strongdm.client

  1# Copyright 2020 StrongDM Inc
  2#
  3# Licensed under the Apache License, Version 2.0 (the "License");
  4# you may not use this file except in compliance with the License.
  5# You may obtain a copy of the License at
  6#
  7#     http://www.apache.org/licenses/LICENSE-2.0
  8#
  9# Unless required by applicable law or agreed to in writing, software
 10# distributed under the License is distributed on an "AS IS" BASIS,
 11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 12# See the License for the specific language governing permissions and
 13# limitations under the License.
 14#
 15
 16# Code generated by protogen. DO NOT EDIT.
 17
 18import base64
 19import copy
 20import datetime
 21import grpc
 22import hashlib
 23import hmac
 24import random
 25import time
 26from . import errors
 27from . import plumbing
 28from . import svc
 29
 30# These defaults are taken from AWS. Customization of these values
 31# is a future step in the API.
 32DEFAULT_MAX_RETRIES = 3
 33DEFAULT_BASE_RETRY_DELAY = 0.0030  # 30 ms
 34DEFAULT_MAX_RETRY_DELAY = 300  # 300 seconds
 35API_VERSION = '2024-03-28'
 36USER_AGENT = 'strongdm-sdk-python/8.1.0'
 37
 38
 39class Client:
 40    '''Client interacts with the strongDM API.'''
 41    def __init__(self,
 42                 api_access_key,
 43                 api_secret,
 44                 host='api.strongdm.com:443',
 45                 insecure=False,
 46                 retry_rate_limit_errors=True,
 47                 page_limit=50):
 48        '''
 49        Create a new Client.
 50
 51        - api_access_key: the access key to authenticate with strongDM
 52        - api_secret: the secret key to authenticate with strongDM
 53        '''
 54        self.api_access_key = api_access_key.strip()
 55        self.api_secret = base64.b64decode(api_secret.strip())
 56        self.max_retries = DEFAULT_MAX_RETRIES
 57        self.base_retry_delay = DEFAULT_BASE_RETRY_DELAY
 58        self.max_retry_delay = DEFAULT_MAX_RETRY_DELAY
 59        self.expose_rate_limit_errors = (not retry_rate_limit_errors)
 60        self.snapshot_datetime = None
 61        self.page_limit = page_limit
 62
 63        try:
 64            if insecure:
 65                channel = grpc.insecure_channel(host)
 66            else:
 67                creds = grpc.ssl_channel_credentials()
 68                channel = grpc.secure_channel(host, creds)
 69        except Exception as e:
 70            raise plumbing.convert_error_to_porcelain(e) from e
 71        self.channel = channel
 72        self.access_requests = svc.AccessRequests(channel, self)
 73        '''
 74         AccessRequests are requests for access to a resource that may match a Workflow.
 75
 76        See `strongdm.svc.AccessRequests`.
 77        '''
 78        self.access_request_events_history = svc.AccessRequestEventsHistory(
 79            channel, self)
 80        '''
 81         AccessRequestEventsHistory provides records of all changes to the state of an AccessRequest.
 82
 83        See `strongdm.svc.AccessRequestEventsHistory`.
 84        '''
 85        self.access_requests_history = svc.AccessRequestsHistory(channel, self)
 86        '''
 87         AccessRequestsHistory provides records of all changes to the state of an AccessRequest.
 88
 89        See `strongdm.svc.AccessRequestsHistory`.
 90        '''
 91        self.account_attachments = svc.AccountAttachments(channel, self)
 92        '''
 93         AccountAttachments assign an account to a role.
 94
 95        See `strongdm.svc.AccountAttachments`.
 96        '''
 97        self.account_attachments_history = svc.AccountAttachmentsHistory(
 98            channel, self)
 99        '''
100         AccountAttachmentsHistory records all changes to the state of an AccountAttachment.
101
102        See `strongdm.svc.AccountAttachmentsHistory`.
103        '''
104        self.account_grants = svc.AccountGrants(channel, self)
105        '''
106         AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
107
108        See `strongdm.svc.AccountGrants`.
109        '''
110        self.account_grants_history = svc.AccountGrantsHistory(channel, self)
111        '''
112         AccountGrantsHistory records all changes to the state of an AccountGrant.
113
114        See `strongdm.svc.AccountGrantsHistory`.
115        '''
116        self.account_permissions = svc.AccountPermissions(channel, self)
117        '''
118         AccountPermissions records the granular permissions accounts have, allowing them to execute
119         relevant commands via StrongDM's APIs.
