Azure parity additions¶

From docs/INVENTORY_CATALOG.md on GitHub

The Azure inventory reads child resources, more Resource Graph tables, subscription-level ARM listings, two data planes, the Kubernetes API of AKS clusters and Entra ID (see INVENTORY_INTERNALS.md 8.4 to 8.10). This block lists what that added: two AssetType values, 153 ARM types in catalogs/azure_arm_types.yaml (278 in total), and the relationship combinations observed in the Azure parity tests (tests/test_azure_parity_*.py, test_azure_entra.py, test_azure_kubernetes.py), recorded the same way as the rest of this catalog.

New asset types¶

PLACEMENT_GROUP¶

A placement construct that groups machines: availability set, proximity placement group, dedicated host group or host.

Azure ARM: microsoft.compute/availabilitysets, microsoft.compute/proximityplacementgroups, microsoft.compute/hostgroups, microsoft.compute/hostgroups/hosts
Providers: AZURE
Metadata keys: member_count (int), fault_domains (int), update_domains (null)
Declared relations: CONTAINS → member VMs and scale sets, CONTAINS ← proximity placement group, CONTAINS → dedicated hosts

APP_REGISTRATION¶

An Entra application object (app registration), read from Microsoft Graph. Its service principal is a separate SERVICE_PRINCIPAL.

Identifier: entra:application/<objectId>, alias entra:app/<appId>
Providers: AZURE
Metadata keys: object_id (str), app_id (str), sign_in_audience (str), multi_tenant (bool), secrets (object: count, latest_expiry), certificates (object), requested_permissions (list), redirect_uris (list), federated_credentials (list), collected_via (str), tenant_id (str)
Declared relations: MANAGES / OWNED_BY → its service principal, MANAGES / OWNED_BY ← owners, IAM_TRUST / CROSS_ACCOUNT_TRUST or ROLE_ASSUMES_ROLE ← federated credential issuers

