strongdm.client

  1# Copyright 2020 StrongDM Inc
  2#
  3# Licensed under the Apache License, Version 2.0 (the "License");
  4# you may not use this file except in compliance with the License.
  5# You may obtain a copy of the License at
  6#
  7#     http://www.apache.org/licenses/LICENSE-2.0
  8#
  9# Unless required by applicable law or agreed to in writing, software
 10# distributed under the License is distributed on an "AS IS" BASIS,
 11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 12# See the License for the specific language governing permissions and
 13# limitations under the License.
 14#
 15
 16# Code generated by protogen. DO NOT EDIT.
 17
 18import base64
 19import copy
 20import datetime
 21import grpc
 22import hashlib
 23import hmac
 24import random
 25import time
 26from . import errors
 27from . import plumbing
 28from . import svc
 29
 30# These defaults are taken from AWS. Customization of these values
 31# is a future step in the API.
 32DEFAULT_MAX_RETRIES = 3
 33DEFAULT_BASE_RETRY_DELAY = 0.0030  # 30 ms
 34DEFAULT_MAX_RETRY_DELAY = 300  # 300 seconds
 35API_VERSION = '2024-03-28'
 36USER_AGENT = 'strongdm-sdk-python/11.20.0'
 37
 38
 39class Client:
 40    '''Client interacts with the strongDM API.'''
 41    def __init__(self,
 42                 api_access_key,
 43                 api_secret,
 44                 host='api.strongdm.com:443',
 45                 insecure=False,
 46                 retry_rate_limit_errors=True,
 47                 page_limit=50):
 48        '''
 49        Create a new Client.
 50
 51        - api_access_key: the access key to authenticate with strongDM
 52        - api_secret: the secret key to authenticate with strongDM
 53        '''
 54        self.api_access_key = api_access_key.strip()
 55        self.api_secret = base64.b64decode(api_secret.strip())
 56        self.max_retries = DEFAULT_MAX_RETRIES
 57        self.base_retry_delay = DEFAULT_BASE_RETRY_DELAY
 58        self.max_retry_delay = DEFAULT_MAX_RETRY_DELAY
 59        self.expose_rate_limit_errors = (not retry_rate_limit_errors)
 60        self.snapshot_datetime = None
 61        self.page_limit = page_limit
 62
 63        try:
 64            if insecure:
 65                channel = grpc.insecure_channel(host)
 66            else:
 67                creds = grpc.ssl_channel_credentials()
 68                channel = grpc.secure_channel(host, creds)
 69        except Exception as e:
 70            raise plumbing.convert_error_to_porcelain(e) from e
 71        self.channel = channel
 72        self.access_requests = svc.AccessRequests(channel, self)
 73        '''
 74         AccessRequests are requests for access to a resource that may match a Workflow.
 75
 76        See `strongdm.svc.AccessRequests`.
 77        '''
 78        self.access_request_events_history = svc.AccessRequestEventsHistory(
 79            channel, self)
 80        '''
 81         AccessRequestEventsHistory provides records of all changes to the state of an AccessRequest.
 82
 83        See `strongdm.svc.AccessRequestEventsHistory`.
 84        '''
 85        self.access_requests_history = svc.AccessRequestsHistory(channel, self)
 86        '''
 87         AccessRequestsHistory provides records of all changes to the state of an AccessRequest.
 88
 89        See `strongdm.svc.AccessRequestsHistory`.
 90        '''
 91        self.account_attachments = svc.AccountAttachments(channel, self)
 92        '''
 93         AccountAttachments assign an account to a role.
 94
 95        See `strongdm.svc.AccountAttachments`.
 96        '''
 97        self.account_attachments_history = svc.AccountAttachmentsHistory(
 98            channel, self)
 99        '''
100         AccountAttachmentsHistory records all changes to the state of an AccountAttachment.
101
102        See `strongdm.svc.AccountAttachmentsHistory`.
103        '''
104        self.account_grants = svc.AccountGrants(channel, self)
105        '''
106         AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
107
108        See `strongdm.svc.AccountGrants`.
109        '''
110        self.account_grants_history = svc.AccountGrantsHistory(channel, self)
111        '''
112         AccountGrantsHistory records all changes to the state of an AccountGrant.
113
114        See `strongdm.svc.AccountGrantsHistory`.
115        '''
116        self.account_permissions = svc.AccountPermissions(channel, self)
117        '''
118         AccountPermissions records the granular permissions accounts have, allowing them to execute
119         relevant commands via StrongDM's APIs.
