strongdm.client

  1# Copyright 2020 StrongDM Inc
  2#
  3# Licensed under the Apache License, Version 2.0 (the "License");
  4# you may not use this file except in compliance with the License.
  5# You may obtain a copy of the License at
  6#
  7#     http://www.apache.org/licenses/LICENSE-2.0
  8#
  9# Unless required by applicable law or agreed to in writing, software
 10# distributed under the License is distributed on an "AS IS" BASIS,
 11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 12# See the License for the specific language governing permissions and
 13# limitations under the License.
 14#
 15
 16# Code generated by protogen. DO NOT EDIT.
 17
 18import base64
 19import copy
 20import datetime
 21import grpc
 22import hashlib
 23import hmac
 24import random
 25import time
 26from . import errors
 27from . import plumbing
 28from . import svc
 29
 30# These defaults are taken from AWS. Customization of these values
 31# is a future step in the API.
 32DEFAULT_BASE_RETRY_DELAY = 1  # 1 second
 33DEFAULT_MAX_RETRY_DELAY = 120  # 120 seconds
 34DEFAULT_RETRY_FACTOR = 1.6
 35DEFAULT_RETRY_JITTER = 0.2
 36API_VERSION = '2025-04-14'
 37USER_AGENT = 'strongdm-sdk-python/15.37.0'
 38
 39
 40class Client:
 41    '''Client interacts with the strongDM API.'''
 42    def __init__(self,
 43                 api_access_key,
 44                 api_secret,
 45                 host='app.strongdm.com:443',
 46                 insecure=False,
 47                 retry_rate_limit_errors=True,
 48                 page_limit=0):
 49        '''
 50        Create a new Client.
 51
 52        - api_access_key: the access key to authenticate with strongDM
 53        - api_secret: the secret key to authenticate with strongDM
 54        '''
 55        self.api_access_key = api_access_key.strip()
 56        self.api_secret = base64.b64decode(api_secret.strip())
 57        self.base_retry_delay = DEFAULT_BASE_RETRY_DELAY
 58        self.max_retry_delay = DEFAULT_MAX_RETRY_DELAY
 59        self.retry_factor = DEFAULT_RETRY_FACTOR
 60        self.retry_jitter = DEFAULT_RETRY_JITTER
 61        self.retry_rate_limit_errors = retry_rate_limit_errors
 62        self.snapshot_datetime = None
 63        self.page_limit = page_limit
 64
 65        try:
 66            if insecure:
 67                channel = grpc.insecure_channel(host)
 68            else:
 69                creds = grpc.ssl_channel_credentials()
 70                channel = grpc.secure_channel(host, creds)
 71        except Exception as e:
 72            raise plumbing.convert_error_to_porcelain(e) from e
 73        self.channel = channel
 74        self.access_requests = svc.AccessRequests(channel, self)
 75        '''
 76         AccessRequests are requests for access to a resource that may match a Workflow.
 77
 78        See `strongdm.svc.AccessRequests`.
 79        '''
 80        self.access_request_events_history = svc.AccessRequestEventsHistory(
 81            channel, self)
 82        '''
 83         AccessRequestEventsHistory provides records of all changes to the state of an AccessRequest.
 84
 85        See `strongdm.svc.AccessRequestEventsHistory`.
 86        '''
 87        self.access_requests_history = svc.AccessRequestsHistory(channel, self)
 88        '''
 89         AccessRequestsHistory provides records of all changes to the state of an AccessRequest.
 90
 91        See `strongdm.svc.AccessRequestsHistory`.
 92        '''
 93        self.account_attachments = svc.AccountAttachments(channel, self)
 94        '''
 95         AccountAttachments assign an account to a role.
 96
 97        See `strongdm.svc.AccountAttachments`.
 98        '''
 99        self.account_attachments_history = svc.AccountAttachmentsHistory(
100            channel, self)
101        '''
102         AccountAttachmentsHistory records all changes to the state of an AccountAttachment.
103
104        See `strongdm.svc.AccountAttachmentsHistory`.
105        '''
106        self.account_grants = svc.AccountGrants(channel, self)
107        '''
108         AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
109
110        See `strongdm.svc.AccountGrants`.
111        '''
112        self.account_grants_history = svc.AccountGrantsHistory(channel, self)
113        '''
114         AccountGrantsHistory records all changes to the state of an AccountGrant.
115
116        See `strongdm.svc.AccountGrantsHistory`.
117        '''
118        self.account_permissions = svc.AccountPermissions(channel, self)
119        '''
120         AccountPermissions records the granular permissions accounts have, allowing them to execute
121         relevant commands via StrongDM's APIs.
