Compute

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

EC2

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:instance

• Providers: AWS

• Also discovered via: tagging-api
• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: discovered_via (str), image_id (str), instance_type (str), private_ip (str), public_ip (null | str), security_groups (list), service (str), state (str), subnet_id (str), vpc_id (str)
• Edges out:
  ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
REFERENCES → VPC
• Edges in:
  ATTACHED_TO ← EBS_VOLUME, NETWORK_INTERFACE
CONTAINS ← ECS_CLUSTER
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
LOAD_BALANCER_TARGET / LB_TARGETS_INSTANCE ← TARGET_GROUP
MANAGES ← APP_SERVICE, OTHER
MANAGES / SCHEDULED_BY ← SCHEDULE

VIRTUAL_MACHINE

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.compute/virtualmachines, microsoft.hybridcompute/machines

• Providers: AWS, AZURE

• Metadata keys: activation_id (null), agent_version (null), collected_via (str), computer_name (null | str), hybrid (bool), identity (object), instance_id (str), kind (null), network_interfaces (list), os_type (str), ping_status (str), platform_name (null), platform_type (str), platform_version (null), power_state (null), private_ip (str), properties (object), provisioning_state (null), resource_group (str), resource_type (null | str), service (str), sku (null), source_id (null), source_type (null), vm_size (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, ATTACHED_TO ←, CONTAINS ←
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
GRANTS_ACCESS / POLICY_ALLOWS_ACTION → KEY_VAULT
• Edges in:
  ATTACHED_TO ← EBS_VOLUME, NETWORK_INTERFACE
CONTAINS ← RESOURCE_GROUP
MANAGES ← OTHER

GCE_INSTANCE

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: compute.googleapis.com/Instance

• Providers: GCP

• Metadata keys: can_ip_forward (bool), confidential_compute (bool), create_time (null), deletion_protection (bool), description (null | str), folders (list), gcp_asset_type (str), location (str), metadata_keys (list), network_tags (list), networks (list), organization (null | str), parent_asset_type (null | str), parent_full_resource_name (null | str), private_ips (list), project (str), project_id (str), project_number (str), public_ips (list), service_account_emails (list), shielded_vm (object), state (str), summary_only (bool)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, ATTACHED_TO ←, CONTAINS / SUBNET_CONTAINS_INSTANCE ←
• Edges out:
  ASSUMES_ROLE / RUNS_ON → SERVICE_PRINCIPAL
ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
REFERENCES → VPC
• Edges in:
  ATTACHED_TO ← EBS_VOLUME
CONTAINS ← CLOUD_ACCOUNT
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET

LAMBDA_FUNCTION

Catalog entries that classify native resources as this type:

• AWS ARN: lambda:function

• Providers: AWS

• Metadata keys: alias (bool), alias_name (str), architectures (list), description (str), environment_keys (list), event_sources (list), function_arn (str), function_name (str), function_url (null), function_url_auth (null), function_version (str), handler (str), image_uri (null), last_modified (str), layers (list), memory_size (int), package_type (str), policy_allows_public (bool), role_arn (str), routing_weights (object), runtime (str), timeout (int), tracing (str), versions (list), vpc_config (null)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, INVOKES ←, INVOKES / TRIGGERED_BY ←, LOGS_TO / LOGS_TO, REFERENCES, REFERENCES / DEPENDS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
LOGS_TO / LOGS_TO → LOG_GROUP
REFERENCES / DEPENDS_ON → LAMBDA_FUNCTION, MESSAGE_QUEUE
• Edges in:
  INVOKES ← DYNAMODB_TABLE, EVENT_RULE, MESSAGE_QUEUE
INVOKES / INVOKES ← AUTHORIZER, EVENT_PIPE, EVENT_RULE, S3_BUCKET, SCHEDULE, USER_POOL
INVOKES / ROTATES_SECRET ← SECRET
INVOKES / STREAMS_TO ← LOG_SINK
INVOKES / TRIGGERED_BY ← MESSAGE_QUEUE, NOTIFICATION_TOPIC
MONITORS / MONITORED_BY ← ALARM
REFERENCES / DEPENDS_ON ← LAMBDA_FUNCTION

