strongdm.client

  1# Copyright 2020 StrongDM Inc
  2#
  3# Licensed under the Apache License, Version 2.0 (the "License");
  4# you may not use this file except in compliance with the License.
  5# You may obtain a copy of the License at
  6#
  7#     http://www.apache.org/licenses/LICENSE-2.0
  8#
  9# Unless required by applicable law or agreed to in writing, software
 10# distributed under the License is distributed on an "AS IS" BASIS,
 11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 12# See the License for the specific language governing permissions and
 13# limitations under the License.
 14#
 15
 16# Code generated by protogen. DO NOT EDIT.
 17
 18import base64
 19import copy
 20import datetime
 21import grpc
 22import hashlib
 23import hmac
 24import random
 25import time
 26from . import errors
 27from . import plumbing
 28from . import svc
 29
 30# These defaults are taken from AWS. Customization of these values
 31# is a future step in the API.
 32DEFAULT_MAX_RETRIES = 3
 33DEFAULT_BASE_RETRY_DELAY = 0.0030  # 30 ms
 34DEFAULT_MAX_RETRY_DELAY = 300  # 300 seconds
 35API_VERSION = '2025-04-14'
 36USER_AGENT = 'strongdm-sdk-python/14.10.0'
 37
 38
 39class Client:
 40    '''Client interacts with the strongDM API.'''
 41    def __init__(self,
 42                 api_access_key,
 43                 api_secret,
 44                 host='app.strongdm.com:443',
 45                 insecure=False,
 46                 retry_rate_limit_errors=True,
 47                 page_limit=50):
 48        '''
 49        Create a new Client.
 50
 51        - api_access_key: the access key to authenticate with strongDM
 52        - api_secret: the secret key to authenticate with strongDM
 53        '''
 54        self.api_access_key = api_access_key.strip()
 55        self.api_secret = base64.b64decode(api_secret.strip())
 56        self.max_retries = DEFAULT_MAX_RETRIES
 57        self.base_retry_delay = DEFAULT_BASE_RETRY_DELAY
 58        self.max_retry_delay = DEFAULT_MAX_RETRY_DELAY
 59        self.expose_rate_limit_errors = (not retry_rate_limit_errors)
 60        self.snapshot_datetime = None
 61        self.page_limit = page_limit
 62
 63        try:
 64            if insecure:
 65                channel = grpc.insecure_channel(host)
 66            else:
 67                creds = grpc.ssl_channel_credentials()
 68                channel = grpc.secure_channel(host, creds)
 69        except Exception as e:
 70            raise plumbing.convert_error_to_porcelain(e) from e
 71        self.channel = channel
 72        self.access_requests = svc.AccessRequests(channel, self)
 73        '''
 74         AccessRequests are requests for access to a resource that may match a Workflow.
 75
 76        See `strongdm.svc.AccessRequests`.
 77        '''
 78        self.access_request_events_history = svc.AccessRequestEventsHistory(
 79            channel, self)
 80        '''
 81         AccessRequestEventsHistory provides records of all changes to the state of an AccessRequest.
 82
 83        See `strongdm.svc.AccessRequestEventsHistory`.
 84        '''
 85        self.access_requests_history = svc.AccessRequestsHistory(channel, self)
 86        '''
 87         AccessRequestsHistory provides records of all changes to the state of an AccessRequest.
 88
 89        See `strongdm.svc.AccessRequestsHistory`.
 90        '''
 91        self.account_attachments = svc.AccountAttachments(channel, self)
 92        '''
 93         AccountAttachments assign an account to a role.
 94
 95        See `strongdm.svc.AccountAttachments`.
 96        '''
 97        self.account_attachments_history = svc.AccountAttachmentsHistory(
 98            channel, self)
 99        '''
