpoint} to access'
else:
reason = f'can use the Glue resource {target_endpoint} to access'
results.append(Edge(
for target in node_endpoint_map[node_destination]:
if ':devEndpoint/' in target:
update_ep_auth, update_ep_needs_mfa = query_interface.local_check_authorization_handling_mfa(
node_source,
node_destination,
reason,
'Glue'
))
break
'glue:UpdateDevEndpoint',
target,
{},
service_control_policy_groups=scps
)
if update_ep_auth:
if update_ep_needs_mfa:
reason = f'(requires MFA) can use the Glue resource {target} to access'
else:
reason = f'can use the Glue resource {target} to access'
results.append(Edge(
node_source,
node_destination,
reason,
'Glue'
))

if ':job/' in target:
update_job_auth, update_job_needs_mfa = query_interface.local_check_authorization_handling_mfa(
node_source,
'glue:UpdateJob',
target,
{},
service_control_policy_groups=scps
)
if update_job_auth:
if update_job_needs_mfa:
reason = f'(requires MFA) can use the Glue resource {target} to access'
else:
reason = f'can use the Glue resource {target} to access'
results.append(Edge(
node_source,
node_destination,
reason,
'Glue'
))

# check if source can create a new endpoint to access destination
passrole_auth, passrole_needs_mfa = query_interface.local_check_authorization_handling_mfa(
Expand Down Expand Up @@ -183,4 +219,24 @@ def generate_edges_locally(nodes: List[Node], scps: Optional[List[List[dict]]] =
'Glue'
))

create_job_auth, create_job_needs_mfa = query_interface.local_check_authorization_handling_mfa(
node_source,
'glue:CreateJob',
'*',
{},
service_control_policy_groups=scps
)

if create_job_auth:
if passrole_needs_mfa or create_job_needs_mfa:
reason = '(requires MFA) can call glue:CreateJob to access'
else:
reason = 'can call glue:CreateJob to access'
results.append(Edge(
node_source,
node_destination,
reason,
'Glue'
))

return results