120
121        See `strongdm.svc.AccountPermissions`.
122        '''
123        self.account_resources = svc.AccountResources(channel, self)
124        '''
125         AccountResources enumerates the resources to which accounts have access.
126         The AccountResources service is read-only.
127
128        See `strongdm.svc.AccountResources`.
129        '''
130        self.account_resources_history = svc.AccountResourcesHistory(
131            channel, self)
132        '''
133         AccountResourcesHistory records all changes to the state of a AccountResource.
134
135        See `strongdm.svc.AccountResourcesHistory`.
136        '''
137        self.accounts = svc.Accounts(channel, self)
138        '''
139         Accounts are users that have access to strongDM. There are two types of accounts:
140         1. **Users:** humans who are authenticated through username and password or SSO.
141         2. **Service Accounts:** machines that are authenticated using a service token.
142         3. **Tokens** are access keys with permissions that can be used for authentication.
143
144        See `strongdm.svc.Accounts`.
145        '''
146        self.accounts_history = svc.AccountsHistory(channel, self)
147        '''
148         AccountsHistory records all changes to the state of an Account.
149
150        See `strongdm.svc.AccountsHistory`.
151        '''
152        self.activities = svc.Activities(channel, self)
153        '''
154         An Activity is a record of an action taken against a strongDM deployment, e.g.
155         a user creation, resource deletion, sso configuration change, etc. The Activities
156         service is read-only.
157
158        See `strongdm.svc.Activities`.
159        '''
160        self.approval_workflow_approvers = svc.ApprovalWorkflowApprovers(
161            channel, self)
162        '''
163         ApprovalWorkflowApprovers link approval workflow approvers to an ApprovalWorkflowStep
164
165        See `strongdm.svc.ApprovalWorkflowApprovers`.
166        '''
167        self.approval_workflow_approvers_history = svc.ApprovalWorkflowApproversHistory(
168            channel, self)
169        '''
170         ApprovalWorkflowApproversHistory records all changes to the state of an ApprovalWorkflowApprover.
171
172        See `strongdm.svc.ApprovalWorkflowApproversHistory`.
173        '''
174        self.approval_workflow_steps = svc.ApprovalWorkflowSteps(channel, self)
175        '''
176         ApprovalWorkflowSteps link approval workflow steps to an ApprovalWorkflow
177
178        See `strongdm.svc.ApprovalWorkflowSteps`.
179        '''
180        self.approval_workflow_steps_history = svc.ApprovalWorkflowStepsHistory(
181            channel, self)
182        '''
183         ApprovalWorkflowStepsHistory records all changes to the state of an ApprovalWorkflowStep.
184
185        See `strongdm.svc.ApprovalWorkflowStepsHistory`.
186        '''
187        self.approval_workflows = svc.ApprovalWorkflows(channel, self)
188        '''
189         ApprovalWorkflows are the mechanism by which requests for access can be viewed by authorized
190         approvers and be approved or denied.
191
192        See `strongdm.svc.ApprovalWorkflows`.
193        '''
194        self.approval_workflows_history = svc.ApprovalWorkflowsHistory(
195            channel, self)
196        '''
197         ApprovalWorkflowsHistory records all changes to the state of an ApprovalWorkflow.
198
199        See `strongdm.svc.ApprovalWorkflowsHistory`.
200        '''
201        self.control_panel = svc.ControlPanel(channel, self)
202        '''
203         ControlPanel contains all administrative controls.
204
205        See `strongdm.svc.ControlPanel`.
206        '''
207        self.health_checks = svc.HealthChecks(channel, self)
208        '''
209         HealthChecks lists the last healthcheck between each node and resource.
210         Note the unconventional capitalization here is to prevent having a collision with GRPC
211
212        See `strongdm.svc.HealthChecks`.
213        '''
214        self.identity_aliases = svc.IdentityAliases(channel, self)
215        '''
216         IdentityAliases assign an alias to an account within an IdentitySet.
217         The alias is used as the username when connecting to a identity supported resource.
218
219        See `strongdm.svc.IdentityAliases`.
220        '''
221        self.identity_aliases_history = svc.IdentityAliasesHistory(
222            channel, self)
223        '''
