Netflix-Skunkworks / aardvark

Aardvark is a multi-account AWS IAM Access Advisor API
Apache License 2.0
471 stars 77 forks source link

Update all fields on AdvisorData upsert #155

Open patricksanders opened 1 week ago

patricksanders commented 1 week ago

In some cases, the IAM Last Accessed Info data may reflect a new LastAuthenticated timestamp before being updated with LastAuthenticatedEntity and TotalAuthenticatedEntities. If Aardvark's updater runs between those two events, subsequent updater runs will not update the database record with LastAuthenticatedEntity and TotalAuthenticatedEntities. This happens because AdvisorData.create_or_update() only updates the database record when the new LastAuthenticated is greater than the existing record (or zero, sometimes). And even when the timestamp increases, only the timestamp ends up getting updated in the database.

This PR updates the implementation so that all fields are updated in the model. SQLAlchemy will ignore any records whose values have not been modified, meaning that we shouldn't see a meaningful increase on database load with this change.

I also added some tests to validate these changes, which was the most difficult part of the whole ordeal. I was able to do so without too much noise, with the exception of needing to add support for config overrides in the create_app() function.