# Buggy code
def load_s3_buckets(neo4j_session, data, current_aws_account_id, aws_update_tag):
    ingest_bucket = """
    MERGE (bucket:S3Bucket{id:{BucketName}})
    ON CREATE SET bucket.firstseen = timestamp(), bucket.creationdate = {CreationDate}
    SET bucket.name = {BucketName}, bucket.arn = {Arn}, bucket.lastupdated = {aws_update_tag}
    WITH bucket
    MATCH (owner:AWSAccount{id: {AWS_ACCOUNT_ID}})
    MERGE (owner)-[r:RESOURCE]->(bucket)
    ON CREATE SET r.firstseen = timestamp()
    SET r.lastupdated = {aws_update_tag}
    """

    # The owner data returned by the API maps to the aws account nickname and not the IAM user
    # there doesn't seem to be a way to retreive the mapping but we can get the current context account
    # so we map to that directly

    for bucket in data["Buckets"]:
        arn = "arn:aws:s3:::" + bucket["Name"]
        neo4j_session.run(
            ingest_bucket,
            BucketName=bucket["Name"],
            Arn=arn,
            CreationDate=str(bucket["CreationDate"]),
            AWS_ACCOUNT_ID=current_aws_account_id,
            aws_update_tag=aws_update_tag,
        )


# Traceback (botocore.exceptions.ClientError)
ERROR:cartography.sync:Unhandled exception during sync stage 'aws'
Traceback (most recent call last):
File "/usr/local/bin/cartography", line 8, in <module>
sys.exit(main())
File "/usr/local/lib/python3.6/site-packages/cartography/cli.py", line 216, in main
return CLI(default_sync, prog='cartography').main(argv)
File "/usr/local/lib/python3.6/site-packages/cartography/cli.py", line 196, in main
return cartography.sync.run_with_config(self.sync, config)
File "/usr/local/lib/python3.6/site-packages/cartography/sync.py", line 135, in run_with_config
return sync.run(neo4j_driver, config)
File "/usr/local/lib/python3.6/site-packages/cartography/sync.py", line 69, in run
stage_func(neo4j_session, config)
File "/usr/local/lib/python3.6/site-packages/cartography/intel/aws/__init__.py", line 106, in start_aws_ingestion
_sync_multiple_accounts(neo4j_session, aws_accounts, regions, config.update_tag, common_job_parameters)
File "/usr/local/lib/python3.6/site-packages/cartography/intel/aws/__init__.py", line 44, in _sync_multiple_accounts
_sync_one_account(neo4j_session, boto3_session, account_id, regions, sync_tag, common_job_parameters)
File "/usr/local/lib/python3.6/site-packages/cartography/intel/aws/__init__.py", line 22, in _sync_one_account
s3.sync(neo4j_session, boto3_session, account_id, sync_tag, common_job_parameters)
File "/usr/local/lib/python3.6/site-packages/cartography/intel/aws/s3.py", line 326, in sync
load_s3_details(neo4j_session, acl_and_policy_data_iter, current_aws_account_id, aws_update_tag)
File "/usr/local/lib/python3.6/site-packages/cartography/intel/aws/s3.py", line 136, in load_s3_details
for bucket, acl, policy in s3_details_iter:
File "/usr/local/lib/python3.6/site-packages/cartography/intel/aws/s3.py", line 26, in get_s3_bucket_details
acl = get_acl(bucket, client)
File "/usr/local/lib/python3.6/site-packages/cartography/intel/aws/s3.py", line 54, in get_acl
acl = client.get_bucket_acl(Bucket=bucket['Name'])
File "/Users/drosenbloom/Library/Python/3.6/lib/python/site-packages/botocore/client.py", line 272, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/Users/drosenbloom/Library/Python/3.6/lib/python/site-packages/botocore/client.py", line 576, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (IllegalLocationConstraintException) when calling the GetBucketAcl operation: The me-south-1 location constraint is incompatible for the region specific endpoint this request was sent to.

# Fixed code
def load_s3_buckets(neo4j_session, data, current_aws_account_id, aws_update_tag):
    ingest_bucket = """
    MERGE (bucket:S3Bucket{id:{BucketName}})
    ON CREATE SET bucket.firstseen = timestamp(), bucket.creationdate = {CreationDate}
    SET bucket.name = {BucketName}, bucket.region = {BucketRegion}, bucket.arn = {Arn},
    bucket.lastupdated = {aws_update_tag}
    WITH bucket
    MATCH (owner:AWSAccount{id: {AWS_ACCOUNT_ID}})
    MERGE (owner)-[r:RESOURCE]->(bucket)
    ON CREATE SET r.firstseen = timestamp()
    SET r.lastupdated = {aws_update_tag}
    """

    # The owner data returned by the API maps to the aws account nickname and not the IAM user
    # there doesn't seem to be a way to retreive the mapping but we can get the current context account
    # so we map to that directly

    for bucket in data["Buckets"]:
        arn = "arn:aws:s3:::" + bucket["Name"]
        neo4j_session.run(
            ingest_bucket,
            BucketName=bucket["Name"],
            BucketRegion=bucket["Region"],
            Arn=arn,
            CreationDate=str(bucket["CreationDate"]),
            AWS_ACCOUNT_ID=current_aws_account_id,
            aws_update_tag=aws_update_tag,
        )