100         AccountAttachmentsHistory records all changes to the state of an AccountAttachment.
101
102        See `strongdm.svc.AccountAttachmentsHistory`.
103        '''
104        self.account_grants = svc.AccountGrants(channel, self)
105        '''
106         AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
107
108        See `strongdm.svc.AccountGrants`.
109        '''
110        self.account_grants_history = svc.AccountGrantsHistory(channel, self)
111        '''
112         AccountGrantsHistory records all changes to the state of an AccountGrant.
113
114        See `strongdm.svc.AccountGrantsHistory`.
115        '''
116        self.account_permissions = svc.AccountPermissions(channel, self)
117        '''
118         AccountPermissions records the granular permissions accounts have, allowing them to execute
119         relevant commands via StrongDM's APIs.
120
121        See `strongdm.svc.AccountPermissions`.
122        '''
123        self.account_resources = svc.AccountResources(channel, self)
124        '''
125         AccountResources enumerates the resources to which accounts have access.
126         The AccountResources service is read-only.
127
128        See `strongdm.svc.AccountResources`.
129        '''
130        self.account_resources_history = svc.AccountResourcesHistory(
131            channel, self)
132        '''
133         AccountResourcesHistory records all changes to the state of a AccountResource.
134
135        See `strongdm.svc.AccountResourcesHistory`.
136        '''
137        self.accounts = svc.Accounts(channel, self)
138        '''
139         Accounts are users that have access to strongDM. There are two types of accounts:
140         1. **Users:** humans who are authenticated through username and password or SSO.
141         2. **Service Accounts:** machines that are authenticated using a service token.
142         3. **Tokens** are access keys with permissions that can be used for authentication.
143
144        See `strongdm.svc.Accounts`.
145        '''
146        self.accounts_history = svc.AccountsHistory(channel, self)
147        '''
148         AccountsHistory records all changes to the state of an Account.
149
150        See `strongdm.svc.AccountsHistory`.
151        '''
152        self.activities = svc.Activities(channel, self)
153        '''
154         An Activity is a record of an action taken against a strongDM deployment, e.g.
155         a user creation, resource deletion, sso configuration change, etc. The Activities
156         service is read-only.
157
158        See `strongdm.svc.Activities`.
159        '''
160        self.approval_workflow_approvers = svc.ApprovalWorkflowApprovers(
161            channel, self)
162        '''
163         ApprovalWorkflowApprovers link approval workflow approvers to an ApprovalWorkflowStep
164
165        See `strongdm.svc.ApprovalWorkflowApprovers`.
166        '''
167        self.approval_workflow_approvers_history = svc.ApprovalWorkflowApproversHistory(
168            channel, self)
169        '''
170         ApprovalWorkflowApproversHistory records all changes to the state of an ApprovalWorkflowApprover.
171
172        See `strongdm.svc.ApprovalWorkflowApproversHistory`.
173        '''
174        self.approval_workflow_steps = svc.ApprovalWorkflowSteps(channel, self)
175        '''
176         ApprovalWorkflowSteps link approval workflow steps to an ApprovalWorkflow
177
178        See `strongdm.svc.ApprovalWorkflowSteps`.
179        '''
180        self.approval_workflow_steps_history = svc.ApprovalWorkflowStepsHistory(
181            channel, self)
182        '''
183         ApprovalWorkflowStepsHistory records all changes to the state of an ApprovalWorkflowStep.
184
185        See `strongdm.svc.ApprovalWorkflowStepsHistory`.
186        '''
187        self.approval_workflows = svc.ApprovalWorkflows(channel, self)
188        '''
189         ApprovalWorkflows are the mechanism by which requests for access can be viewed by authorized
190         approvers and be approved or denied.