224         IdentityAliasesHistory records all changes to the state of a IdentityAlias.
225
226        See `strongdm.svc.IdentityAliasesHistory`.
227        '''
228        self.identity_sets = svc.IdentitySets(channel, self)
229        '''
230         A IdentitySet is a named grouping of Identity Aliases for Accounts.
231         An Account's relationship to a IdentitySet is defined via IdentityAlias objects.
232
233        See `strongdm.svc.IdentitySets`.
234        '''
235        self.identity_sets_history = svc.IdentitySetsHistory(channel, self)
236        '''
237         IdentitySetsHistory records all changes to the state of a IdentitySet.
238
239        See `strongdm.svc.IdentitySetsHistory`.
240        '''
241        self.nodes = svc.Nodes(channel, self)
242        '''
243         Nodes make up the strongDM network, and allow your users to connect securely to your resources. There are two types of nodes:
244         - **Gateways** are the entry points into network. They listen for connection from the strongDM client, and provide access to databases and servers.
245         - **Relays** are used to extend the strongDM network into segmented subnets. They provide access to databases and servers but do not listen for incoming connections.
246
247        See `strongdm.svc.Nodes`.
248        '''
249        self.nodes_history = svc.NodesHistory(channel, self)
250        '''
251         NodesHistory records all changes to the state of a Node.
252
253        See `strongdm.svc.NodesHistory`.
254        '''
255        self.organization_history = svc.OrganizationHistory(channel, self)
256        '''
257         OrganizationHistory records all changes to the state of an Organization.
258
259        See `strongdm.svc.OrganizationHistory`.
260        '''
261        self.peering_group_nodes = svc.PeeringGroupNodes(channel, self)
262        '''
263         PeeringGroupNodes provides the building blocks necessary to obtain attach a node to a peering group.
264
265        See `strongdm.svc.PeeringGroupNodes`.
266        '''
267        self.peering_group_peers = svc.PeeringGroupPeers(channel, self)
268        '''
269         PeeringGroupPeers provides the building blocks necessary to link two peering groups.
270
271        See `strongdm.svc.PeeringGroupPeers`.
272        '''
273        self.peering_group_resources = svc.PeeringGroupResources(channel, self)
274        '''
275         PeeringGroupResources provides the building blocks necessary to obtain attach a resource to a peering group.
276
277        See `strongdm.svc.PeeringGroupResources`.
278        '''
279        self.peering_groups = svc.PeeringGroups(channel, self)
280        '''
281         PeeringGroups provides the building blocks necessary to obtain explicit network topology and routing.
282
283        See `strongdm.svc.PeeringGroups`.
284        '''
285        self.policies = svc.Policies(channel, self)
286        '''
287         Policies are the collection of one or more statements that enforce fine-grained access
288         control for the users of an organization.
289
290        See `strongdm.svc.Policies`.
291        '''
292        self.policies_history = svc.PoliciesHistory(channel, self)
293        '''
294         PoliciesHistory records all changes to the state of a Policy.
295
296        See `strongdm.svc.PoliciesHistory`.
297        '''
298        self.proxy_cluster_keys = svc.ProxyClusterKeys(channel, self)
299        '''
300         Proxy Cluster Keys are authentication keys for all proxies within a cluster.
301         The proxies within a cluster share the same key. One cluster can have
302         multiple keys in order to facilitate key rotation.
303
304        See `strongdm.svc.ProxyClusterKeys`.
305        '''
306        self.queries = svc.Queries(channel, self)
307        '''
308         A Query is a record of a single client request to a resource, such as a SQL query.
309         Long-running SSH, RDP, or Kubernetes interactive sessions also count as queries.
310         The Queries service is read-only.
311
312        See `strongdm.svc.Queries`.
313        '''
314        self.remote_identities = svc.RemoteIdentities(channel, self)
315        '''
316         RemoteIdentities assign a resource directly to an account, giving the account the permission to connect to that resource.