122
123        See `strongdm.svc.AccountPermissions`.
124        '''
125        self.account_resources = svc.AccountResources(channel, self)
126        '''
127         AccountResources enumerates the resources to which accounts have access.
128         The AccountResources service is read-only.
129
130        See `strongdm.svc.AccountResources`.
131        '''
132        self.account_resources_history = svc.AccountResourcesHistory(
133            channel, self)
134        '''
135         AccountResourcesHistory records all changes to the state of a AccountResource.
136
137        See `strongdm.svc.AccountResourcesHistory`.
138        '''
139        self.accounts = svc.Accounts(channel, self)
140        '''
141         Accounts are users that have access to strongDM. There are two types of accounts:
142         1. **Users:** humans who are authenticated through username and password or SSO.
143         2. **Service Accounts:** machines that are authenticated using a service token.
144         3. **Tokens** are access keys with permissions that can be used for authentication.
145
146        See `strongdm.svc.Accounts`.
147        '''
148        self.accounts_groups = svc.AccountsGroups(channel, self)
149        '''
150         An AccountGroup links an account and a group.
151
152        See `strongdm.svc.AccountsGroups`.
153        '''
154        self.accounts_groups_history = svc.AccountsGroupsHistory(channel, self)
155        '''
156         AccountsGroupsHistory records all changes to the state of an AccountGroup.
157
158        See `strongdm.svc.AccountsGroupsHistory`.
159        '''
160        self.accounts_history = svc.AccountsHistory(channel, self)
161        '''
162         AccountsHistory records all changes to the state of an Account.
163
164        See `strongdm.svc.AccountsHistory`.
165        '''
166        self.activities = svc.Activities(channel, self)
167        '''
168         An Activity is a record of an action taken against a strongDM deployment, e.g.
169         a user creation, resource deletion, sso configuration change, etc. The Activities
170         service is read-only.
171
172        See `strongdm.svc.Activities`.
173        '''
174        self.approval_workflow_approvers = svc.ApprovalWorkflowApprovers(
175            channel, self)
176        '''
177         ApprovalWorkflowApprovers link approval workflow approvers to an ApprovalWorkflowStep
178
179        See `strongdm.svc.ApprovalWorkflowApprovers`.
180        '''
181        self.approval_workflow_approvers_history = svc.ApprovalWorkflowApproversHistory(
182            channel, self)
183        '''
184         ApprovalWorkflowApproversHistory records all changes to the state of an ApprovalWorkflowApprover.
185
186        See `strongdm.svc.ApprovalWorkflowApproversHistory`.
187        '''
188        self.approval_workflow_steps = svc.ApprovalWorkflowSteps(channel, self)
189        '''
190         ApprovalWorkflowSteps link approval workflow steps to an ApprovalWorkflow
191
192        See `strongdm.svc.ApprovalWorkflowSteps`.
193        '''
194        self.approval_workflow_steps_history = svc.ApprovalWorkflowStepsHistory(
195            channel, self)
196        '''
197         ApprovalWorkflowStepsHistory records all changes to the state of an ApprovalWorkflowStep.
198
199        See `strongdm.svc.ApprovalWorkflowStepsHistory`.
200        '''
201        self.approval_workflows = svc.ApprovalWorkflows(channel, self)
202        '''
203         ApprovalWorkflows are the mechanism by which requests for access can be viewed by authorized
204         approvers and be approved or denied.