ARM types added to the catalog¶

Asset type	ARM types
`ACCESS_KEY`	`microsoft.containerregistry/registries/tokens`
`AI_GUARDRAIL`	`microsoft.cognitiveservices/accounts/raipolicies`
`AKS_CLUSTER`	`microsoft.kubernetes/connectedclusters`
`ALARM`	`microsoft.alertsmanagement/smartdetectoralertrules`, `microsoft.securityinsights/alertrules`
`API_GATEWAY`	`microsoft.apimanagement/service/apis`, `microsoft.apimanagement/service/gateways`
`AUTHORIZER`	`microsoft.apimanagement/service/apis/authorizers`, `microsoft.apimanagement/service/authorizationservers`
`AZURE_SQL`	`microsoft.sql/managedinstances/databases`
`BACKUP_PLAN`	`microsoft.dataprotection/backupvaults/backuppolicies`, `microsoft.netapp/netappaccounts/backuppolicies`, `microsoft.netapp/netappaccounts/snapshotpolicies`, `microsoft.recoveryservices/vaults/backuppolicies`, `microsoft.recoveryservices/vaults/replicationpolicies`
`BACKUP_VAULT`	`microsoft.netapp/netappaccounts/backupvaults`
`BATCH_ENVIRONMENT`	`microsoft.batch/batchaccounts/pools`, `microsoft.datafactory/factories/integrationruntimes`, `microsoft.machinelearningservices/workspaces/computes`, `microsoft.synapse/workspaces/integrationruntimes`
`BIG_DATA_CLUSTER`	`microsoft.synapse/workspaces/bigdatapools`
`BUILD_PROJECT`	`microsoft.containerregistry/registries/tasks`
`CERTIFICATE`	`microsoft.cdn/profiles/secrets`
`CLUSTER_ADDON`	`microsoft.kubernetesconfiguration/extensions`
`CONTAINER_REGISTRY`	`microsoft.containerregistry/registries/replications`
`CONTAINER_SERVICE`	`microsoft.appplatform/spring/apps`
`CUSTOMER_GATEWAY`	`microsoft.network/vpnsites`
`DATA_CATALOG`	`microsoft.datafactory/factories/datasets`, `microsoft.synapse/workspaces/datasets`
`DATA_STREAM`	`microsoft.eventhub/namespaces/eventhubs`
`DATA_WAREHOUSE`	`microsoft.kusto/clusters/databases`, `microsoft.synapse/workspaces/sqlpools`
`DEPLOYMENT_GROUP`	`microsoft.devcenter/projects`, `microsoft.devcenter/projects/environmenttypes`, `microsoft.kubernetesconfiguration/fluxconfigurations`, `microsoft.kubernetesconfiguration/sourcecontrolconfigurations`
`DIRECT_CONNECT`	`microsoft.network/expressrouteports`
`DNS_RECORD`	`microsoft.network/dnszones/a`, `microsoft.network/dnszones/aaaa`, `microsoft.network/dnszones/caa`, `microsoft.network/dnszones/cname`, `microsoft.network/dnszones/ds`, `microsoft.network/dnszones/mx`, `microsoft.network/dnszones/ns`, `microsoft.network/dnszones/ptr`, `microsoft.network/dnszones/soa`, `microsoft.network/dnszones/srv`, `microsoft.network/dnszones/txt`, `microsoft.network/privatednszones/a`, `microsoft.network/privatednszones/aaaa`, `microsoft.network/privatednszones/cname`, `microsoft.network/privatednszones/mx`, `microsoft.network/privatednszones/ptr`, `microsoft.network/privatednszones/soa`, `microsoft.network/privatednszones/srv`, `microsoft.network/privatednszones/txt`
`DNS_RESOLVER`	`microsoft.network/dnsforwardingrulesets`, `microsoft.network/dnsforwardingrulesets/forwardingrules`, `microsoft.network/dnsresolvers/inboundendpoints`, `microsoft.network/dnsresolvers/outboundendpoints`
`DYNAMODB_TABLE`	`microsoft.documentdb/databaseaccounts/regions`
`ECS_CLUSTER`	`microsoft.appplatform/spring`
`EDGE_FUNCTION`	`microsoft.cdn/profiles/rulesets`, `microsoft.cdn/profiles/rulesets/rules`
`ENDPOINT_SERVICE`	`microsoft.insights/privatelinkscopes`
`ETL_JOB`	`microsoft.datafactory/factories/pipelines`, `microsoft.search/searchservices/indexers`, `microsoft.search/searchservices/skillsets`, `microsoft.synapse/workspaces/pipelines`
`EVENT_RULE`	`microsoft.containerregistry/registries/webhooks`, `microsoft.eventgrid/eventsubscriptions`, `microsoft.securityinsights/automationrules`
`FILE_SYSTEM`	`microsoft.netapp/netappaccounts/capacitypools`, `microsoft.netapp/netappaccounts/capacitypools/volumes`
`GUARDRAIL`	`microsoft.authorization/denyassignments`, `microsoft.authorization/locks`, `microsoft.guestconfiguration/guestconfigurationassignments`
`IAC_STACK`	`microsoft.resources/deployments`, `microsoft.resources/deploymentstacks`
`IAM_POLICY`	`microsoft.authorization/roledefinitions`, `microsoft.containerregistry/registries/scopemaps`
`IDENTITY_PROVIDER`	`microsoft.apimanagement/service/openidconnectproviders`, `microsoft.managedidentity/userassignedidentities/federatedidentitycredentials`
`IDENTITY_USER`	`microsoft.storage/storageaccounts/localusers`
`KMS_KEY`	`microsoft.keyvault/vaults/keys`
`KNOWLEDGE_BASE`	`microsoft.search/searchservices/indexes`
`LB_LISTENER`	`microsoft.cdn/profiles/afdendpoints/routes`, `microsoft.network/applicationgateways/httplisteners`
`LOG_SINK`	`microsoft.insights/datacollectionendpoints`, `microsoft.securityinsights/dataconnectors`
`MACHINE_IMAGE`	`microsoft.compute/galleries`
`MESSAGE_QUEUE`	`microsoft.servicebus/namespaces/queues`, `microsoft.servicebus/namespaces/topics/subscriptions`
`ML_ENDPOINT`	`microsoft.machinelearningservices/workspaces/serverlessendpoints`
`ML_MODEL`	`microsoft.cognitiveservices/accounts/deployments`, `microsoft.machinelearningservices/workspaces/onlineendpoints/deployments`
`ML_WORKSPACE`	`microsoft.cognitiveservices/accounts/projects`
`NACL`	`microsoft.network/networkmanagers/securityadminconfigurations`, `microsoft.network/networkmanagers/securityadminconfigurations/rulecollections`
`NETWORK_INTERFACE`	`microsoft.network/virtualhubs/ipconfigurations`
`NODE_GROUP`	`microsoft.automation/automationaccounts/hybridrunbookworkergroups`
`NOTIFICATION_TOPIC`	`microsoft.servicebus/namespaces/topics`
`ORG_POLICY`	`microsoft.authorization/policydefinitions`, `microsoft.authorization/policysetdefinitions`
`PARAMETER`	`microsoft.apimanagement/service/namedvalues`, `microsoft.appconfiguration/configurationstores/replicas`
`PEERING_CONNECTION`	`microsoft.network/virtualhubs/bgpconnections`, `microsoft.network/virtualhubs/hubvirtualnetworkconnections`
`PLACEMENT_GROUP`	`microsoft.compute/availabilitysets`, `microsoft.compute/hostgroups`, `microsoft.compute/hostgroups/hosts`, `microsoft.compute/proximityplacementgroups`
`PRODUCT_PORTFOLIO`	`microsoft.apimanagement/service/products`, `microsoft.devcenter/devcenters`, `microsoft.resources/templatespecs`, `microsoft.resources/templatespecs/versions`, `microsoft.solutions/applicationdefinitions`
`PROVISIONED_PRODUCT`	`microsoft.solutions/applications`, `microsoft.subscription/aliases`
`RESOURCE_SHARE`	`microsoft.managedservices/registrationassignments`, `microsoft.managedservices/registrationdefinitions`
`ROUTE_TABLE`	`microsoft.network/networkmanagers/routingconfigurations`, `microsoft.network/virtualhubs/hubroutetables`, `microsoft.network/virtualhubs/routingintent`
`RUNBOOK`	`microsoft.automation/automationaccounts/runbooks`
`SCHEDULE`	`microsoft.automation/automationaccounts/schedules`, `microsoft.automation/automationaccounts/softwareupdateconfigurations`, `microsoft.datafactory/factories/triggers`, `microsoft.logic/workflows/triggers`, `microsoft.maintenance/maintenanceconfigurations`, `microsoft.synapse/workspaces/triggers`, `microsoft.web/sites/functions/timers`
`SECRET`	`microsoft.keyvault/vaults/secrets`
`SERVICE_NETWORK`	`microsoft.network/networkmanagers/connectivityconfigurations`, `microsoft.network/networkmanagers/networkgroups`
`SOURCE_CONNECTION`	`microsoft.cognitiveservices/accounts/connections`, `microsoft.cognitiveservices/accounts/projects/connections`, `microsoft.datafactory/factories/linkedservices`, `microsoft.devcenter/devcenters/catalogs`, `microsoft.devcenter/projects/catalogs`, `microsoft.machinelearningservices/workspaces/connections`, `microsoft.machinelearningservices/workspaces/datastores`, `microsoft.search/searchservices/datasources`, `microsoft.synapse/workspaces/linkedservices`, `microsoft.web/connections`
`TARGET_GROUP`	`microsoft.apimanagement/service/backends`, `microsoft.cdn/profiles/origingroups`, `microsoft.cdn/profiles/origingroups/origins`
`THREAT_DETECTOR`	`microsoft.securityinsights/onboardingstates`
`USER_POOL`	`microsoft.azureactivedirectory/b2cdirectories`, `microsoft.azureactivedirectory/ciamdirectories`
`VPN_GATEWAY`	`microsoft.network/p2svpngateways`
`WAF_WEB_ACL`	`microsoft.cdn/profiles/securitypolicies`