317
318        See `strongdm.svc.RemoteIdentities`.
319        '''
320        self.remote_identities_history = svc.RemoteIdentitiesHistory(
321            channel, self)
322        '''
323         RemoteIdentitiesHistory records all changes to the state of a RemoteIdentity.
324
325        See `strongdm.svc.RemoteIdentitiesHistory`.
326        '''
327        self.remote_identity_groups = svc.RemoteIdentityGroups(channel, self)
328        '''
329         A RemoteIdentityGroup is a named grouping of Remote Identities for Accounts.
330         An Account's relationship to a RemoteIdentityGroup is defined via RemoteIdentity objects.
331
332        See `strongdm.svc.RemoteIdentityGroups`.
333        '''
334        self.remote_identity_groups_history = svc.RemoteIdentityGroupsHistory(
335            channel, self)
336        '''
337         RemoteIdentityGroupsHistory records all changes to the state of a RemoteIdentityGroup.
338
339        See `strongdm.svc.RemoteIdentityGroupsHistory`.
340        '''
341        self.replays = svc.Replays(channel, self)
342        '''
343         A Replay captures the data transferred over a long-running SSH, RDP, or Kubernetes interactive session
344         (otherwise referred to as a query). The Replays service is read-only.
345
346        See `strongdm.svc.Replays`.
347        '''
348        self.resources = svc.Resources(channel, self)
349        '''
350         Resources are databases, servers, clusters, websites, or clouds that strongDM
351         delegates access to.
352
353        See `strongdm.svc.Resources`.
354        '''
355        self.resources_history = svc.ResourcesHistory(channel, self)
356        '''
357         ResourcesHistory records all changes to the state of a Resource.
358
359        See `strongdm.svc.ResourcesHistory`.
360        '''
361        self.role_resources = svc.RoleResources(channel, self)
362        '''
363         RoleResources enumerates the resources to which roles have access.
364         The RoleResources service is read-only.
365
366        See `strongdm.svc.RoleResources`.
367        '''
368        self.role_resources_history = svc.RoleResourcesHistory(channel, self)
369        '''
370         RoleResourcesHistory records all changes to the state of a RoleResource.
371
372        See `strongdm.svc.RoleResourcesHistory`.
373        '''
374        self.roles = svc.Roles(channel, self)
375        '''
376         A Role has a list of access rules which determine which Resources the members
377         of the Role have access to. An Account can be a member of multiple Roles via
378         AccountAttachments.
379
380        See `strongdm.svc.Roles`.
381        '''
382        self.roles_history = svc.RolesHistory(channel, self)
383        '''
384         RolesHistory records all changes to the state of a Role.
385
386        See `strongdm.svc.RolesHistory`.
387        '''
388        self.secret_stores = svc.SecretStores(channel, self)
389        '''
390         SecretStores are servers where resource secrets (passwords, keys) are stored.
391
392        See `strongdm.svc.SecretStores`.
393        '''
394        self.secret_store_healths = svc.SecretStoreHealths(channel, self)
395        '''
396         SecretStoreHealths exposes health states for secret stores.
397
398        See `strongdm.svc.SecretStoreHealths`.
399        '''
400        self.secret_stores_history = svc.SecretStoresHistory(channel, self)
401        '''
402         SecretStoresHistory records all changes to the state of a SecretStore.
403
404        See `strongdm.svc.SecretStoresHistory`.
405        '''
406        self.workflow_approvers = svc.WorkflowApprovers(channel, self)
407        '''
408         WorkflowApprovers is an account or a role with the ability to approve requests bound to a workflow.
409
410        See `strongdm.svc.WorkflowApprovers`.
411        '''
412        self.workflow_approvers_history = svc.WorkflowApproversHistory(
413            channel, self)
414        '''
415         WorkflowApproversHistory provides records of all changes to the state of a WorkflowApprover.
416
417        See `strongdm.svc.WorkflowApproversHistory`.
418        '''
419        self.workflow_assignments = svc.WorkflowAssignments(channel, self)
420        '''
421         WorkflowAssignments links a Resource to a Workflow. The assigned resources are those that a user can request
422         access to via the workflow.
423
424        See `strongdm.svc.WorkflowAssignments`.
425        '''
426        self.workflow_assignments_history = svc.WorkflowAssignmentsHistory(
427            channel, self)
428        '''
429         WorkflowAssignmentsHistory provides records of all changes to the state of a WorkflowAssignment.
430
431        See `strongdm.svc.WorkflowAssignmentsHistory`.
432        '''
433        self.workflow_roles = svc.WorkflowRoles(channel, self)
434        '''
435         WorkflowRole links a role to a workflow. The linked roles indicate which roles a user must be a part of
436         to request access to a resource via the workflow.
