Aws iam server certs
Summary
This PR adds support for syncing AWS IAM Server Certificates to Cartography.
What this adds:
- New
AWSServerCertificatenode type with properties: arn, name, path, upload_date, certificateid RESOURCErelationship fromAWSServerCertificatetoAWSAccount- Server certificates can be synced as part of IAM sync or independently via
--aws-requested-syncs server_certificates
Implementation:
- Follows the modern data model pattern using
CartographyNodeSchema - Implements standard sync pattern:
get()→transform()→load()→cleanup() - Handles optional fields (path, upload_date) gracefully
- Uses IAM pagination for complete certificate retrieval
Related issues or links
- Adds missing AWS IAM resource type to Cartography
- Complements existing IAM sync functionality (users, roles, groups, policies)
Checklist
Provide proof that this works (this makes reviews move faster). Please perform one or more of the following:
-
[x] Update/add unit or integration tests.
- Unit tests:
test_transform_server_certificates()validates transformation with shared test data,test_transform_server_certificates_handles_optional_fields()validates optional field handling - Integration tests: Added assertions to
test_sync()verifying nodes and relationships are created correctly
- Unit tests:
-
[ ] Include a screenshot showing what the graph looked like before and after your changes.
- Will provide if requested - can run against test AWS account
-
[ ] Include console log trace showing what happened before and after your changes.
- Will provide if requested - can run against test AWS account
If you are changing a node or relationship:
- [ ] Update the schema and readme.
- TODO: Will update AWS schema documentation in follow-up commit if this approach is approved
If you are implementing a new intel module:
-
[x] Use the NodeSchema data model.
- Uses
CartographyNodeSchemawith properCartographyNodePropertiesandCartographyRelSchema - Follows AGENTS.md guidelines for modern data model implementation
- Uses
-
[x] Confirm that the linter actually passes (submitting a PR where the linter actually fails shows reviewers that you did not test your code and will delay your review).
- Will run linter before marking as ready for review
Testing performed
Unit tests pass
pytest tests/unit/cartography/intel/aws/iam/test_iam.py::test_transform_server_certificates -v pytest tests/unit/cartography/intel/aws/iam/test_iam.py::test_transform_server_certificates_handles_optional_fields -v
Integration tests pass
pytest tests/integration/cartography/intel/aws/iam/test_iam_sync.py::test_sync -v
Sorry seems like I forgot to sign the commits and there's a small merge conflict (Looks very easy to solve). I have to go to work now, but I'll fix both those issues today.