Azure parity relationship matrix¶

307 (source type, edge type, relationship, target type) combinations the linker produced from the Azure parity fixtures, grouped by edge type. none means the edge carries no fine-grained relationship.

ASSUMES_ROLE¶

Source type	Relationship	Target type
`K8S_SERVICE_ACCOUNT`	`RUNS_ON`	`SERVICE_PRINCIPAL`
`LOG_SINK`	`CROSS_ACCOUNT_TRUST`	`CLOUD_ACCOUNT`
`SERVICE_PRINCIPAL`	`CROSS_ACCOUNT_TRUST`	`RESOURCE_SHARE`

ATTACHED_TO¶

Source type	Relationship	Target type
`ELASTIC_IP`	`none`	`LOAD_BALANCER`
`VPN_CONNECTION`	`TRANSIT_ROUTED`	`CUSTOMER_GATEWAY`
`VPN_CONNECTION`	`TRANSIT_ROUTED`	`VPN_GATEWAY`

CONTAINS¶

Source type	Relationship	Target type
`AKS_CLUSTER`	`CLUSTER_CONTAINS_SERVICE`	`CLUSTER_ADDON`
`AKS_CLUSTER`	`CLUSTER_CONTAINS_SERVICE`	`DEPLOYMENT_GROUP`
`AKS_CLUSTER`	`CLUSTER_CONTAINS_SERVICE`	`K8S_NAMESPACE`
`API_GATEWAY`	`none`	`API_GATEWAY`
`API_GATEWAY`	`none`	`AUTHORIZER`
`API_GATEWAY`	`none`	`PARAMETER`
`API_GATEWAY`	`none`	`PRODUCT_PORTFOLIO`
`API_GATEWAY`	`none`	`TARGET_GROUP`
`AZURE_SQL`	`none`	`AZURE_SQL`
`BACKUP_VAULT`	`none`	`BACKUP_PLAN`
`BATCH_ENVIRONMENT`	`none`	`BATCH_ENVIRONMENT`
`BLOB_STORAGE`	`none`	`EVENT_RULE`
`BLOB_STORAGE`	`none`	`IDENTITY_USER`
`CDN`	`none`	`CDN`
`CDN`	`none`	`CERTIFICATE`
`CDN`	`none`	`LB_LISTENER`
`CDN`	`none`	`TARGET_GROUP`
`CLOUD_ACCOUNT`	`ACCOUNT_CONTAINS_REGION`	`RESOURCE_GROUP`
`CLOUD_ACCOUNT`	`none`	`GUARDRAIL`
`CLOUD_ACCOUNT`	`none`	`LOG_SINK`
`CLOUD_ACCOUNT`	`none`	`ORG_POLICY`
`CLOUD_ACCOUNT`	`none`	`RESOURCE_SHARE`
`CLOUD_FUNCTION`	`CLUSTER_CONTAINS_SERVICE`	`CLOUD_FUNCTION`
`CLOUD_FUNCTION`	`none`	`SCHEDULE`
`CONTAINER_REGISTRY`	`none`	`ACCESS_KEY`
`CONTAINER_REGISTRY`	`none`	`BUILD_PROJECT`
`CONTAINER_REGISTRY`	`none`	`CONTAINER_REGISTRY`
`CONTAINER_REGISTRY`	`none`	`EVENT_RULE`
`CONTAINER_REGISTRY`	`none`	`IAM_POLICY`
`DATA_STREAM`	`none`	`DATA_STREAM`
`DATA_WAREHOUSE`	`none`	`DATA_CATALOG`
`DATA_WAREHOUSE`	`none`	`DATA_WAREHOUSE`
`DATA_WAREHOUSE`	`none`	`ETL_JOB`
`DATA_WAREHOUSE`	`none`	`SOURCE_CONNECTION`
`DEPLOYMENT_GROUP`	`none`	`DEPLOYMENT_GROUP`
`DNS_RESOLVER`	`none`	`DNS_RESOLVER`
`DNS_ZONE`	`none`	`DNS_RECORD`
`DYNAMODB_TABLE`	`none`	`DYNAMODB_TABLE`
`ECS_CLUSTER`	`CLUSTER_CONTAINS_SERVICE`	`CONTAINER_SERVICE`
`ETL_JOB`	`none`	`BATCH_ENVIRONMENT`
`ETL_JOB`	`none`	`DATA_CATALOG`
`ETL_JOB`	`none`	`ETL_JOB`
`ETL_JOB`	`none`	`SCHEDULE`
`ETL_JOB`	`none`	`SOURCE_CONNECTION`
`IDENTITY_GROUP`	`none`	`IDENTITY_USER`
`IDENTITY_GROUP`	`none`	`SERVICE_PRINCIPAL`
`K8S_NAMESPACE`	`CLUSTER_CONTAINS_SERVICE`	`K8S_SERVICE`
`K8S_NAMESPACE`	`CLUSTER_CONTAINS_SERVICE`	`K8S_SERVICE_ACCOUNT`
`K8S_NAMESPACE`	`CLUSTER_CONTAINS_SERVICE`	`K8S_WORKLOAD`
`KEY_VAULT`	`none`	`GUARDRAIL`
`KEY_VAULT`	`none`	`KMS_KEY`
`KEY_VAULT`	`none`	`LOG_SINK`