437
438        See `strongdm.svc.WorkflowRoles`.
439        '''
440        self.workflow_roles_history = svc.WorkflowRolesHistory(channel, self)
441        '''
442         WorkflowRolesHistory provides records of all changes to the state of a WorkflowRole
443
444        See `strongdm.svc.WorkflowRolesHistory`.
445        '''
446        self.workflows = svc.Workflows(channel, self)
447        '''
448         Workflows are the collection of rules that define the resources to which access can be requested,
449         the users that can request that access, and the mechanism for approving those requests which can either
450         be automatic approval or a set of users authorized to approve the requests.
451
452        See `strongdm.svc.Workflows`.
453        '''
454        self.workflows_history = svc.WorkflowsHistory(channel, self)
455        '''
456         WorkflowsHistory provides records of all changes to the state of a Workflow.
457
458        See `strongdm.svc.WorkflowsHistory`.
459        '''
460
461    def close(self):
462        '''Closes this Client and releases all resources held by it.
463
464        Closing the Client will immediately terminate all RPCs active with the
465        Client and it is not valid to invoke new RPCs with the Client.
466
467        This method is idempotent.
468        '''
469        self.channel.close()
470
471    def get_metadata(self, method_name, req):
472        return [
473            ('x-sdm-authentication', self.api_access_key),
474            ('x-sdm-signature', self.sign(method_name,
475                                          req.SerializeToString())),
476            ('x-sdm-api-version', API_VERSION),
477            ('x-sdm-user-agent', USER_AGENT),
478        ]
479
480    def sign(self, method_name, request_bytes):
481        def hmac_digest(key, msg_byte_string):
482            return hmac.new(key, msg=msg_byte_string,
483                            digestmod=hashlib.sha256).digest()
484
485        current_utc_date = datetime.datetime.now(
486            datetime.timezone.utc).strftime('%Y-%m-%d')
487        signing_key = hmac_digest(self.api_secret, current_utc_date.encode())
488        signing_key = hmac_digest(signing_key, b'sdm_api_v1')
489
490        hash = hashlib.sha256()
491
492        hash.update(method_name.encode())
493        hash.update(b'\n')
494        hash.update(request_bytes)
495
496        return base64.b64encode(hmac_digest(signing_key, hash.digest()))
497
498    def jitterSleep(self, iter):
499        dur_max = self.base_retry_delay * 2**iter
500        if (dur_max > self.max_retry_delay):
501            dur_max = self.max_retry_delay
502        # get a value between 0 and max
503        dur = random.random() * dur_max
504        time.sleep(dur)
505
506    def shouldRetry(self, iter, err):
507        if (iter >= self.max_retries - 1):
508            return False
509        if not isinstance(err, grpc.RpcError):
510            return True
511        porcelain_err = plumbing.convert_error_to_porcelain(err)
512        if (not self.expose_rate_limit_errors) and isinstance(
513                porcelain_err, errors.RateLimitError):
514            wait_until = porcelain_err.rate_limit.reset_at
515            now = datetime.datetime.now(datetime.timezone.utc)
516            sleep_for = (wait_until - now).total_seconds()
517            # If timezones or clock drift causes this calculation to fail,
518            # wait at most one minute.
519            if sleep_for < 0 or sleep_for > 60:
520                sleep_for = 60
521            time.sleep(sleep_for)
522            return True
523        return err.code() == grpc.StatusCode.INTERNAL or err.code(
524        ) == grpc.StatusCode.UNAVAILABLE
525
526    def snapshot_at(self, snapshot_datetime):
527        '''