191
192        See `strongdm.svc.ApprovalWorkflows`.
193        '''
194        self.approval_workflows_history = svc.ApprovalWorkflowsHistory(
195            channel, self)
196        '''
197         ApprovalWorkflowsHistory records all changes to the state of an ApprovalWorkflow.
198
199        See `strongdm.svc.ApprovalWorkflowsHistory`.
200        '''
201        self.control_panel = svc.ControlPanel(channel, self)
202        '''
203         ControlPanel contains all administrative controls.
204
205        See `strongdm.svc.ControlPanel`.
206        '''
207        self.health_checks = svc.HealthChecks(channel, self)
208        '''
209         HealthChecks lists the last healthcheck between each node and resource.
210         Note the unconventional capitalization here is to prevent having a collision with GRPC
211
212        See `strongdm.svc.HealthChecks`.
213        '''
214        self.identity_aliases = svc.IdentityAliases(channel, self)
215        '''
216         IdentityAliases assign an alias to an account within an IdentitySet.
217         The alias is used as the username when connecting to a identity supported resource.
218
219        See `strongdm.svc.IdentityAliases`.
220        '''
221        self.identity_aliases_history = svc.IdentityAliasesHistory(
222            channel, self)
223        '''
224         IdentityAliasesHistory records all changes to the state of a IdentityAlias.
225
226        See `strongdm.svc.IdentityAliasesHistory`.
227        '''
228        self.identity_sets = svc.IdentitySets(channel, self)
229        '''
230         A IdentitySet is a named grouping of Identity Aliases for Accounts.
231         An Account's relationship to a IdentitySet is defined via IdentityAlias objects.
232
233        See `strongdm.svc.IdentitySets`.
234        '''
235        self.identity_sets_history = svc.IdentitySetsHistory(channel, self)
236        '''
237         IdentitySetsHistory records all changes to the state of a IdentitySet.
238
239        See `strongdm.svc.IdentitySetsHistory`.
240        '''
241        self.managed_secrets = svc.ManagedSecrets(channel, self)
242        '''
243         ManagedSecret is a private vertical for creating, reading, updating,
244         deleting, listing and rotating the managed secrets in the secrets engines as
245         an authenticated user.
246
247        See `strongdm.svc.ManagedSecrets`.
248        '''
249        self.nodes = svc.Nodes(channel, self)
250        '''
251         Nodes make up the strongDM network, and allow your users to connect securely to your resources. There are two types of nodes:
252         - **Gateways** are the entry points into network. They listen for connection from the strongDM client, and provide access to databases and servers.
253         - **Relays** are used to extend the strongDM network into segmented subnets. They provide access to databases and servers but do not listen for incoming connections.
254
255        See `strongdm.svc.Nodes`.
256        '''
257        self.nodes_history = svc.NodesHistory(channel, self)
258        '''
259         NodesHistory records all changes to the state of a Node.
260
261        See `strongdm.svc.NodesHistory`.
262        '''
263        self.organization_history = svc.OrganizationHistory(channel, self)
264        '''
265         OrganizationHistory records all changes to the state of an Organization.
266
267        See `strongdm.svc.OrganizationHistory`.
268        '''
269        self.peering_group_nodes = svc.PeeringGroupNodes(channel, self)
270        '''
271         PeeringGroupNodes provides the building blocks necessary to obtain attach a node to a peering group.
272
273        See `strongdm.svc.PeeringGroupNodes`.
274        '''
275        self.peering_group_peers = svc.PeeringGroupPeers(channel, self)
276        '''
277         PeeringGroupPeers provides the building blocks necessary to link two peering groups.
278
279        See `strongdm.svc.PeeringGroupPeers`.
280        '''
281        self.peering_group_resources = svc.PeeringGroupResources(channel, self)
282        '''
283         PeeringGroupResources provides the building blocks necessary to obtain attach a resource to a peering group.
284
285        See `strongdm.svc.PeeringGroupResources`.
286        '''
287        self.peering_groups = svc.PeeringGroups(channel, self)
288        '''
289         PeeringGroups provides the building blocks necessary to obtain explicit network topology and routing.
290
291        See `strongdm.svc.PeeringGroups`.
292        '''
293        self.policies = svc.Policies(channel, self)
294        '''
295         Policies are the collection of one or more statements that enforce fine-grained access
296         control for the users of an organization.