205
206        See `strongdm.svc.ApprovalWorkflows`.
207        '''
208        self.approval_workflows_history = svc.ApprovalWorkflowsHistory(
209            channel, self)
210        '''
211         ApprovalWorkflowsHistory records all changes to the state of an ApprovalWorkflow.
212
213        See `strongdm.svc.ApprovalWorkflowsHistory`.
214        '''
215        self.control_panel = svc.ControlPanel(channel, self)
216        '''
217         ControlPanel contains all administrative controls.
218
219        See `strongdm.svc.ControlPanel`.
220        '''
221        self.roles = svc.Roles(channel, self)
222        '''
223         A Role has a list of access rules which determine which Resources the members
224         of the Role have access to. An Account can be a member of multiple Roles via
225         AccountAttachments.
226
227        See `strongdm.svc.Roles`.
228        '''
229        self.groups = svc.Groups(channel, self)
230        '''
231         A Group is a set of principals.
232
233        See `strongdm.svc.Groups`.
234        '''
235        self.groups_history = svc.GroupsHistory(channel, self)
236        '''
237         GroupsHistory records all changes to the state of a Group.
238
239        See `strongdm.svc.GroupsHistory`.
240        '''
241        self.groups_roles = svc.GroupsRoles(channel, self)
242        '''
243         A GroupRole is an assignment of a Group to a Role.
244
245        See `strongdm.svc.GroupsRoles`.
246        '''
247        self.groups_roles_history = svc.GroupsRolesHistory(channel, self)
248        '''
249         GroupsRolesHistory records all changes to the state of a GroupRole.
250
251        See `strongdm.svc.GroupsRolesHistory`.
252        '''
253        self.health_checks = svc.HealthChecks(channel, self)
254        '''
255         HealthChecks lists the last healthcheck between each node and resource.
256         Note the unconventional capitalization here is to prevent having a collision with GRPC
257
258        See `strongdm.svc.HealthChecks`.
259        '''
260        self.identity_aliases = svc.IdentityAliases(channel, self)
261        '''
262         IdentityAliases assign an alias to an account within an IdentitySet.
263         The alias is used as the username when connecting to a identity supported resource.
264
265        See `strongdm.svc.IdentityAliases`.
266        '''
267        self.identity_aliases_history = svc.IdentityAliasesHistory(
268            channel, self)
269        '''
270         IdentityAliasesHistory records all changes to the state of a IdentityAlias.
271
272        See `strongdm.svc.IdentityAliasesHistory`.
273        '''
274        self.identity_sets = svc.IdentitySets(channel, self)
275        '''
276         A IdentitySet is a named grouping of Identity Aliases for Accounts.
277         An Account's relationship to a IdentitySet is defined via IdentityAlias objects.
278
279        See `strongdm.svc.IdentitySets`.
280        '''
281        self.identity_sets_history = svc.IdentitySetsHistory(channel, self)
282        '''
283         IdentitySetsHistory records all changes to the state of a IdentitySet.
284
285        See `strongdm.svc.IdentitySetsHistory`.
286        '''
287        self.managed_secrets = svc.ManagedSecrets(channel, self)
288        '''
289         ManagedSecret is a private vertical for creating, reading, updating,
290         deleting, listing and rotating the managed secrets in the secrets engines as
291         an authenticated user.
292
293        See `strongdm.svc.ManagedSecrets`.
294        '''
295        self.nodes = svc.Nodes(channel, self)
296        '''
297         Nodes make up the StrongDM network, and allow your users to connect securely to your resources.
298         There are three types of nodes:
299         1. **Relay:** creates connectivity to your datasources, while maintaining the egress-only nature of your firewall
300         2. **Gateway:** a relay that also listens for connections from StrongDM clients
301         3. **Proxy Cluster:** a cluster of workers that together mediate access from clients to resources
302
303        See `strongdm.svc.Nodes`.
304        '''
305        self.nodes_history = svc.NodesHistory(channel, self)
306        '''
307         NodesHistory records all changes to the state of a Node.
308
309        See `strongdm.svc.NodesHistory`.
310        '''
311        self.organization_history = svc.OrganizationHistory(channel, self)
312        '''