528        Constructs a read-only client that will provide historical data from the provided timestamp.
529
530        See `SnapshotClient`.
531        '''
532        client = copy.copy(self)
533        client.snapshot_datetime = snapshot_datetime
534        client.access_requests = svc.AccessRequests(client.channel, client)
535        client.account_attachments = svc.AccountAttachments(
536            client.channel, client)
537        client.account_grants = svc.AccountGrants(client.channel, client)
538        client.account_permissions = svc.AccountPermissions(
539            client.channel, client)
540        client.account_resources = svc.AccountResources(client.channel, client)
541        client.accounts = svc.Accounts(client.channel, client)
542        client.approval_workflow_approvers = svc.ApprovalWorkflowApprovers(
543            client.channel, client)
544        client.approval_workflow_steps = svc.ApprovalWorkflowSteps(
545            client.channel, client)
546        client.approval_workflows = svc.ApprovalWorkflows(
547            client.channel, client)
548        client.identity_aliases = svc.IdentityAliases(client.channel, client)
549        client.identity_sets = svc.IdentitySets(client.channel, client)
550        client.nodes = svc.Nodes(client.channel, client)
551        client.policies = svc.Policies(client.channel, client)
552        client.proxy_cluster_keys = svc.ProxyClusterKeys(
553            client.channel, client)
554        client.remote_identities = svc.RemoteIdentities(client.channel, client)
555        client.remote_identity_groups = svc.RemoteIdentityGroups(
556            client.channel, client)
557        client.resources = svc.Resources(client.channel, client)
558        client.role_resources = svc.RoleResources(client.channel, client)
559        client.roles = svc.Roles(client.channel, client)
560        client.secret_stores = svc.SecretStores(client.channel, client)
561        client.workflow_approvers = svc.WorkflowApprovers(
562            client.channel, client)
563        client.workflow_assignments = svc.WorkflowAssignments(
564            client.channel, client)
565        client.workflow_roles = svc.WorkflowRoles(client.channel, client)
566        client.workflows = svc.Workflows(client.channel, client)
567        return SnapshotClient(client)
568
569
570class SnapshotClient:
571    '''SnapshotClient exposes methods to query historical records at a provided timestamp.'''
572    def __init__(self, client):
573        self.access_requests = svc.SnapshotAccessRequests(
574            client.access_requests)
575        '''
576         AccessRequests are requests for access to a resource that may match a Workflow.
577
578        See `strongdm.svc.SnapshotAccessRequests`.
579        '''
580        self.account_attachments = svc.SnapshotAccountAttachments(
581            client.account_attachments)
582        '''
583         AccountAttachments assign an account to a role.
584
585        See `strongdm.svc.SnapshotAccountAttachments`.
586        '''
587        self.account_grants = svc.SnapshotAccountGrants(client.account_grants)
588        '''
589         AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
590
591        See `strongdm.svc.SnapshotAccountGrants`.
592        '''
593        self.account_permissions = svc.SnapshotAccountPermissions(
594            client.account_permissions)
595        '''
596         AccountPermissions records the granular permissions accounts have, allowing them to execute
597         relevant commands via StrongDM's APIs.
598
599        See `strongdm.svc.SnapshotAccountPermissions`.
600        '''
601        self.account_resources = svc.SnapshotAccountResources(
602            client.account_resources)
603        '''
604         AccountResources enumerates the resources to which accounts have access.
605         The AccountResources service is read-only.
606
607        See `strongdm.svc.SnapshotAccountResources`.
608        '''
609        self.accounts = svc.SnapshotAccounts(client.accounts)
610        '''
611         Accounts are users that have access to strongDM. There are two types of accounts:
612         1. **Users:** humans who are authenticated through username and password or SSO.
613         2. **Service Accounts:** machines that are authenticated using a service token.
614         3. **Tokens** are access keys with permissions that can be used for authentication.
615
616        See `strongdm.svc.SnapshotAccounts`.
617        '''
618        self.approval_workflow_approvers = svc.SnapshotApprovalWorkflowApprovers(
619            client.approval_workflow_approvers)
620        '''
621         ApprovalWorkflowApprovers link approval workflow approvers to an ApprovalWorkflowStep
622
623        See `strongdm.svc.SnapshotApprovalWorkflowApprovers`.
624        '''
625        self.approval_workflow_steps = svc.SnapshotApprovalWorkflowSteps(
626            client.approval_workflow_steps)
627        '''
628         ApprovalWorkflowSteps link approval workflow steps to an ApprovalWorkflow
629
630        See `strongdm.svc.SnapshotApprovalWorkflowSteps`.
631        '''
632        self.approval_workflows = svc.SnapshotApprovalWorkflows(
633            client.approval_workflows)
634        '''
635         ApprovalWorkflows are the mechanism by which requests for access can be viewed by authorized
636         approvers and be approved or denied.
637
638        See `strongdm.svc.SnapshotApprovalWorkflows`.
639        '''
640        self.identity_aliases = svc.SnapshotIdentityAliases(
641            client.identity_aliases)
642        '''
643         IdentityAliases assign an alias to an account within an IdentitySet.
644         The alias is used as the username when connecting to a identity supported resource.
645
646        See `strongdm.svc.SnapshotIdentityAliases`.
647        '''
648        self.identity_sets = svc.SnapshotIdentitySets(client.identity_sets)
649        '''
650         A IdentitySet is a named grouping of Identity Aliases for Accounts.
651         An Account's relationship to a IdentitySet is defined via IdentityAlias objects.
652
653        See `strongdm.svc.SnapshotIdentitySets`.
654        '''
655        self.nodes = svc.SnapshotNodes(client.nodes)
656        '''
657         Nodes make up the strongDM network, and allow your users to connect securely to your resources. There are two types of nodes:
658         - **Gateways** are the entry points into network. They listen for connection from the strongDM client, and provide access to databases and servers.