297
298        See `strongdm.svc.Policies`.
299        '''
300        self.policies_history = svc.PoliciesHistory(channel, self)
301        '''
302         PoliciesHistory records all changes to the state of a Policy.
303
304        See `strongdm.svc.PoliciesHistory`.
305        '''
306        self.proxy_cluster_keys = svc.ProxyClusterKeys(channel, self)
307        '''
308         Proxy Cluster Keys are authentication keys for all proxies within a cluster.
309         The proxies within a cluster share the same key. One cluster can have
310         multiple keys in order to facilitate key rotation.
311
312        See `strongdm.svc.ProxyClusterKeys`.
313        '''
314        self.queries = svc.Queries(channel, self)
315        '''
316         A Query is a record of a single client request to a resource, such as a SQL query.
317         Long-running SSH, RDP, or Kubernetes interactive sessions also count as queries.
318         The Queries service is read-only.
319
320        See `strongdm.svc.Queries`.
321        '''
322        self.remote_identities = svc.RemoteIdentities(channel, self)
323        '''
324         RemoteIdentities assign a resource directly to an account, giving the account the permission to connect to that resource.
325
326        See `strongdm.svc.RemoteIdentities`.
327        '''
328        self.remote_identities_history = svc.RemoteIdentitiesHistory(
329            channel, self)
330        '''
331         RemoteIdentitiesHistory records all changes to the state of a RemoteIdentity.
332
333        See `strongdm.svc.RemoteIdentitiesHistory`.
334        '''
335        self.remote_identity_groups = svc.RemoteIdentityGroups(channel, self)
336        '''
337         A RemoteIdentityGroup is a named grouping of Remote Identities for Accounts.
338         An Account's relationship to a RemoteIdentityGroup is defined via RemoteIdentity objects.
339
340        See `strongdm.svc.RemoteIdentityGroups`.
341        '''
342        self.remote_identity_groups_history = svc.RemoteIdentityGroupsHistory(
343            channel, self)
344        '''
345         RemoteIdentityGroupsHistory records all changes to the state of a RemoteIdentityGroup.
346
347        See `strongdm.svc.RemoteIdentityGroupsHistory`.
348        '''
349        self.replays = svc.Replays(channel, self)
350        '''
351         A Replay captures the data transferred over a long-running SSH, RDP, or Kubernetes interactive session
352         (otherwise referred to as a query). The Replays service is read-only.
353
354        See `strongdm.svc.Replays`.
355        '''
356        self.resources = svc.Resources(channel, self)
357        '''
358         Resources are databases, servers, clusters, websites, or clouds that strongDM
359         delegates access to.
360
361        See `strongdm.svc.Resources`.
362        '''
363        self.resources_history = svc.ResourcesHistory(channel, self)
364        '''
365         ResourcesHistory records all changes to the state of a Resource.
366
367        See `strongdm.svc.ResourcesHistory`.
368        '''
369        self.role_resources = svc.RoleResources(channel, self)
370        '''
371         RoleResources enumerates the resources to which roles have access.
372         The RoleResources service is read-only.
373
374        See `strongdm.svc.RoleResources`.
375        '''
376        self.role_resources_history = svc.RoleResourcesHistory(channel, self)
377        '''
378         RoleResourcesHistory records all changes to the state of a RoleResource.
379
380        See `strongdm.svc.RoleResourcesHistory`.
381        '''
382        self.roles = svc.Roles(channel, self)
383        '''
384         A Role has a list of access rules which determine which Resources the members
385         of the Role have access to. An Account can be a member of multiple Roles via
386         AccountAttachments.
387
388        See `strongdm.svc.Roles`.
389        '''
390        self.roles_history = svc.RolesHistory(channel, self)
391        '''