`KEY_VAULT`	`none`	`SECRET`
`LOAD_BALANCER`	`none`	`LB_LISTENER`
`LOG_GROUP`	`none`	`ALARM`
`LOG_GROUP`	`none`	`EVENT_RULE`
`LOG_GROUP`	`none`	`LOG_SINK`
`LOG_GROUP`	`none`	`THREAT_DETECTOR`
`MESSAGE_QUEUE`	`none`	`MESSAGE_QUEUE`
`MESSAGE_QUEUE`	`none`	`NOTIFICATION_TOPIC`
`ML_ENDPOINT`	`CLUSTER_CONTAINS_SERVICE`	`ML_MODEL`
`ML_ENDPOINT`	`none`	`AI_GUARDRAIL`
`ML_ENDPOINT`	`none`	`LOG_SINK`
`ML_ENDPOINT`	`none`	`ML_MODEL`
`ML_WORKSPACE`	`none`	`BATCH_ENVIRONMENT`
`ML_WORKSPACE`	`none`	`ML_ENDPOINT`
`ML_WORKSPACE`	`none`	`ML_WORKSPACE`
`ML_WORKSPACE`	`none`	`SOURCE_CONNECTION`
`NACL`	`none`	`NACL`
`NODE_GROUP`	`CLUSTER_CONTAINS_SERVICE`	`VIRTUAL_MACHINE`
`NOTIFICATION_TOPIC`	`none`	`EVENT_RULE`
`NOTIFICATION_TOPIC`	`none`	`MESSAGE_QUEUE`
`PARAMETER`	`none`	`PARAMETER`
`PLACEMENT_GROUP`	`none`	`PLACEMENT_GROUP`
`PLACEMENT_GROUP`	`none`	`VIRTUAL_MACHINE`
`PREFIX_LIST`	`none`	`ELASTIC_IP`
`PRODUCT_PORTFOLIO`	`none`	`DEPLOYMENT_GROUP`
`PRODUCT_PORTFOLIO`	`none`	`PRODUCT_PORTFOLIO`
`PRODUCT_PORTFOLIO`	`none`	`SOURCE_CONNECTION`
`RESOURCE_GROUP`	`none`	`AKS_CLUSTER`
`RESOURCE_GROUP`	`none`	`BACKUP_VAULT`
`RESOURCE_GROUP`	`none`	`BLOB_STORAGE`
`RESOURCE_GROUP`	`none`	`CONTAINER_REGISTRY`
`RESOURCE_GROUP`	`none`	`GUARDRAIL`
`RESOURCE_GROUP`	`none`	`KEY_VAULT`
`RESOURCE_GROUP`	`none`	`LOG_GROUP`
`RESOURCE_GROUP`	`none`	`LOG_SINK`
`RESOURCE_GROUP`	`none`	`SCHEDULE`
`RESOURCE_GROUP`	`none`	`SERVICE_NETWORK`
`RESOURCE_GROUP`	`none`	`VIRTUAL_MACHINE`
`RESOURCE_GROUP`	`none`	`VNET`
`SCHEDULE`	`none`	`NODE_GROUP`
`SCHEDULE`	`none`	`RUNBOOK`
`SCHEDULE`	`none`	`SCHEDULE`
`SEARCH_DOMAIN`	`none`	`ETL_JOB`
`SEARCH_DOMAIN`	`none`	`KNOWLEDGE_BASE`
`SEARCH_DOMAIN`	`none`	`SOURCE_CONNECTION`
`SERVICE_NETWORK`	`none`	`CUSTOMER_GATEWAY`
`SERVICE_NETWORK`	`none`	`NACL`
`SERVICE_NETWORK`	`none`	`SERVICE_NETWORK`
`SERVICE_NETWORK`	`none`	`TRANSIT_GATEWAY`
`SERVICE_NETWORK`	`none`	`VNET`
`SERVICE_PRINCIPAL`	`none`	`IDENTITY_PROVIDER`
`STATE_MACHINE`	`none`	`SCHEDULE`
`SUBNET`	`SUBNET_CONTAINS_INSTANCE`	`AZURE_SQL`
`SUBNET`	`SUBNET_CONTAINS_INSTANCE`	`BATCH_ENVIRONMENT`
`SUBNET`	`SUBNET_CONTAINS_INSTANCE`	`BIG_DATA_CLUSTER`
`SUBNET`	`SUBNET_CONTAINS_INSTANCE`	`DATA_WAREHOUSE`
`SUBNET`	`SUBNET_CONTAINS_INSTANCE`	`DNS_RESOLVER`
`SUBNET`	`SUBNET_CONTAINS_INSTANCE`	`FILE_SYSTEM`
`SUBNET`	`SUBNET_CONTAINS_INSTANCE`	`NETWORK_INTERFACE`
`TARGET_GROUP`	`none`	`TARGET_GROUP`
`TRANSIT_GATEWAY`	`none`	`DIRECT_CONNECT`
`TRANSIT_GATEWAY`	`none`	`NETWORK_FIREWALL`
`TRANSIT_GATEWAY`	`none`	`NETWORK_INTERFACE`
`TRANSIT_GATEWAY`	`none`	`PEERING_CONNECTION`
`TRANSIT_GATEWAY`	`none`	`ROUTE_TABLE`
`TRANSIT_GATEWAY`	`none`	`VPN_GATEWAY`
`VIRTUAL_MACHINE`	`none`	`GUARDRAIL`
`VIRTUAL_MACHINE`	`none`	`OTHER`
`VNET`	`VPC_CONTAINS_SUBNET`	`SUBNET`