313         OrganizationHistory records all changes to the state of an Organization.
314
315        See `strongdm.svc.OrganizationHistory`.
316        '''
317        self.peering_group_nodes = svc.PeeringGroupNodes(channel, self)
318        '''
319         PeeringGroupNodes provides the building blocks necessary to obtain attach a node to a peering group.
320
321        See `strongdm.svc.PeeringGroupNodes`.
322        '''
323        self.peering_group_peers = svc.PeeringGroupPeers(channel, self)
324        '''
325         PeeringGroupPeers provides the building blocks necessary to link two peering groups.
326
327        See `strongdm.svc.PeeringGroupPeers`.
328        '''
329        self.peering_group_resources = svc.PeeringGroupResources(channel, self)
330        '''
331         PeeringGroupResources provides the building blocks necessary to obtain attach a resource to a peering group.
332
333        See `strongdm.svc.PeeringGroupResources`.
334        '''
335        self.peering_groups = svc.PeeringGroups(channel, self)
336        '''
337         PeeringGroups provides the building blocks necessary to obtain explicit network topology and routing.
338
339        See `strongdm.svc.PeeringGroups`.
340        '''
341        self.policies = svc.Policies(channel, self)
342        '''
343         Policies are the collection of one or more statements that enforce fine-grained access
344         control for the users of an organization.
345
346        See `strongdm.svc.Policies`.
347        '''
348        self.policies_history = svc.PoliciesHistory(channel, self)
349        '''
350         PoliciesHistory records all changes to the state of a Policy.
351
352        See `strongdm.svc.PoliciesHistory`.
353        '''
354        self.proxy_cluster_keys = svc.ProxyClusterKeys(channel, self)
355        '''
356         Proxy Cluster Keys are authentication keys for all proxies within a cluster.
357         The proxies within a cluster share the same key. One cluster can have
358         multiple keys in order to facilitate key rotation.
359
360        See `strongdm.svc.ProxyClusterKeys`.
361        '''
362        self.queries = svc.Queries(channel, self)
363        '''
364         A Query is a record of a single client request to a resource, such as a SQL query.
365         Long-running SSH, RDP, or Kubernetes interactive sessions also count as queries.
366         The Queries service is read-only.
367
368        See `strongdm.svc.Queries`.
369        '''
370        self.remote_identities = svc.RemoteIdentities(channel, self)
371        '''
372         RemoteIdentities assign a resource directly to an account, giving the account the permission to connect to that resource.
373
374        See `strongdm.svc.RemoteIdentities`.
375        '''
376        self.remote_identities_history = svc.RemoteIdentitiesHistory(
377            channel, self)
378        '''
379         RemoteIdentitiesHistory records all changes to the state of a RemoteIdentity.
380
381        See `strongdm.svc.RemoteIdentitiesHistory`.
382        '''
383        self.remote_identity_groups = svc.RemoteIdentityGroups(channel, self)
384        '''
385         A RemoteIdentityGroup is a named grouping of Remote Identities for Accounts.
386         An Account's relationship to a RemoteIdentityGroup is defined via RemoteIdentity objects.
387
388        See `strongdm.svc.RemoteIdentityGroups`.
389        '''
390        self.remote_identity_groups_history = svc.RemoteIdentityGroupsHistory(
391            channel, self)
392        '''
393         RemoteIdentityGroupsHistory records all changes to the state of a RemoteIdentityGroup.
394
395        See `strongdm.svc.RemoteIdentityGroupsHistory`.
396        '''
397        self.replays = svc.Replays(channel, self)
398        '''
399         A Replay captures the data transferred over a long-running SSH, RDP, or Kubernetes interactive session
400         (otherwise referred to as a query). The Replays service is read-only.
401
402        See `strongdm.svc.Replays`.
403        '''
404        self.resources = svc.Resources(channel, self)
405        '''
406         Resources are databases, servers, clusters, websites, or clouds that strongDM
407         delegates access to.