120
121        See `strongdm.svc.AccountPermissions`.
122        '''
123        self.account_resources = svc.AccountResources(channel, self)
124        '''
125         AccountResources enumerates the resources to which accounts have access.
126         The AccountResources service is read-only.
127
128        See `strongdm.svc.AccountResources`.
129        '''
130        self.account_resources_history = svc.AccountResourcesHistory(
131            channel, self)
132        '''
133         AccountResourcesHistory records all changes to the state of a AccountResource.
134
135        See `strongdm.svc.AccountResourcesHistory`.
136        '''
137        self.accounts = svc.Accounts(channel, self)
138        '''
139         Accounts are users that have access to strongDM. There are two types of accounts:
140         1. **Users:** humans who are authenticated through username and password or SSO.
141         2. **Service Accounts:** machines that are authenticated using a service token.
142         3. **Tokens** are access keys with permissions that can be used for authentication.
143
144        See `strongdm.svc.Accounts`.
145        '''
146        self.accounts_history = svc.AccountsHistory(channel, self)
147        '''
148         AccountsHistory records all changes to the state of an Account.
149
150        See `strongdm.svc.AccountsHistory`.
151        '''
152        self.activities = svc.Activities(channel, self)
153        '''
154         An Activity is a record of an action taken against a strongDM deployment, e.g.
155         a user creation, resource deletion, sso configuration change, etc. The Activities
156         service is read-only.
157
158        See `strongdm.svc.Activities`.
159        '''
160        self.approval_workflow_approvers = svc.ApprovalWorkflowApprovers(
161            channel, self)
162        '''
163         ApprovalWorkflowApprovers link approval workflow approvers to an ApprovalWorkflowStep
164
165        See `strongdm.svc.ApprovalWorkflowApprovers`.
166        '''
167        self.approval_workflow_approvers_history = svc.ApprovalWorkflowApproversHistory(
168            channel, self)
169        '''
170         ApprovalWorkflowApproversHistory records all changes to the state of an ApprovalWorkflowApprover.
171
172        See `strongdm.svc.ApprovalWorkflowApproversHistory`.
173        '''
174        self.approval_workflow_steps = svc.ApprovalWorkflowSteps(channel, self)
175        '''
176         ApprovalWorkflowSteps link approval workflow steps to an ApprovalWorkflow
177
178        See `strongdm.svc.ApprovalWorkflowSteps`.
179        '''
180        self.approval_workflow_steps_history = svc.ApprovalWorkflowStepsHistory(
181            channel, self)
182        '''
183         ApprovalWorkflowStepsHistory records all changes to the state of an ApprovalWorkflowStep.
184
185        See `strongdm.svc.ApprovalWorkflowStepsHistory`.
186        '''
187        self.approval_workflows = svc.ApprovalWorkflows(channel, self)
188        '''
189         ApprovalWorkflows are the mechanism by which requests for access can be viewed by authorized
190         approvers and be approved or denied.
191
192        See `strongdm.svc.ApprovalWorkflows`.
193        '''
194        self.approval_workflows_history = svc.ApprovalWorkflowsHistory(
195            channel, self)
196        '''
197         ApprovalWorkflowsHistory records all changes to the state of an ApprovalWorkflow.
198
199        See `strongdm.svc.ApprovalWorkflowsHistory`.
200        '''
201        self.control_panel = svc.ControlPanel(channel, self)
202        '''
203         ControlPanel contains all administrative controls.
204
205        See `strongdm.svc.ControlPanel`.
206        '''
207        self.nodes = svc.Nodes(channel, self)
208        '''
209         Nodes make up the strongDM network, and allow your users to connect securely to your resources. There are two types of nodes:
210         - **Gateways** are the entry points into network. They listen for connection from the strongDM client, and provide access to databases and servers.
211         - **Relays** are used to extend the strongDM network into segmented subnets. They provide access to databases and servers but do not listen for incoming connections.