GOVERNS¶

Source type	Relationship	Target type
`GUARDRAIL`	`COMPLIANCE_GOVERNS`	`CLOUD_ACCOUNT`
`GUARDRAIL`	`COMPLIANCE_GOVERNS`	`RESOURCE_GROUP`
`GUARDRAIL`	`FINDING_AFFECTS`	`VIRTUAL_MACHINE`
`GUARDRAIL`	`POLICY_DENIES_ACTION`	`KEY_VAULT`
`ORG_POLICY`	`SCP_RESTRICTS`	`CLOUD_ACCOUNT`
`SERVICE_NETWORK`	`COMPLIANCE_GOVERNS`	`CLOUD_ACCOUNT`

GRANTS_ACCESS¶

Source type	Relationship	Target type
`ACCESS_KEY`	`POLICY_ALLOWS_ACTION`	`CONTAINER_REGISTRY`
`BACKUP_VAULT`	`POLICY_ALLOWS_ACTION`	`AKS_CLUSTER`
`CLOUD_ACCOUNT`	`CROSS_ACCOUNT_TRUST`	`MACHINE_IMAGE`
`CLOUD_ACCOUNT`	`POLICY_ALLOWS_ACTION`	`ENDPOINT_SERVICE`
`IDENTITY_GROUP`	`POLICY_ALLOWS_ACTION`	`AKS_CLUSTER`
`IDENTITY_GROUP`	`POLICY_ALLOWS_ACTION`	`DATA_WAREHOUSE`
`IDENTITY_GROUP`	`POLICY_ALLOWS_ACTION`	`ORGANIZATION`
`IDENTITY_USER`	`POLICY_ALLOWS_ACTION`	`AZURE_SQL`
`IDENTITY_USER`	`POLICY_ALLOWS_ACTION`	`BLOB_STORAGE`
`IDENTITY_USER`	`POLICY_ALLOWS_ACTION`	`CLOUD_ACCOUNT`
`IDENTITY_USER`	`POLICY_ALLOWS_ACTION`	`DEPLOYMENT_GROUP`
`IDENTITY_USER`	`POLICY_ALLOWS_ACTION`	`DYNAMODB_TABLE`
`IDENTITY_USER`	`POLICY_ALLOWS_ACTION`	`KEY_VAULT`
`IDENTITY_USER`	`POLICY_ALLOWS_ACTION`	`ORGANIZATION`
`RESOURCE_SHARE`	`CROSS_ACCOUNT_TRUST`	`CLOUD_ACCOUNT`
`SERVICE_PRINCIPAL`	`CROSS_ACCOUNT_TRUST`	`PRODUCT_PORTFOLIO`
`SERVICE_PRINCIPAL`	`CROSS_ACCOUNT_TRUST`	`PROVISIONED_PRODUCT`
`SERVICE_PRINCIPAL`	`POLICY_ALLOWS_ACTION`	`BLOB_STORAGE`
`SERVICE_PRINCIPAL`	`POLICY_ALLOWS_ACTION`	`SERVICE_PRINCIPAL`
`SUBNET`	`POLICY_ALLOWS_ACTION`	`APP_SERVICE`