659         - **Relays** are used to extend the strongDM network into segmented subnets. They provide access to databases and servers but do not listen for incoming connections.
660
661        See `strongdm.svc.SnapshotNodes`.
662        '''
663        self.policies = svc.SnapshotPolicies(client.policies)
664        '''
665         Policies are the collection of one or more statements that enforce fine-grained access
666         control for the users of an organization.
667
668        See `strongdm.svc.SnapshotPolicies`.
669        '''
670        self.proxy_cluster_keys = svc.SnapshotProxyClusterKeys(
671            client.proxy_cluster_keys)
672        '''
673         Proxy Cluster Keys are authentication keys for all proxies within a cluster.
674         The proxies within a cluster share the same key. One cluster can have
675         multiple keys in order to facilitate key rotation.
676
677        See `strongdm.svc.SnapshotProxyClusterKeys`.
678        '''
679        self.remote_identities = svc.SnapshotRemoteIdentities(
680            client.remote_identities)
681        '''
682         RemoteIdentities assign a resource directly to an account, giving the account the permission to connect to that resource.
683
684        See `strongdm.svc.SnapshotRemoteIdentities`.
685        '''
686        self.remote_identity_groups = svc.SnapshotRemoteIdentityGroups(
687            client.remote_identity_groups)
688        '''
689         A RemoteIdentityGroup is a named grouping of Remote Identities for Accounts.
690         An Account's relationship to a RemoteIdentityGroup is defined via RemoteIdentity objects.
691
692        See `strongdm.svc.SnapshotRemoteIdentityGroups`.
693        '''
694        self.resources = svc.SnapshotResources(client.resources)
695        '''
696         Resources are databases, servers, clusters, websites, or clouds that strongDM
697         delegates access to.
698
699        See `strongdm.svc.SnapshotResources`.
700        '''
701        self.role_resources = svc.SnapshotRoleResources(client.role_resources)
702        '''
703         RoleResources enumerates the resources to which roles have access.
704         The RoleResources service is read-only.
705
706        See `strongdm.svc.SnapshotRoleResources`.
707        '''
708        self.roles = svc.SnapshotRoles(client.roles)
709        '''
710         A Role has a list of access rules which determine which Resources the members
711         of the Role have access to. An Account can be a member of multiple Roles via
712         AccountAttachments.
713
714        See `strongdm.svc.SnapshotRoles`.
715        '''
716        self.secret_stores = svc.SnapshotSecretStores(client.secret_stores)
717        '''
718         SecretStores are servers where resource secrets (passwords, keys) are stored.
719
720        See `strongdm.svc.SnapshotSecretStores`.
721        '''
722        self.workflow_approvers = svc.SnapshotWorkflowApprovers(
723            client.workflow_approvers)
724        '''
725         WorkflowApprovers is an account or a role with the ability to approve requests bound to a workflow.
726
727        See `strongdm.svc.SnapshotWorkflowApprovers`.
728        '''
729        self.workflow_assignments = svc.SnapshotWorkflowAssignments(
730            client.workflow_assignments)
731        '''
732         WorkflowAssignments links a Resource to a Workflow. The assigned resources are those that a user can request
733         access to via the workflow.
734
735        See `strongdm.svc.SnapshotWorkflowAssignments`.
736        '''
737        self.workflow_roles = svc.SnapshotWorkflowRoles(client.workflow_roles)
738        '''
739         WorkflowRole links a role to a workflow. The linked roles indicate which roles a user must be a part of
740         to request access to a resource via the workflow.
741
742        See `strongdm.svc.SnapshotWorkflowRoles`.
743        '''
744        self.workflows = svc.SnapshotWorkflows(client.workflows)
745        '''
746         Workflows are the collection of rules that define the resources to which access can be requested,
747         the users that can request that access, and the mechanism for approving those requests which can either
748         be automatic approval or a set of users authorized to approve the requests.
749
750        See `strongdm.svc.SnapshotWorkflows`.
751        '''