408
409        See `strongdm.svc.Resources`.
410        '''
411        self.resources_history = svc.ResourcesHistory(channel, self)
412        '''
413         ResourcesHistory records all changes to the state of a Resource.
414
415        See `strongdm.svc.ResourcesHistory`.
416        '''
417        self.role_resources = svc.RoleResources(channel, self)
418        '''
419         RoleResources enumerates the resources to which roles have access.
420         The RoleResources service is read-only.
421
422        See `strongdm.svc.RoleResources`.
423        '''
424        self.role_resources_history = svc.RoleResourcesHistory(channel, self)
425        '''
426         RoleResourcesHistory records all changes to the state of a RoleResource.
427
428        See `strongdm.svc.RoleResourcesHistory`.
429        '''
430        self.roles_history = svc.RolesHistory(channel, self)
431        '''
432         RolesHistory records all changes to the state of a Role.
433
434        See `strongdm.svc.RolesHistory`.
435        '''
436        self.secret_stores = svc.SecretStores(channel, self)
437        '''
438         SecretStores are servers where resource secrets (passwords, keys) are stored.
439
440        See `strongdm.svc.SecretStores`.
441        '''
442        self.secret_engines = svc.SecretEngines(channel, self)
443        '''
444
445
446        See `strongdm.svc.SecretEngines`.
447        '''
448        self.secret_store_healths = svc.SecretStoreHealths(channel, self)
449        '''
450         SecretStoreHealths exposes health states for secret stores.
451
452        See `strongdm.svc.SecretStoreHealths`.
453        '''
454        self.secret_stores_history = svc.SecretStoresHistory(channel, self)
455        '''
456         SecretStoresHistory records all changes to the state of a SecretStore.
457
458        See `strongdm.svc.SecretStoresHistory`.
459        '''
460        self.workflow_approvers = svc.WorkflowApprovers(channel, self)
461        '''
462         WorkflowApprovers is an account or a role with the ability to approve requests bound to a workflow.
463
464        See `strongdm.svc.WorkflowApprovers`.
465        '''
466        self.workflow_approvers_history = svc.WorkflowApproversHistory(
467            channel, self)
468        '''
469         WorkflowApproversHistory provides records of all changes to the state of a WorkflowApprover.
470
471        See `strongdm.svc.WorkflowApproversHistory`.
472        '''
473        self.workflow_roles = svc.WorkflowRoles(channel, self)
474        '''
475         WorkflowRole links a role to a workflow. The linked roles indicate which roles a user must be a part of
476         to request access to a resource via the workflow.
477
478        See `strongdm.svc.WorkflowRoles`.
479        '''
480        self.workflow_roles_history = svc.WorkflowRolesHistory(channel, self)
481        '''
482         WorkflowRolesHistory provides records of all changes to the state of a WorkflowRole
483
484        See `strongdm.svc.WorkflowRolesHistory`.
485        '''
486        self.workflows = svc.Workflows(channel, self)
487        '''
488         Workflows are the collection of rules that define the resources to which access can be requested,
489         the users that can request that access, and the mechanism for approving those requests which can either
490         be automatic approval or a set of users authorized to approve the requests.
491
492        See `strongdm.svc.Workflows`.
493        '''
494        self.workflows_history = svc.WorkflowsHistory(channel, self)
495        '''
496         WorkflowsHistory provides records of all changes to the state of a Workflow.
497
498        See `strongdm.svc.WorkflowsHistory`.
499        '''
500
501    def close(self):
502        '''Closes this Client and releases all resources held by it.