IAM_POLICY_ATTACHMENT¶

Source type	Relationship	Target type
`IDENTITY_GROUP`	`GROUP_HAS_POLICY`	`IAM_POLICY`
`IDENTITY_USER`	`USER_HAS_POLICY`	`IAM_POLICY`
`SERVICE_PRINCIPAL`	`ROLE_HAS_POLICY`	`IAM_POLICY`

IAM_TRUST¶

Source type	Relationship	Target type
`AKS_CLUSTER`	`ROLE_ASSUMES_ROLE`	`SERVICE_PRINCIPAL`
`IDENTITY_PROVIDER`	`CROSS_ACCOUNT_TRUST`	`SERVICE_PRINCIPAL`
`IDENTITY_PROVIDER`	`ROLE_ASSUMES_ROLE`	`SERVICE_PRINCIPAL`

INVOKES¶

Source type	Relationship	Target type
`ALARM`	`INVOKES`	`NOTIFICATION_TOPIC`
`BLOB_STORAGE`	`INVOKES`	`CLOUD_FUNCTION`
`ETL_JOB`	`INVOKES`	`CLOUD_FUNCTION`
`EVENT_RULE`	`INVOKES`	`CLOUD_FUNCTION`
`EVENT_RULE`	`INVOKES`	`STATE_MACHINE`
`KEY_VAULT`	`ROTATES_SECRET`	`CLOUD_FUNCTION`
`KEY_VAULT`	`TRIGGERED_BY`	`NOTIFICATION_TOPIC`
`KNOWLEDGE_BASE`	`INVOKES`	`ML_ENDPOINT`
`MESSAGE_QUEUE`	`TRIGGERED_BY`	`CLOUD_FUNCTION`
`NOTIFICATION_TOPIC`	`INVOKES`	`CLOUD_FUNCTION`
`NOTIFICATION_TOPIC`	`STREAMS_TO`	`DATA_STREAM`
`STATE_MACHINE`	`INVOKES`	`CLOUD_FUNCTION`
`STATE_MACHINE`	`INVOKES`	`SOURCE_CONNECTION`

LOAD_BALANCER_TARGET¶

Source type	Relationship	Target type
`API_GATEWAY`	`SERVES_TRAFFIC_TO`	`CLOUD_FUNCTION`
`API_GATEWAY`	`SERVES_TRAFFIC_TO`	`TARGET_GROUP`
`APP_SERVICE`	`SERVES_TRAFFIC_TO`	`CLOUD_FUNCTION`
`CDN`	`SERVES_TRAFFIC_TO`	`TARGET_GROUP`
`EDGE_FUNCTION`	`SERVES_TRAFFIC_TO`	`TARGET_GROUP`
`K8S_SERVICE`	`SERVES_TRAFFIC_TO`	`K8S_WORKLOAD`
`LB_LISTENER`	`SERVES_TRAFFIC_TO`	`APP_SERVICE`
`LB_LISTENER`	`SERVES_TRAFFIC_TO`	`TARGET_GROUP`
`LOAD_BALANCER`	`SERVES_TRAFFIC_TO`	`APP_SERVICE`
`TARGET_GROUP`	`SERVES_TRAFFIC_TO`	`APP_SERVICE`
`TARGET_GROUP`	`SERVES_TRAFFIC_TO`	`CLOUD_FUNCTION`

LOGS_TO¶

Source type	Relationship	Target type
`AZURE_SQL`	`LOGS_TO`	`BLOB_STORAGE`
`DATA_STREAM`	`STREAMS_TO`	`BLOB_STORAGE`
`EVENT_RULE`	`STREAMS_TO`	`DATA_STREAM`
`KEY_VAULT`	`LOGS_TO`	`LOG_GROUP`
`KEY_VAULT`	`STREAMS_TO`	`DATA_STREAM`
`LOG_SINK`	`LOGS_TO`	`BLOB_STORAGE`
`LOG_SINK`	`LOGS_TO`	`LOG_GROUP`
`LOG_SINK`	`STREAMS_TO`	`DATA_STREAM`
`ML_ENDPOINT`	`LOGS_TO`	`BLOB_STORAGE`
`OTHER`	`LOGS_TO`	`LOG_GROUP`
`VIRTUAL_MACHINE`	`LOGS_TO`	`LOG_SINK`