392         RolesHistory records all changes to the state of a Role.
393
394        See `strongdm.svc.RolesHistory`.
395        '''
396        self.secret_stores = svc.SecretStores(channel, self)
397        '''
398         SecretStores are servers where resource secrets (passwords, keys) are stored.
399
400        See `strongdm.svc.SecretStores`.
401        '''
402        self.secret_engines = svc.SecretEngines(channel, self)
403        '''
404
405
406        See `strongdm.svc.SecretEngines`.
407        '''
408        self.secret_store_healths = svc.SecretStoreHealths(channel, self)
409        '''
410         SecretStoreHealths exposes health states for secret stores.
411
412        See `strongdm.svc.SecretStoreHealths`.
413        '''
414        self.secret_stores_history = svc.SecretStoresHistory(channel, self)
415        '''
416         SecretStoresHistory records all changes to the state of a SecretStore.
417
418        See `strongdm.svc.SecretStoresHistory`.
419        '''
420        self.workflow_approvers = svc.WorkflowApprovers(channel, self)
421        '''
422         WorkflowApprovers is an account or a role with the ability to approve requests bound to a workflow.
423
424        See `strongdm.svc.WorkflowApprovers`.
425        '''
426        self.workflow_approvers_history = svc.WorkflowApproversHistory(
427            channel, self)
428        '''
429         WorkflowApproversHistory provides records of all changes to the state of a WorkflowApprover.
430
431        See `strongdm.svc.WorkflowApproversHistory`.
432        '''
433        self.workflow_assignments = svc.WorkflowAssignments(channel, self)
434        '''
435         WorkflowAssignments links a Resource to a Workflow. The assigned resources are those that a user can request
436         access to via the workflow.
437
438        See `strongdm.svc.WorkflowAssignments`.
439        '''
440        self.workflow_assignments_history = svc.WorkflowAssignmentsHistory(
441            channel, self)
442        '''
443         WorkflowAssignmentsHistory provides records of all changes to the state of a WorkflowAssignment.
444
445        See `strongdm.svc.WorkflowAssignmentsHistory`.
446        '''
447        self.workflow_roles = svc.WorkflowRoles(channel, self)
448        '''
449         WorkflowRole links a role to a workflow. The linked roles indicate which roles a user must be a part of
450         to request access to a resource via the workflow.
451
452        See `strongdm.svc.WorkflowRoles`.
453        '''
454        self.workflow_roles_history = svc.WorkflowRolesHistory(channel, self)
455        '''
456         WorkflowRolesHistory provides records of all changes to the state of a WorkflowRole
457
458        See `strongdm.svc.WorkflowRolesHistory`.
459        '''
460        self.workflows = svc.Workflows(channel, self)
461        '''
462         Workflows are the collection of rules that define the resources to which access can be requested,
463         the users that can request that access, and the mechanism for approving those requests which can either
464         be automatic approval or a set of users authorized to approve the requests.
465
466        See `strongdm.svc.Workflows`.
467        '''
468        self.workflows_history = svc.WorkflowsHistory(channel, self)
469        '''
470         WorkflowsHistory provides records of all changes to the state of a Workflow.
471
472        See `strongdm.svc.WorkflowsHistory`.
473        '''
474
475    def close(self):
476        '''Closes this Client and releases all resources held by it.