503
504        Closing the Client will immediately terminate all RPCs active with the
505        Client and it is not valid to invoke new RPCs with the Client.
506
507        This method is idempotent.
508        '''
509        self.channel.close()
510
511    def get_metadata(self, method_name, req):
512        return [
513            ('x-sdm-authentication', self.api_access_key),
514            ('x-sdm-signature', self.sign(method_name,
515                                          req.SerializeToString())),
516            ('x-sdm-api-version', API_VERSION),
517            ('x-sdm-user-agent', USER_AGENT),
518        ]
519
520    def sign(self, method_name, request_bytes):
521        def hmac_digest(key, msg_byte_string):
522            return hmac.new(key, msg=msg_byte_string,
523                            digestmod=hashlib.sha256).digest()
524
525        current_utc_date = datetime.datetime.now(
526            datetime.timezone.utc).strftime('%Y-%m-%d')
527        signing_key = hmac_digest(self.api_secret, current_utc_date.encode())
528        signing_key = hmac_digest(signing_key, b'sdm_api_v1')
529
530        hash = hashlib.sha256()
531
532        hash.update(method_name.encode())
533        hash.update(b'\n')
534        hash.update(request_bytes)
535
536        return base64.b64encode(hmac_digest(signing_key, hash.digest()))
537
538    def exponentialBackoff(self, retries, deadline=None):
539        def applyDeadline(delay, deadline):
540            if deadline is None:
541                return delay
542            remaining = deadline - time.time()
543            if remaining < 0:
544                return 0
545            return min(delay, remaining)
546
547        if retries == 0:
548            return applyDeadline(self.base_retry_delay, deadline)
549
550        backoff, max_delay = self.base_retry_delay, self.max_retry_delay
551        while backoff < max_delay and retries > 0:
552            backoff *= self.retry_factor
553            retries -= 1
554
555        if backoff > max_delay:
556            backoff = max_delay
557
558        # Randomize backoff delays so that if a cluster of requests start at
559        # the same time, they won't operate in lockstep.
560        backoff *= 1 + self.retry_jitter * (random.random() * 2 - 1)
561        if backoff < 0:
562            return 0
563
564        return applyDeadline(backoff, deadline)
565
566    def shouldRetry(self, retries, err, deadline=None):
567        # Check if we've passed the deadline
568        if deadline is not None and time.time() >= deadline:
569            return False
570
571        if not isinstance(err, grpc.RpcError):
572            return False
573
574        if self.retry_rate_limit_errors and err.code(
575        ) == grpc.StatusCode.RESOURCE_EXHAUSTED:
576            return True
577
578        return retries <= 3 and (err.code() == grpc.StatusCode.INTERNAL
579                                 or err.code() == grpc.StatusCode.UNAVAILABLE)
580
581    def snapshot_at(self, snapshot_datetime):
582        '''
583        Constructs a read-only client that will provide historical data from the provided timestamp.
584
585        See `SnapshotClient`.
586        '''
587        client = copy.copy(self)
588        client.snapshot_datetime = snapshot_datetime
589        client.access_requests = svc.AccessRequests(client.channel, client)
590        client.account_attachments = svc.AccountAttachments(
591            client.channel, client)
592        client.account_grants = svc.AccountGrants(client.channel, client)
593        client.account_permissions = svc.AccountPermissions(
594            client.channel, client)
595        client.account_resources = svc.AccountResources(client.channel, client)
596        client.accounts = svc.Accounts(client.channel, client)
597        client.accounts_groups = svc.AccountsGroups(client.channel, client)
598        client.approval_workflow_approvers = svc.ApprovalWorkflowApprovers(
599            client.channel, client)
600        client.approval_workflow_steps = svc.ApprovalWorkflowSteps(
601            client.channel, client)
602        client.approval_workflows = svc.ApprovalWorkflows(
603            client.channel, client)
604        client.roles = svc.Roles(client.channel, client)
605        client.groups = svc.Groups(client.channel, client)
606        client.groups_roles = svc.GroupsRoles(client.channel, client)
607        client.identity_aliases = svc.IdentityAliases(client.channel, client)
608        client.identity_sets = svc.IdentitySets(client.channel, client)
609        client.nodes = svc.Nodes(client.channel, client)
610        client.policies = svc.Policies(client.channel, client)
611        client.proxy_cluster_keys = svc.ProxyClusterKeys(
612            client.channel, client)
613        client.remote_identities = svc.RemoteIdentities(client.channel, client)
614        client.remote_identity_groups = svc.RemoteIdentityGroups(
615            client.channel, client)
616        client.resources = svc.Resources(client.channel, client)
617        client.role_resources = svc.RoleResources(client.channel, client)
618        client.secret_stores = svc.SecretStores(client.channel, client)
619        client.workflow_approvers = svc.WorkflowApprovers(
620            client.channel, client)
621        client.workflow_roles = svc.WorkflowRoles(client.channel, client)
622        client.workflows = svc.Workflows(client.channel, client)
623        return SnapshotClient(client)
624
625
626class SnapshotClient:
627    '''SnapshotClient exposes methods to query historical records at a provided timestamp.'''