212
213        See `strongdm.svc.Nodes`.
214        '''
215        self.nodes_history = svc.NodesHistory(channel, self)
216        '''
217         NodesHistory records all changes to the state of a Node.
218
219        See `strongdm.svc.NodesHistory`.
220        '''
221        self.organization_history = svc.OrganizationHistory(channel, self)
222        '''
223         OrganizationHistory records all changes to the state of an Organization.
224
225        See `strongdm.svc.OrganizationHistory`.
226        '''
227        self.peering_group_nodes = svc.PeeringGroupNodes(channel, self)
228        '''
229         PeeringGroupNodes provides the building blocks necessary to obtain attach a node to a peering group.
230
231        See `strongdm.svc.PeeringGroupNodes`.
232        '''
233        self.peering_group_peers = svc.PeeringGroupPeers(channel, self)
234        '''
235         PeeringGroupPeers provides the building blocks necessary to link two peering groups.
236
237        See `strongdm.svc.PeeringGroupPeers`.
238        '''
239        self.peering_group_resources = svc.PeeringGroupResources(channel, self)
240        '''
241         PeeringGroupResources provides the building blocks necessary to obtain attach a resource to a peering group.
242
243        See `strongdm.svc.PeeringGroupResources`.
244        '''
245        self.peering_groups = svc.PeeringGroups(channel, self)
246        '''
247         PeeringGroups provides the building blocks necessary to obtain explicit network topology and routing.
248
249        See `strongdm.svc.PeeringGroups`.
250        '''
251        self.queries = svc.Queries(channel, self)
252        '''
253         A Query is a record of a single client request to a resource, such as a SQL query.
254         Long-running SSH, RDP, or Kubernetes interactive sessions also count as queries.
255         The Queries service is read-only.
256
257        See `strongdm.svc.Queries`.
258        '''
259        self.remote_identities = svc.RemoteIdentities(channel, self)
260        '''
261         RemoteIdentities assign a resource directly to an account, giving the account the permission to connect to that resource.
262
263        See `strongdm.svc.RemoteIdentities`.
264        '''
265        self.remote_identities_history = svc.RemoteIdentitiesHistory(
266            channel, self)
267        '''
268         RemoteIdentitiesHistory records all changes to the state of a RemoteIdentity.
269
270        See `strongdm.svc.RemoteIdentitiesHistory`.
271        '''
272        self.remote_identity_groups = svc.RemoteIdentityGroups(channel, self)
273        '''
274         A RemoteIdentityGroup is a named grouping of Remote Identities for Accounts.
275         An Account's relationship to a RemoteIdentityGroup is defined via RemoteIdentity objects.
276
277        See `strongdm.svc.RemoteIdentityGroups`.
278        '''
279        self.remote_identity_groups_history = svc.RemoteIdentityGroupsHistory(
280            channel, self)
281        '''
282         RemoteIdentityGroupsHistory records all changes to the state of a RemoteIdentityGroup.
283
284        See `strongdm.svc.RemoteIdentityGroupsHistory`.
285        '''
286        self.replays = svc.Replays(channel, self)
287        '''
288         A Replay captures the data transferred over a long-running SSH, RDP, or Kubernetes interactive session
289         (otherwise referred to as a query). The Replays service is read-only.
290
291        See `strongdm.svc.Replays`.
292        '''
293        self.resources = svc.Resources(channel, self)
294        '''
295         Resources are databases, servers, clusters, websites, or clouds that strongDM
296         delegates access to.
297
298        See `strongdm.svc.Resources`.
299        '''
300        self.resources_history = svc.ResourcesHistory(channel, self)
301        '''
302         ResourcesHistory records all changes to the state of a Resource.
303
304        See `strongdm.svc.ResourcesHistory`.
305        '''
306        self.role_resources = svc.RoleResources(channel, self)
307        '''
308         RoleResources enumerates the resources to which roles have access.
309         The RoleResources service is read-only.
310
311        See `strongdm.svc.RoleResources`.
312        '''
313        self.role_resources_history = svc.RoleResourcesHistory(channel, self)
314        '''
315         RoleResourcesHistory records all changes to the state of a RoleResource.
316
317        See `strongdm.svc.RoleResourcesHistory`.
318        '''
319        self.roles = svc.Roles(channel, self)
320        '''
321         A Role has a list of access rules which determine which Resources the members
322         of the Role have access to. An Account can be a member of multiple Roles via
323         AccountAttachments.
324
325        See `strongdm.svc.Roles`.
326        '''
327        self.roles_history = svc.RolesHistory(channel, self)
328        '''
329         RolesHistory records all changes to the state of a Role.
330
331        See `strongdm.svc.RolesHistory`.
332        '''
333        self.secret_store_healths = svc.SecretStoreHealths(channel, self)
334        '''
335         SecretStoreHealths exposes health states for secret stores.
336
337        See `strongdm.svc.SecretStoreHealths`.
338        '''
339        self.secret_stores = svc.SecretStores(channel, self)
340        '''