477
478        Closing the Client will immediately terminate all RPCs active with the
479        Client and it is not valid to invoke new RPCs with the Client.
480
481        This method is idempotent.
482        '''
483        self.channel.close()
484
485    def get_metadata(self, method_name, req):
486        return [
487            ('x-sdm-authentication', self.api_access_key),
488            ('x-sdm-signature', self.sign(method_name,
489                                          req.SerializeToString())),
490            ('x-sdm-api-version', API_VERSION),
491            ('x-sdm-user-agent', USER_AGENT),
492        ]
493
494    def sign(self, method_name, request_bytes):
495        def hmac_digest(key, msg_byte_string):
496            return hmac.new(key, msg=msg_byte_string,
497                            digestmod=hashlib.sha256).digest()
498
499        current_utc_date = datetime.datetime.now(
500            datetime.timezone.utc).strftime('%Y-%m-%d')
501        signing_key = hmac_digest(self.api_secret, current_utc_date.encode())
502        signing_key = hmac_digest(signing_key, b'sdm_api_v1')
503
504        hash = hashlib.sha256()
505
506        hash.update(method_name.encode())
507        hash.update(b'\n')
508        hash.update(request_bytes)
509
510        return base64.b64encode(hmac_digest(signing_key, hash.digest()))
511
512    def jitterSleep(self, iter):
513        dur_max = self.base_retry_delay * 2**iter
514        if (dur_max > self.max_retry_delay):
515            dur_max = self.max_retry_delay
516        # get a value between 0 and max
517        dur = random.random() * dur_max
518        time.sleep(dur)
519
520    def shouldRetry(self, iter, err):
521        if (iter >= self.max_retries - 1):
522            return False
523        if not isinstance(err, grpc.RpcError):
524            return True
525        porcelain_err = plumbing.convert_error_to_porcelain(err)
526        if (not self.expose_rate_limit_errors) and isinstance(
527                porcelain_err, errors.RateLimitError):
528            wait_until = porcelain_err.rate_limit.reset_at
529            now = datetime.datetime.now(datetime.timezone.utc)
530            sleep_for = (wait_until - now).total_seconds()
531            # If timezones or clock drift causes this calculation to fail,
532            # wait at most one minute.
533            if sleep_for < 0 or sleep_for > 60:
534                sleep_for = 60
535            time.sleep(sleep_for)
536            return True
537        return err.code() == grpc.StatusCode.INTERNAL or err.code(
538        ) == grpc.StatusCode.UNAVAILABLE
539
540    def snapshot_at(self, snapshot_datetime):
541        '''
542        Constructs a read-only client that will provide historical data from the provided timestamp.
543
544        See `SnapshotClient`.
545        '''
546        client = copy.copy(self)
547        client.snapshot_datetime = snapshot_datetime
548        client.access_requests = svc.AccessRequests(client.channel, client)
549        client.account_attachments = svc.AccountAttachments(
550            client.channel, client)
551        client.account_grants = svc.AccountGrants(client.channel, client)
552        client.account_permissions = svc.AccountPermissions(
553            client.channel, client)
554        client.account_resources = svc.AccountResources(client.channel, client)
555        client.accounts = svc.Accounts(client.channel, client)
556        client.approval_workflow_approvers = svc.ApprovalWorkflowApprovers(
557            client.channel, client)
558        client.approval_workflow_steps = svc.ApprovalWorkflowSteps(
559            client.channel, client)
560        client.approval_workflows = svc.ApprovalWorkflows(
561            client.channel, client)
562        client.identity_aliases = svc.IdentityAliases(client.channel, client)
563        client.identity_sets = svc.IdentitySets(client.channel, client)
564        client.nodes = svc.Nodes(client.channel, client)
565        client.policies = svc.Policies(client.channel, client)
566        client.proxy_cluster_keys = svc.ProxyClusterKeys(
567            client.channel, client)
568        client.remote_identities = svc.RemoteIdentities(client.channel, client)
569        client.remote_identity_groups = svc.RemoteIdentityGroups(
570            client.channel, client)
571        client.resources = svc.Resources(client.channel, client)
572        client.role_resources = svc.RoleResources(client.channel, client)
573        client.roles = svc.Roles(client.channel, client)
574        client.secret_stores = svc.SecretStores(client.channel, client)
575        client.workflow_approvers = svc.WorkflowApprovers(
576            client.channel, client)
577        client.workflow_assignments = svc.WorkflowAssignments(
578            client.channel, client)
579        client.workflow_roles = svc.WorkflowRoles(client.channel, client)
580        client.workflows = svc.Workflows(client.channel, client)
581        return SnapshotClient(client)
582
583
584class SnapshotClient:
585    '''SnapshotClient exposes methods to query historical records at a provided timestamp.'''