628    def __init__(self, client):
629        self.access_requests = svc.SnapshotAccessRequests(
630            client.access_requests)
631        '''
632         AccessRequests are requests for access to a resource that may match a Workflow.
633
634        See `strongdm.svc.SnapshotAccessRequests`.
635        '''
636        self.account_attachments = svc.SnapshotAccountAttachments(
637            client.account_attachments)
638        '''
639         AccountAttachments assign an account to a role.
640
641        See `strongdm.svc.SnapshotAccountAttachments`.
642        '''
643        self.account_grants = svc.SnapshotAccountGrants(client.account_grants)
644        '''
645         AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
646
647        See `strongdm.svc.SnapshotAccountGrants`.
648        '''
649        self.account_permissions = svc.SnapshotAccountPermissions(
650            client.account_permissions)
651        '''
652         AccountPermissions records the granular permissions accounts have, allowing them to execute
653         relevant commands via StrongDM's APIs.
654
655        See `strongdm.svc.SnapshotAccountPermissions`.
656        '''
657        self.account_resources = svc.SnapshotAccountResources(
658            client.account_resources)
659        '''
660         AccountResources enumerates the resources to which accounts have access.
661         The AccountResources service is read-only.
662
663        See `strongdm.svc.SnapshotAccountResources`.
664        '''
665        self.accounts = svc.SnapshotAccounts(client.accounts)
666        '''
667         Accounts are users that have access to strongDM. There are two types of accounts:
668         1. **Users:** humans who are authenticated through username and password or SSO.
669         2. **Service Accounts:** machines that are authenticated using a service token.
670         3. **Tokens** are access keys with permissions that can be used for authentication.
671
672        See `strongdm.svc.SnapshotAccounts`.
673        '''
674        self.accounts_groups = svc.SnapshotAccountsGroups(
675            client.accounts_groups)
676        '''
677         An AccountGroup links an account and a group.
678
679        See `strongdm.svc.SnapshotAccountsGroups`.
680        '''
681        self.approval_workflow_approvers = svc.SnapshotApprovalWorkflowApprovers(
682            client.approval_workflow_approvers)
683        '''
684         ApprovalWorkflowApprovers link approval workflow approvers to an ApprovalWorkflowStep
685
686        See `strongdm.svc.SnapshotApprovalWorkflowApprovers`.
687        '''
688        self.approval_workflow_steps = svc.SnapshotApprovalWorkflowSteps(
689            client.approval_workflow_steps)
690        '''
691         ApprovalWorkflowSteps link approval workflow steps to an ApprovalWorkflow
692
693        See `strongdm.svc.SnapshotApprovalWorkflowSteps`.
694        '''
695        self.approval_workflows = svc.SnapshotApprovalWorkflows(
696            client.approval_workflows)
697        '''
698         ApprovalWorkflows are the mechanism by which requests for access can be viewed by authorized
699         approvers and be approved or denied.
700
701        See `strongdm.svc.SnapshotApprovalWorkflows`.
702        '''
703        self.roles = svc.SnapshotRoles(client.roles)
704        '''
705         A Role has a list of access rules which determine which Resources the members
706         of the Role have access to. An Account can be a member of multiple Roles via
707         AccountAttachments.
708
709        See `strongdm.svc.SnapshotRoles`.
710        '''
711        self.groups = svc.SnapshotGroups(client.groups)
712        '''
713         A Group is a set of principals.
714
715        See `strongdm.svc.SnapshotGroups`.
716        '''
717        self.groups_roles = svc.SnapshotGroupsRoles(client.groups_roles)
718        '''
719         A GroupRole is an assignment of a Group to a Role.
720
721        See `strongdm.svc.SnapshotGroupsRoles`.
722        '''
723        self.identity_aliases = svc.SnapshotIdentityAliases(
724            client.identity_aliases)
725        '''