341         SecretStores are servers where resource secrets (passwords, keys) are stored.
342
343        See `strongdm.svc.SecretStores`.
344        '''
345        self.secret_stores_history = svc.SecretStoresHistory(channel, self)
346        '''
347         SecretStoresHistory records all changes to the state of a SecretStore.
348
349        See `strongdm.svc.SecretStoresHistory`.
350        '''
351        self.workflow_approvers = svc.WorkflowApprovers(channel, self)
352        '''
353         WorkflowApprovers is an account or a role with the ability to approve requests bound to a workflow.
354
355        See `strongdm.svc.WorkflowApprovers`.
356        '''
357        self.workflow_approvers_history = svc.WorkflowApproversHistory(
358            channel, self)
359        '''
360         WorkflowApproversHistory provides records of all changes to the state of a WorkflowApprover.
361
362        See `strongdm.svc.WorkflowApproversHistory`.
363        '''
364        self.workflow_assignments = svc.WorkflowAssignments(channel, self)
365        '''
366         WorkflowAssignments links a Resource to a Workflow. The assigned resources are those that a user can request
367         access to via the workflow.
368
369        See `strongdm.svc.WorkflowAssignments`.
370        '''
371        self.workflow_assignments_history = svc.WorkflowAssignmentsHistory(
372            channel, self)
373        '''
374         WorkflowAssignmentsHistory provides records of all changes to the state of a WorkflowAssignment.
375
376        See `strongdm.svc.WorkflowAssignmentsHistory`.
377        '''
378        self.workflow_roles = svc.WorkflowRoles(channel, self)
379        '''
380         WorkflowRole links a role to a workflow. The linked roles indicate which roles a user must be a part of
381         to request access to a resource via the workflow.
382
383        See `strongdm.svc.WorkflowRoles`.
384        '''
385        self.workflow_roles_history = svc.WorkflowRolesHistory(channel, self)
386        '''
387         WorkflowRolesHistory provides records of all changes to the state of a WorkflowRole
388
389        See `strongdm.svc.WorkflowRolesHistory`.
390        '''
391        self.workflows = svc.Workflows(channel, self)
392        '''
393         Workflows are the collection of rules that define the resources to which access can be requested,
394         the users that can request that access, and the mechanism for approving those requests which can either
395         be automatic approval or a set of users authorized to approve the requests.
396
397        See `strongdm.svc.Workflows`.
398        '''
399        self.workflows_history = svc.WorkflowsHistory(channel, self)
400        '''
401         WorkflowsHistory provides records of all changes to the state of a Workflow.
402
403        See `strongdm.svc.WorkflowsHistory`.
404        '''
405
406    def close(self):
407        '''Closes this Client and releases all resources held by it.
408
409        Closing the Client will immediately terminate all RPCs active with the
410        Client and it is not valid to invoke new RPCs with the Client.
411
412        This method is idempotent.
413        '''
414        self.channel.close()
415
416    def get_metadata(self, method_name, req):
417        return [
418            ('x-sdm-authentication', self.api_access_key),
419            ('x-sdm-signature', self.sign(method_name,
420                                          req.SerializeToString())),
421            ('x-sdm-api-version', API_VERSION),
422            ('x-sdm-user-agent', USER_AGENT),
423        ]
424
425    def sign(self, method_name, request_bytes):
426        def hmac_digest(key, msg_byte_string):
427            return hmac.new(key, msg=msg_byte_string,
428                            digestmod=hashlib.sha256).digest()
429
430        current_utc_date = datetime.datetime.now(
431            datetime.timezone.utc).strftime('%Y-%m-%d')
432        signing_key = hmac_digest(self.api_secret, current_utc_date.encode())
433        signing_key = hmac_digest(signing_key, b'sdm_api_v1')
434
435        hash = hashlib.sha256()
436
437        hash.update(method_name.encode())
438        hash.update(b'\n')
439        hash.update(request_bytes)
440
441        return base64.b64encode(hmac_digest(signing_key, hash.digest()))
442
443    def jitterSleep(self, iter):
444        dur_max = self.base_retry_delay * 2**iter
445        if (dur_max > self.max_retry_delay):
446            dur_max = self.max_retry_delay
447        # get a value between 0 and max
448        dur = random.random() * dur_max
449        time.sleep(dur)
450
451    def shouldRetry(self, iter, err):
452        if (iter >= self.max_retries - 1):
453            return False
454        if not isinstance(err, grpc.RpcError):
455            return True
456        porcelain_err = plumbing.convert_error_to_porcelain(err)
457        if (not self.expose_rate_limit_errors) and isinstance(
458                porcelain_err, errors.RateLimitError):
459            wait_until = porcelain_err.rate_limit.reset_at
460            now = datetime.datetime.now(datetime.timezone.utc)
461            sleep_for = (wait_until - now).total_seconds()
462            # If timezones or clock drift causes this calculation to fail,
463            # wait at most one minute.