MANAGES¶

Source type	Relationship	Target type
`APP_REGISTRATION`	`OWNED_BY`	`SERVICE_PRINCIPAL`
`BACKUP_PLAN`	`BACKUP_TO`	`VIRTUAL_MACHINE`
`BACKUP_PLAN`	`SCHEDULED_BY`	`FILE_SYSTEM`
`BACKUP_VAULT`	`REPLICATES_TO`	`VIRTUAL_MACHINE`
`DATA_CATALOG`	`OWNED_BY`	`BLOB_STORAGE`
`DEPLOYMENT_GROUP`	`OWNED_BY`	`AKS_CLUSTER`
`DEPLOYMENT_GROUP`	`OWNED_BY`	`CLOUD_ACCOUNT`
`IAC_STACK`	`OWNED_BY`	`VIRTUAL_MACHINE`
`IDENTITY_USER`	`OWNED_BY`	`APP_REGISTRATION`
`IDENTITY_USER`	`OWNED_BY`	`SERVICE_PRINCIPAL`
`SCHEDULE`	`SCHEDULED_BY`	`CLOUD_FUNCTION`
`SCHEDULE`	`SCHEDULED_BY`	`ETL_JOB`
`SCHEDULE`	`SCHEDULED_BY`	`RUNBOOK`
`SCHEDULE`	`SCHEDULED_BY`	`STATE_MACHINE`
`SCHEDULE`	`SCHEDULED_BY`	`VIRTUAL_MACHINE`

MONITORS¶

Source type	Relationship	Target type
`ALARM`	`MONITORED_BY`	`CLOUD_ACCOUNT`
`ALARM`	`MONITORED_BY`	`CLOUD_FUNCTION`
`ALARM`	`MONITORED_BY`	`LOG_GROUP`
`ALARM`	`MONITORED_BY`	`VIRTUAL_MACHINE`
`LOG_SINK`	`MONITORED_BY`	`CLOUD_ACCOUNT`
`LOG_SINK`	`MONITORED_BY`	`VIRTUAL_MACHINE`
`SECURITY_HUB`	`FINDING_AFFECTS`	`CONTAINER_REGISTRY`
`SECURITY_HUB`	`FINDING_AFFECTS`	`VIRTUAL_MACHINE`
`SECURITY_HUB`	`MONITORED_BY`	`BLOB_STORAGE`
`SECURITY_HUB`	`MONITORED_BY`	`CLOUD_ACCOUNT`
`THREAT_DETECTOR`	`FINDING_AFFECTS`	`VIRTUAL_MACHINE`
`THREAT_DETECTOR`	`MONITORED_BY`	`BLOB_STORAGE`
`THREAT_DETECTOR`	`MONITORED_BY`	`CLOUD_ACCOUNT`
`THREAT_DETECTOR`	`MONITORED_BY`	`VIRTUAL_MACHINE`

PROTECTS¶

Source type	Relationship	Target type
`AI_GUARDRAIL`	`none`	`ML_MODEL`
`NACL`	`PROTECTED_BY_NACL`	`SERVICE_NETWORK`
`WAF_WEB_ACL`	`PROTECTED_BY_WAF`	`CDN`
`WAF_WEB_ACL`	`PROTECTED_BY_WAF`	`LB_LISTENER`
`WAF_WEB_ACL`	`PROTECTED_BY_WAF`	`LOAD_BALANCER`

