Common metadata keys

From docs/INVENTORY_CATALOG.md on GitHub

Keys that mean the same thing on every asset type that carries them.

Key	Type	Meaning
relations	list[object]	Relationships the collector declared; resolved into edges by the linker. Each entry is a relation object (see INVENTORY_REFERENCE.md, Relation object). Kept on the asset after linking, so the map records what was declared even when the target never resolved.
aliases	list[str]	Extra identifiers other services use for this asset (short IDs, names, endpoints, image repositories, aws-security: / azure-security: keys, Entra principal refs, serviceAccount: emails, selfLinks). Every alias is registered in the linker's identifier index.
discovered_via	str	How a non-collector asset was found; absent on assets built by a dedicated collector. Breadth sweeps: tagging-api, cloud-control, arm-sweep. Placeholders built from a reference: cross-account reference (external account), entra-principal-reference (Entra principal), iam_policy and workload_reference (GCP principals), eks-pod-identity (role named by an EKS Pod Identity association), ecs container instances (EC2 instances seen as ECS container instances), ram-incoming (resource shared into the account through RAM). Scope nodes: azure-subscription, collection scope (GCP project / folder the listing ran at), configured organization_id (GCP organization node). In deduplication a copy without discovered_via always wins.
collected_via	str	Azure: resource-graph or sdk, the collection path that produced the asset.
security_service	str	Security service name (AWS: guardduty, securityhub, inspector2, macie, config, accessanalyzer, detective, wafv2, network-firewall, shield, cloudtrail; Azure: defender-<plan>). Present on security-service assets and their not-enabled placeholders; feeds security_coverage.
enabled	bool	With security_service: whether the service runs in this account and region. false marks a coverage gap (counted in summary.security_service_gaps).
status	str	Native lifecycle or status value of the resource (ACTIVE, available, Enabled, ...); on not-enabled placeholders the reason (not enabled).
external	bool	On CLOUD_ACCOUNT: true for accounts, subscriptions or projects that were referenced but not mapped; false for mapped ones.
placeholder	bool	true on identity nodes synthesised from a reference (Entra principals, GCP per-project service-account placeholders). Real assets win over placeholders during resolution.
account_id	str	On CLOUD_ACCOUNT: the account / subscription / project ID (also indexed as an identifier).
properties	object	Azure: the resource's ARM properties, sanitised. AWS Cloud Control: the resource model with secret-bearing fields redacted.
resource_type	str	Native type string: ARM type for Azure, CloudFormation type for Cloud Control hits.
gcp_asset_type	str	GCP: Cloud Asset Inventory asset type (compute.googleapis.com/Instance).
project, project_id, project_number, folders, organization, location	str / list	GCP: owning project, ancestor folders, organization and location from Cloud Asset Inventory.
parent_full_resource_name	str	GCP: parent resource; the linker adds a parent CONTAINS edge.
kms_keys	list[str]	GCP: every Cloud KMS key referenced anywhere in the resource (CMEK); each becomes an ENCRYPTED_BY_KMS relation.
exposure_reasons, internet_ingress	list	GCP: why the asset is internet-exposed (firewall, allUsers, external IP, ...) and the ingress entries (via, kind, protocol, ports) behind the INTERNET_EXPOSED edges.
security_groups	list[str]	AWS: attached security groups; the linker adds ATTACHED_TO / PROTECTED_BY_SG edges.
subnet_id, subnets, vpc_id, vpc_config	str / list / object	AWS placement. subnet_id adds a SUBNET_CONTAINS_INSTANCE edge; vpc_config (SubnetIds, SecurityGroupIds) adds subnet containment and SG attachment.
kms_key_id	str	AWS: KMS key reference; the linker adds REFERENCES / ENCRYPTED_BY_KMS.
role_arn	str	AWS: execution / service role; ASSUMES_ROLE / RUNS_ON for Lambda and Step Functions, REFERENCES otherwise.
web_acl_id	str	AWS: WAF web ACL; the linker adds PROTECTS / PROTECTED_BY_WAF from the ACL.
origins	list[str]	CloudFront origins; resolved to buckets / load balancers as SERVES_TRAFFIC_TO unless a typed relation already links the pair.
attached_instance_id, attached_instance_ids, network_interface_id	str / list	AWS attachment of volumes, ENIs and Elastic IPs; ATTACHED_TO edges.
provisioned_role_prefix	str	IAM Identity Center permission set: prefix of the AWSReservedSSO_<name>_<hash> roles it creates; drives the SSO MANAGES / OWNED_BY rule.
cluster_arn, namespace, kind	str	Kubernetes objects mapped from EKS: owning cluster, namespace and object kind.
environment_keys	list[str]	Names of environment variables only. Values are never collected.
extraction_error	str	GCP: an extractor raised on this resource; the asset is kept with its base metadata.
summary_only	bool	GCP: built from a searchAllResources summary rather than the full resource JSON.