cartography icon indicating copy to clipboard operation
cartography copied to clipboard

Aws iam server certs

Open Jarro01X opened this issue 1 month ago • 1 comments

Summary

This PR adds support for syncing AWS IAM Server Certificates to Cartography.

What this adds:

  • New AWSServerCertificate node type with properties: arn, name, path, upload_date, certificateid
  • RESOURCE relationship from AWSServerCertificate to AWSAccount
  • Server certificates can be synced as part of IAM sync or independently via --aws-requested-syncs server_certificates

Implementation:

  • Follows the modern data model pattern using CartographyNodeSchema
  • Implements standard sync pattern: get()transform()load()cleanup()
  • Handles optional fields (path, upload_date) gracefully
  • Uses IAM pagination for complete certificate retrieval

Related issues or links

  • Adds missing AWS IAM resource type to Cartography
  • Complements existing IAM sync functionality (users, roles, groups, policies)

Checklist

Provide proof that this works (this makes reviews move faster). Please perform one or more of the following:

  • [x] Update/add unit or integration tests.

    • Unit tests: test_transform_server_certificates() validates transformation with shared test data, test_transform_server_certificates_handles_optional_fields() validates optional field handling
    • Integration tests: Added assertions to test_sync() verifying nodes and relationships are created correctly
  • [ ] Include a screenshot showing what the graph looked like before and after your changes.

    • Will provide if requested - can run against test AWS account
  • [ ] Include console log trace showing what happened before and after your changes.

    • Will provide if requested - can run against test AWS account

If you are changing a node or relationship:

  • [ ] Update the schema and readme.
    • TODO: Will update AWS schema documentation in follow-up commit if this approach is approved

If you are implementing a new intel module:

  • [x] Use the NodeSchema data model.

    • Uses CartographyNodeSchema with proper CartographyNodeProperties and CartographyRelSchema
    • Follows AGENTS.md guidelines for modern data model implementation
  • [x] Confirm that the linter actually passes (submitting a PR where the linter actually fails shows reviewers that you did not test your code and will delay your review).

    • Will run linter before marking as ready for review

Testing performed

Unit tests pass

pytest tests/unit/cartography/intel/aws/iam/test_iam.py::test_transform_server_certificates -v pytest tests/unit/cartography/intel/aws/iam/test_iam.py::test_transform_server_certificates_handles_optional_fields -v

Integration tests pass

pytest tests/integration/cartography/intel/aws/iam/test_iam_sync.py::test_sync -v

Jarro01X avatar Nov 20 '25 16:11 Jarro01X

Sorry seems like I forgot to sign the commits and there's a small merge conflict (Looks very easy to solve). I have to go to work now, but I'll fix both those issues today.

Jarro01X avatar Nov 20 '25 16:11 Jarro01X