586    def __init__(self, client):
587        self.access_requests = svc.SnapshotAccessRequests(
588            client.access_requests)
589        '''
590         AccessRequests are requests for access to a resource that may match a Workflow.
591
592        See `strongdm.svc.SnapshotAccessRequests`.
593        '''
594        self.account_attachments = svc.SnapshotAccountAttachments(
595            client.account_attachments)
596        '''
597         AccountAttachments assign an account to a role.
598
599        See `strongdm.svc.SnapshotAccountAttachments`.
600        '''
601        self.account_grants = svc.SnapshotAccountGrants(client.account_grants)
602        '''
603         AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
604
605        See `strongdm.svc.SnapshotAccountGrants`.
606        '''
607        self.account_permissions = svc.SnapshotAccountPermissions(
608            client.account_permissions)
609        '''
610         AccountPermissions records the granular permissions accounts have, allowing them to execute
611         relevant commands via StrongDM's APIs.
612
613        See `strongdm.svc.SnapshotAccountPermissions`.
614        '''
615        self.account_resources = svc.SnapshotAccountResources(
616            client.account_resources)
617        '''
618         AccountResources enumerates the resources to which accounts have access.
619         The AccountResources service is read-only.
620
621        See `strongdm.svc.SnapshotAccountResources`.
622        '''
623        self.accounts = svc.SnapshotAccounts(client.accounts)
624        '''
625         Accounts are users that have access to strongDM. There are two types of accounts:
626         1. **Users:** humans who are authenticated through username and password or SSO.
627         2. **Service Accounts:** machines that are authenticated using a service token.
628         3. **Tokens** are access keys with permissions that can be used for authentication.
629
630        See `strongdm.svc.SnapshotAccounts`.
631        '''
632        self.approval_workflow_approvers = svc.SnapshotApprovalWorkflowApprovers(
633            client.approval_workflow_approvers)
634        '''
635         ApprovalWorkflowApprovers link approval workflow approvers to an ApprovalWorkflowStep
636
637        See `strongdm.svc.SnapshotApprovalWorkflowApprovers`.
638        '''
639        self.approval_workflow_steps = svc.SnapshotApprovalWorkflowSteps(
640            client.approval_workflow_steps)
641        '''
642         ApprovalWorkflowSteps link approval workflow steps to an ApprovalWorkflow
643
644        See `strongdm.svc.SnapshotApprovalWorkflowSteps`.
645        '''
646        self.approval_workflows = svc.SnapshotApprovalWorkflows(
647            client.approval_workflows)
648        '''
649         ApprovalWorkflows are the mechanism by which requests for access can be viewed by authorized
650         approvers and be approved or denied.
651
652        See `strongdm.svc.SnapshotApprovalWorkflows`.
653        '''
654        self.identity_aliases = svc.SnapshotIdentityAliases(
655            client.identity_aliases)
656        '''
657         IdentityAliases assign an alias to an account within an IdentitySet.
658         The alias is used as the username when connecting to a identity supported resource.
659
660        See `strongdm.svc.SnapshotIdentityAliases`.
661        '''
662        self.identity_sets = svc.SnapshotIdentitySets(client.identity_sets)
663        '''
664         A IdentitySet is a named grouping of Identity Aliases for Accounts.
665         An Account's relationship to a IdentitySet is defined via IdentityAlias objects.
666
667        See `strongdm.svc.SnapshotIdentitySets`.
668        '''
669        self.nodes = svc.SnapshotNodes(client.nodes)
670        '''
671         Nodes make up the strongDM network, and allow your users to connect securely to your resources. There are two types of nodes:
672         - **Gateways** are the entry points into network. They listen for connection from the strongDM client, and provide access to databases and servers.