464            if sleep_for < 0 or sleep_for > 60:
465                sleep_for = 60
466            time.sleep(sleep_for)
467            return True
468        return err.code() == grpc.StatusCode.INTERNAL or err.code(
469        ) == grpc.StatusCode.UNAVAILABLE
470
471    def snapshot_at(self, snapshot_datetime):
472        '''
473        Constructs a read-only client that will provide historical data from the provided timestamp.
474
475        See `SnapshotClient`.
476        '''
477        client = copy.copy(self)
478        client.snapshot_datetime = snapshot_datetime
479        client.access_requests = svc.AccessRequests(client.channel, client)
480        client.account_attachments = svc.AccountAttachments(
481            client.channel, client)
482        client.account_grants = svc.AccountGrants(client.channel, client)
483        client.account_permissions = svc.AccountPermissions(
484            client.channel, client)
485        client.account_resources = svc.AccountResources(client.channel, client)
486        client.accounts = svc.Accounts(client.channel, client)
487        client.approval_workflow_approvers = svc.ApprovalWorkflowApprovers(
488            client.channel, client)
489        client.approval_workflow_steps = svc.ApprovalWorkflowSteps(
490            client.channel, client)
491        client.approval_workflows = svc.ApprovalWorkflows(
492            client.channel, client)
493        client.nodes = svc.Nodes(client.channel, client)
494        client.remote_identities = svc.RemoteIdentities(client.channel, client)
495        client.remote_identity_groups = svc.RemoteIdentityGroups(
496            client.channel, client)
497        client.resources = svc.Resources(client.channel, client)
498        client.role_resources = svc.RoleResources(client.channel, client)
499        client.roles = svc.Roles(client.channel, client)
500        client.secret_stores = svc.SecretStores(client.channel, client)
501        client.workflow_approvers = svc.WorkflowApprovers(
502            client.channel, client)
503        client.workflow_assignments = svc.WorkflowAssignments(
504            client.channel, client)
505        client.workflow_roles = svc.WorkflowRoles(client.channel, client)
506        client.workflows = svc.Workflows(client.channel, client)
507        return SnapshotClient(client)
508
509
510class SnapshotClient:
511    '''SnapshotClient exposes methods to query historical records at a provided timestamp.'''
512    def __init__(self, client):
513        self.access_requests = svc.SnapshotAccessRequests(
514            client.access_requests)
515        '''
516         AccessRequests are requests for access to a resource that may match a Workflow.
517
518        See `strongdm.svc.SnapshotAccessRequests`.
519        '''
520        self.account_attachments = svc.SnapshotAccountAttachments(
521            client.account_attachments)
522        '''
523         AccountAttachments assign an account to a role.
524
525        See `strongdm.svc.SnapshotAccountAttachments`.
526        '''
527        self.account_grants = svc.SnapshotAccountGrants(client.account_grants)
528        '''
529         AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
530
531        See `strongdm.svc.SnapshotAccountGrants`.
532        '''
533        self.account_permissions = svc.SnapshotAccountPermissions(
534            client.account_permissions)
535        '''
536         AccountPermissions records the granular permissions accounts have, allowing them to execute
537         relevant commands via StrongDM's APIs.
538
539        See `strongdm.svc.SnapshotAccountPermissions`.
540        '''
541        self.account_resources = svc.SnapshotAccountResources(
542            client.account_resources)
543        '''
544         AccountResources enumerates the resources to which accounts have access.
545         The AccountResources service is read-only.
546
547        See `strongdm.svc.SnapshotAccountResources`.
548        '''
549        self.accounts = svc.SnapshotAccounts(client.accounts)
550        '''
551         Accounts are users that have access to strongDM. There are two types of accounts:
552         1. **Users:** humans who are authenticated through username and password or SSO.
553         2. **Service Accounts:** machines that are authenticated using a service token.
554         3. **Tokens** are access keys with permissions that can be used for authentication.
