com.mozilla.secops.authprofile

Class AwsAssumeRoleCorrelator

java.lang.Object

org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Event>>

com.mozilla.secops.authprofile.AwsAssumeRoleCorrelator

All Implemented Interfaces:

Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

public class AwsAssumeRoleCorrelator
extends org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Event>>

Analyze cross account assumeRole events and correlates between the trusting account (the account a role is being assumed in) and the trusted account (the account with the iam user assuming a role).

The normalized event for the trusting account is fixed up with the user information from the trusted event.

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	AwsAssumeRoleCorrelator.CrossAccountAssumeRoleFilter Returns only AssumeRole events with a sharedEventID indicating there's events across two accounts that need to be correlated

Constructor Summary

Constructors

Constructor and Description
AwsAssumeRoleCorrelator(AuthProfile.AuthProfileOptions options)

Method Summary

Modifier and Type	Method and Description
org.apache.beam.sdk.values.PCollection<Event>	expand(org.apache.beam.sdk.values.PCollection<Event> input)

Methods inherited from class org.apache.beam.sdk.transforms.PTransform

compose, compose, getAdditionalInputs, getDefaultOutputCoder, getName, getResourceHints, populateDisplayData, setResourceHints, toString, validate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

AwsAssumeRoleCorrelator

public AwsAssumeRoleCorrelator(AuthProfile.AuthProfileOptions options)

Method Detail

expand

public org.apache.beam.sdk.values.PCollection<Event> expand(org.apache.beam.sdk.values.PCollection<Event> input)

Specified by:

expand in class org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Event>>