673         - **Relays** are used to extend the strongDM network into segmented subnets. They provide access to databases and servers but do not listen for incoming connections.
674
675        See `strongdm.svc.SnapshotNodes`.
676        '''
677        self.policies = svc.SnapshotPolicies(client.policies)
678        '''
679         Policies are the collection of one or more statements that enforce fine-grained access
680         control for the users of an organization.
681
682        See `strongdm.svc.SnapshotPolicies`.
683        '''
684        self.proxy_cluster_keys = svc.SnapshotProxyClusterKeys(
685            client.proxy_cluster_keys)
686        '''
687         Proxy Cluster Keys are authentication keys for all proxies within a cluster.
688         The proxies within a cluster share the same key. One cluster can have
689         multiple keys in order to facilitate key rotation.
690
691        See `strongdm.svc.SnapshotProxyClusterKeys`.
692        '''
693        self.remote_identities = svc.SnapshotRemoteIdentities(
694            client.remote_identities)
695        '''
696         RemoteIdentities assign a resource directly to an account, giving the account the permission to connect to that resource.
697
698        See `strongdm.svc.SnapshotRemoteIdentities`.
699        '''
700        self.remote_identity_groups = svc.SnapshotRemoteIdentityGroups(
701            client.remote_identity_groups)
702        '''
703         A RemoteIdentityGroup is a named grouping of Remote Identities for Accounts.
704         An Account's relationship to a RemoteIdentityGroup is defined via RemoteIdentity objects.
705
706        See `strongdm.svc.SnapshotRemoteIdentityGroups`.
707        '''
708        self.resources = svc.SnapshotResources(client.resources)
709        '''
710         Resources are databases, servers, clusters, websites, or clouds that strongDM
711         delegates access to.
712
713        See `strongdm.svc.SnapshotResources`.
714        '''
715        self.role_resources = svc.SnapshotRoleResources(client.role_resources)
716        '''
717         RoleResources enumerates the resources to which roles have access.
718         The RoleResources service is read-only.
719
720        See `strongdm.svc.SnapshotRoleResources`.
721        '''
722        self.roles = svc.SnapshotRoles(client.roles)
723        '''
724         A Role has a list of access rules which determine which Resources the members
725         of the Role have access to. An Account can be a member of multiple Roles via
726         AccountAttachments.
727
728        See `strongdm.svc.SnapshotRoles`.
729        '''
730        self.secret_stores = svc.SnapshotSecretStores(client.secret_stores)
731        '''
732         SecretStores are servers where resource secrets (passwords, keys) are stored.
733
734        See `strongdm.svc.SnapshotSecretStores`.
735        '''
736        self.workflow_approvers = svc.SnapshotWorkflowApprovers(
737            client.workflow_approvers)
738        '''
739         WorkflowApprovers is an account or a role with the ability to approve requests bound to a workflow.
740
741        See `strongdm.svc.SnapshotWorkflowApprovers`.
742        '''
743        self.workflow_assignments = svc.SnapshotWorkflowAssignments(
744            client.workflow_assignments)
745        '''
746         WorkflowAssignments links a Resource to a Workflow. The assigned resources are those that a user can request
747         access to via the workflow.
748
749        See `strongdm.svc.SnapshotWorkflowAssignments`.
750        '''
751        self.workflow_roles = svc.SnapshotWorkflowRoles(client.workflow_roles)
752        '''
753         WorkflowRole links a role to a workflow. The linked roles indicate which roles a user must be a part of
754         to request access to a resource via the workflow.
755
756        See `strongdm.svc.SnapshotWorkflowRoles`.
757        '''
758        self.workflows = svc.SnapshotWorkflows(client.workflows)
759        '''
760         Workflows are the collection of rules that define the resources to which access can be requested,
761         the users that can request that access, and the mechanism for approving those requests which can either
762         be automatic approval or a set of users authorized to approve the requests.
763
764        See `strongdm.svc.SnapshotWorkflows`.
765        '''