REFERENCES¶

Source type	Relationship	Target type
`ACCESS_KEY`	`DEPENDS_ON`	`IAM_POLICY`
`API_GATEWAY`	`DEPENDS_ON`	`AUTHORIZER`
`APP_SERVICE`	`READS_FROM`	`SOURCE_CONNECTION`
`AZURE_SQL`	`REPLICATES_TO`	`AZURE_SQL`
`BACKUP_PLAN`	`BACKUP_TO`	`BACKUP_VAULT`
`BIG_DATA_CLUSTER`	`READS_FROM`	`BLOB_STORAGE`
`BLOB_STORAGE`	`BACKUP_TO`	`BACKUP_VAULT`
`BLOB_STORAGE`	`REPLICATES_TO`	`BLOB_STORAGE`
`BUILD_PROJECT`	`READS_FROM`	`SOURCE_CONNECTION`
`BUILD_PROJECT`	`WRITES_TO`	`CONTAINER_REGISTRY`
`CERTIFICATE`	`CERTIFICATE_SECURES`	`CUSTOM_DOMAIN`
`CERTIFICATE`	`CERTIFICATE_SECURES`	`KEY_VAULT`
`CLOUD_FUNCTION`	`WRITES_TO`	`DATA_STREAM`
`CONTAINER_REGISTRY`	`REPLICATES_TO`	`CONTAINER_REGISTRY`
`DATA_CATALOG`	`DEPENDS_ON`	`SOURCE_CONNECTION`
`DATA_WAREHOUSE`	`READS_FROM`	`BLOB_STORAGE`
`DATA_WAREHOUSE`	`READS_FROM`	`DATA_STREAM`
`DEPLOYMENT_GROUP`	`READS_FROM`	`SOURCE_CONNECTION`
`DNS_RESOLVER`	`DEPENDS_ON`	`DNS_RESOLVER`
`DNS_RESOLVER`	`DNS_RESOLVED`	`VNET`
`DYNAMODB_TABLE`	`REPLICATES_TO`	`DYNAMODB_TABLE`
`EBS_VOLUME`	`BACKUP_TO`	`SNAPSHOT`
`ENDPOINT_SERVICE`	`DEPENDS_ON`	`LOG_GROUP`
`ETL_JOB`	`DEPENDS_ON`	`ETL_JOB`
`ETL_JOB`	`READS_FROM`	`DATA_CATALOG`
`ETL_JOB`	`READS_FROM`	`DATA_STREAM`
`ETL_JOB`	`READS_FROM`	`SOURCE_CONNECTION`
`ETL_JOB`	`WRITES_TO`	`AZURE_SQL`
`ETL_JOB`	`WRITES_TO`	`DATA_CATALOG`
`ETL_JOB`	`WRITES_TO`	`KNOWLEDGE_BASE`
`FILE_SYSTEM`	`BACKUP_TO`	`BACKUP_VAULT`
`FILE_SYSTEM`	`REPLICATES_TO`	`FILE_SYSTEM`
`GUARDRAIL`	`DEPENDS_ON`	`GUARDRAIL`
`GUARDRAIL`	`DEPENDS_ON`	`ORG_POLICY`
`IAC_STACK`	`DEPENDS_ON`	`PRODUCT_PORTFOLIO`
`IAM_POLICY`	`none`	`CLOUD_ACCOUNT`
`IDENTITY_USER`	`PERMISSION_BOUNDARY_LIMITS`	`GUARDRAIL`
`K8S_WORKLOAD`	`RUNS_ON`	`K8S_SERVICE_ACCOUNT`
`LB_LISTENER`	`CERTIFICATE_SECURES`	`KEY_VAULT`
`LOAD_BALANCER`	`CERTIFICATE_SECURES`	`KEY_VAULT`
`MACHINE_IMAGE`	`DEPENDS_ON`	`VIRTUAL_MACHINE`
`MESSAGE_QUEUE`	`WRITES_TO`	`MESSAGE_QUEUE`
`ML_WORKSPACE`	`READS_FROM`	`BLOB_STORAGE`
`NETWORK_FIREWALL`	`DEPENDS_ON`	`PREFIX_LIST`
`ORG_POLICY`	`DEPENDS_ON`	`ORG_POLICY`
`OTHER`	`DEPENDS_ON`	`LOG_GROUP`
`PARAMETER`	`READS_FROM`	`KEY_VAULT`
`PARAMETER`	`REPLICATES_TO`	`PARAMETER`
`PRODUCT_PORTFOLIO`	`DEPENDS_ON`	`API_GATEWAY`
`PROVISIONED_PRODUCT`	`DEPENDS_ON`	`PRODUCT_PORTFOLIO`
`RUNBOOK`	`RUNS_ON`	`NODE_GROUP`
`SEARCH_DOMAIN`	`DEPENDS_ON`	`BLOB_STORAGE`
`SOURCE_CONNECTION`	`DEPENDS_ON`	`AZURE_SQL`
`SOURCE_CONNECTION`	`DEPENDS_ON`	`BLOB_STORAGE`
`SOURCE_CONNECTION`	`DEPENDS_ON`	`MESSAGE_QUEUE`
`SOURCE_CONNECTION`	`READS_FROM`	`BLOB_STORAGE`
`SOURCE_CONNECTION`	`READS_FROM`	`SOURCE_CONNECTION`
`SOURCE_CONNECTION`	`RUNS_ON`	`BATCH_ENVIRONMENT`
`STATE_MACHINE`	`DEPENDS_ON`	`SOURCE_CONNECTION`
`THREAT_DETECTOR`	`DEPENDS_ON`	`LOG_GROUP`
`VIRTUAL_MACHINE`	`BACKUP_TO`	`BACKUP_VAULT`
`VIRTUAL_MACHINE`	`REPLICATES_TO`	`VIRTUAL_MACHINE`
`VPC_ENDPOINT`	`DEPENDS_ON`	`BLOB_STORAGE`

ROUTE¶

Source type	Relationship	Target type
`DIRECT_CONNECT`	`TRANSIT_ROUTED`	`DIRECT_CONNECT`
`DNS_RECORD`	`DNS_RESOLVED`	`API_GATEWAY`
`DNS_RECORD`	`DNS_RESOLVED`	`ELASTIC_IP`
`DNS_RECORD`	`DNS_RESOLVED`	`VPC_ENDPOINT`
`DNS_RESOLVER`	`DNS_RESOLVED`	`DNS_RESOLVER`
`ELASTIC_IP`	`LOAD_BALANCED_BY`	`K8S_SERVICE`
`PEERING_CONNECTION`	`TRANSIT_ROUTED`	`NETWORK_INTERFACE`
`PEERING_CONNECTION`	`TRANSIT_ROUTED`	`VNET`
`ROUTE_TABLE`	`TRANSIT_ROUTED`	`NETWORK_FIREWALL`
`SERVICE_NETWORK`	`TRANSIT_ROUTED`	`SERVICE_NETWORK`
`SERVICE_NETWORK`	`TRANSIT_ROUTED`	`VNET`
`TRANSIT_GATEWAY`	`TRANSIT_ROUTED`	`NETWORK_FIREWALL`
`TRANSIT_GATEWAY`	`TRANSIT_ROUTED`	`VNET`
`VPN_GATEWAY`	`TRANSIT_ROUTED`	`CUSTOMER_GATEWAY`

USES_IMAGE¶

Source type	Relationship	Target type
`APP_SERVICE`	`RUNS_ON`	`CONTAINER_REGISTRY`
`K8S_WORKLOAD`	`RUNS_ON`	`CONTAINER_REGISTRY`