726         IdentityAliases assign an alias to an account within an IdentitySet.
727         The alias is used as the username when connecting to a identity supported resource.
728
729        See `strongdm.svc.SnapshotIdentityAliases`.
730        '''
731        self.identity_sets = svc.SnapshotIdentitySets(client.identity_sets)
732        '''
733         A IdentitySet is a named grouping of Identity Aliases for Accounts.
734         An Account's relationship to a IdentitySet is defined via IdentityAlias objects.
735
736        See `strongdm.svc.SnapshotIdentitySets`.
737        '''
738        self.nodes = svc.SnapshotNodes(client.nodes)
739        '''
740         Nodes make up the StrongDM network, and allow your users to connect securely to your resources.
741         There are three types of nodes:
742         1. **Relay:** creates connectivity to your datasources, while maintaining the egress-only nature of your firewall
743         2. **Gateway:** a relay that also listens for connections from StrongDM clients
744         3. **Proxy Cluster:** a cluster of workers that together mediate access from clients to resources
745
746        See `strongdm.svc.SnapshotNodes`.
747        '''
748        self.policies = svc.SnapshotPolicies(client.policies)
749        '''
750         Policies are the collection of one or more statements that enforce fine-grained access
751         control for the users of an organization.
752
753        See `strongdm.svc.SnapshotPolicies`.
754        '''
755        self.proxy_cluster_keys = svc.SnapshotProxyClusterKeys(
756            client.proxy_cluster_keys)
757        '''
758         Proxy Cluster Keys are authentication keys for all proxies within a cluster.
759         The proxies within a cluster share the same key. One cluster can have
760         multiple keys in order to facilitate key rotation.
761
762        See `strongdm.svc.SnapshotProxyClusterKeys`.
763        '''
764        self.remote_identities = svc.SnapshotRemoteIdentities(
765            client.remote_identities)
766        '''
767         RemoteIdentities assign a resource directly to an account, giving the account the permission to connect to that resource.
768
769        See `strongdm.svc.SnapshotRemoteIdentities`.
770        '''
771        self.remote_identity_groups = svc.SnapshotRemoteIdentityGroups(
772            client.remote_identity_groups)
773        '''
774         A RemoteIdentityGroup is a named grouping of Remote Identities for Accounts.
775         An Account's relationship to a RemoteIdentityGroup is defined via RemoteIdentity objects.
776
777        See `strongdm.svc.SnapshotRemoteIdentityGroups`.
778        '''
779        self.resources = svc.SnapshotResources(client.resources)
780        '''
781         Resources are databases, servers, clusters, websites, or clouds that strongDM
782         delegates access to.
783
784        See `strongdm.svc.SnapshotResources`.
785        '''
786        self.role_resources = svc.SnapshotRoleResources(client.role_resources)
787        '''
788         RoleResources enumerates the resources to which roles have access.
789         The RoleResources service is read-only.
790
791        See `strongdm.svc.SnapshotRoleResources`.
792        '''
793        self.secret_stores = svc.SnapshotSecretStores(client.secret_stores)
794        '''
795         SecretStores are servers where resource secrets (passwords, keys) are stored.
796
797        See `strongdm.svc.SnapshotSecretStores`.
798        '''
799        self.workflow_approvers = svc.SnapshotWorkflowApprovers(
800            client.workflow_approvers)
801        '''
802         WorkflowApprovers is an account or a role with the ability to approve requests bound to a workflow.
803
804        See `strongdm.svc.SnapshotWorkflowApprovers`.
805        '''
806        self.workflow_roles = svc.SnapshotWorkflowRoles(client.workflow_roles)
807        '''
808         WorkflowRole links a role to a workflow. The linked roles indicate which roles a user must be a part of
809         to request access to a resource via the workflow.
810
811        See `strongdm.svc.SnapshotWorkflowRoles`.
812        '''
813        self.workflows = svc.SnapshotWorkflows(client.workflows)
814        '''
815         Workflows are the collection of rules that define the resources to which access can be requested,
816         the users that can request that access, and the mechanism for approving those requests which can either
817         be automatic approval or a set of users authorized to approve the requests.
818
819        See `strongdm.svc.SnapshotWorkflows`.
820        '''