555
556        See `strongdm.svc.SnapshotAccounts`.
557        '''
558        self.approval_workflow_approvers = svc.SnapshotApprovalWorkflowApprovers(
559            client.approval_workflow_approvers)
560        '''
561         ApprovalWorkflowApprovers link approval workflow approvers to an ApprovalWorkflowStep
562
563        See `strongdm.svc.SnapshotApprovalWorkflowApprovers`.
564        '''
565        self.approval_workflow_steps = svc.SnapshotApprovalWorkflowSteps(
566            client.approval_workflow_steps)
567        '''
568         ApprovalWorkflowSteps link approval workflow steps to an ApprovalWorkflow
569
570        See `strongdm.svc.SnapshotApprovalWorkflowSteps`.
571        '''
572        self.approval_workflows = svc.SnapshotApprovalWorkflows(
573            client.approval_workflows)
574        '''
575         ApprovalWorkflows are the mechanism by which requests for access can be viewed by authorized
576         approvers and be approved or denied.
577
578        See `strongdm.svc.SnapshotApprovalWorkflows`.
579        '''
580        self.nodes = svc.SnapshotNodes(client.nodes)
581        '''
582         Nodes make up the strongDM network, and allow your users to connect securely to your resources. There are two types of nodes:
583         - **Gateways** are the entry points into network. They listen for connection from the strongDM client, and provide access to databases and servers.
584         - **Relays** are used to extend the strongDM network into segmented subnets. They provide access to databases and servers but do not listen for incoming connections.
585
586        See `strongdm.svc.SnapshotNodes`.
587        '''
588        self.remote_identities = svc.SnapshotRemoteIdentities(
589            client.remote_identities)
590        '''
591         RemoteIdentities assign a resource directly to an account, giving the account the permission to connect to that resource.
592
593        See `strongdm.svc.SnapshotRemoteIdentities`.
594        '''
595        self.remote_identity_groups = svc.SnapshotRemoteIdentityGroups(
596            client.remote_identity_groups)
597        '''
598         A RemoteIdentityGroup is a named grouping of Remote Identities for Accounts.
599         An Account's relationship to a RemoteIdentityGroup is defined via RemoteIdentity objects.
600
601        See `strongdm.svc.SnapshotRemoteIdentityGroups`.
602        '''
603        self.resources = svc.SnapshotResources(client.resources)
604        '''
605         Resources are databases, servers, clusters, websites, or clouds that strongDM
606         delegates access to.
607
608        See `strongdm.svc.SnapshotResources`.
609        '''
610        self.role_resources = svc.SnapshotRoleResources(client.role_resources)
611        '''
612         RoleResources enumerates the resources to which roles have access.
613         The RoleResources service is read-only.
614
615        See `strongdm.svc.SnapshotRoleResources`.
616        '''
617        self.roles = svc.SnapshotRoles(client.roles)
618        '''
619         A Role has a list of access rules which determine which Resources the members
620         of the Role have access to. An Account can be a member of multiple Roles via
621         AccountAttachments.
622
623        See `strongdm.svc.SnapshotRoles`.
624        '''
625        self.secret_stores = svc.SnapshotSecretStores(client.secret_stores)
626        '''
627         SecretStores are servers where resource secrets (passwords, keys) are stored.
628
629        See `strongdm.svc.SnapshotSecretStores`.
630        '''
631        self.workflow_approvers = svc.SnapshotWorkflowApprovers(
632            client.workflow_approvers)
633        '''
634         WorkflowApprovers is an account or a role with the ability to approve requests bound to a workflow.
635
636        See `strongdm.svc.SnapshotWorkflowApprovers`.
637        '''
638        self.workflow_assignments = svc.SnapshotWorkflowAssignments(
639            client.workflow_assignments)
640        '''
641         WorkflowAssignments links a Resource to a Workflow. The assigned resources are those that a user can request
642         access to via the workflow.
643
644        See `strongdm.svc.SnapshotWorkflowAssignments`.
645        '''
646        self.workflow_roles = svc.SnapshotWorkflowRoles(client.workflow_roles)
647        '''
648         WorkflowRole links a role to a workflow. The linked roles indicate which roles a user must be a part of
649         to request access to a resource via the workflow.
650
651        See `strongdm.svc.SnapshotWorkflowRoles`.
652        '''
653        self.workflows = svc.SnapshotWorkflows(client.workflows)
654        '''
655         Workflows are the collection of rules that define the resources to which access can be requested,
656         the users that can request that access, and the mechanism for approving those requests which can either
657         be automatic approval or a set of users authorized to approve the requests.
658
659        See `strongdm.svc.SnapshotWorkflows`.
660        '''