CLOUD_FUNCTION

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.web/sites/functions

• GCP Cloud Asset Inventory: cloudfunctions.googleapis.com/CloudFunction, cloudfunctions.googleapis.com/Function

• Providers: AZURE

• Also discovered via: arm-sweep
• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: collected_via (str), default_host_name (null | str), discovered_via (str), https_only (null), identity (object), kind (str), properties (object), public_network_access (null), resource_group (str), resource_type (str), role (str), sku (null), state (null), vnet_integration_subnet (null)
• Carries aliases: yes
• Declared relations: CONTAINS ←, CONTAINS / CLUSTER_CONTAINS_SERVICE ←
• Edges in:
  CONTAINS ← RESOURCE_GROUP
CONTAINS / CLUSTER_CONTAINS_SERVICE ← APP_SERVICE

ECS_CLUSTER

Catalog entries that classify native resources as this type:

• AWS ARN: ecs:cluster

• Azure ARM: microsoft.app/managedenvironments

• Providers: AWS

• Also discovered via: ecs container instances
• Metadata keys: active_services (int), capacity_providers (list), container_insights (bool), container_instance_ids (list), container_instances (int), discovered_via (str), pending_tasks (int), running_tasks (int), standalone_task_definitions (list), status (str)
• Carries aliases: yes
• Declared relations: CONTAINS
• Edges out:
  CONTAINS → EC2
CONTAINS / CLUSTER_CONTAINS_SERVICE → CONTAINER_SERVICE
REFERENCES / SCALES_WITH → CAPACITY_PROVIDER

EKS_CLUSTER

Catalog entries that classify native resources as this type:

• AWS ARN: eks:cluster

• Providers: AWS

• Metadata keys: access_entries (list), authentication_mode (null), endpoint (str), endpoint_private_access (bool), endpoint_public_access (bool), logging_enabled (list), oidc_issuer (str), platform_version (str), public_access_cidrs (list), secrets_encrypted (bool), security_groups (list), status (str), subnets (list), version (str), vpc_id (null)
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, REFERENCES / DEPENDS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
CONTAINS / CLUSTER_CONTAINS_SERVICE → FARGATE_PROFILE, K8S_NAMESPACE, NODE_GROUP
• Edges in:
  CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET

AKS_CLUSTER

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.containerservice/managedclusters

• Providers: AZURE

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: aad_managed (null), api_server_authorized_ip_ranges (list), azure_rbac (null), collected_via (str), fqdn (str), identity (object), kind (null), kubelet_identity (object), kubernetes_version (str), local_accounts_disabled (null), network_plugin (null), network_policy (null), node_resource_group (str), outbound_type (null), private_cluster (bool), private_fqdn (null), properties (object), rbac_enabled (null), resource_group (str), resource_type (str), sku (null)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS ←, LOGS_TO / LOGS_TO, MANAGES / OWNED_BY, USES_IMAGE / RUNS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → SERVICE_PRINCIPAL
CONTAINS / CLUSTER_CONTAINS_SERVICE → NODE_GROUP
LOGS_TO / LOGS_TO → LOG_GROUP
MANAGES / OWNED_BY → RESOURCE_GROUP
REFERENCES → SUBNET
USES_IMAGE / RUNS_ON → CONTAINER_REGISTRY
• Edges in:
  CONTAINS ← RESOURCE_GROUP

GKE_CLUSTER

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: container.googleapis.com/Cluster

• Providers: GCP

• Metadata keys: autopilot (bool), create_time (null), description (null), folders (list), gcp_asset_type (str), kms_keys (list), legacy_abac (bool), location (str), master_authorized_networks (list), master_authorized_networks_enabled (bool), network (str), network_policy (bool), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), private_nodes (bool), project (str), project_id (str), project_number (str), public_endpoint (bool), secrets_encryption (str), shielded_nodes (bool), state (null), subnetwork (str), workload_pool (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, REFERENCES / ENCRYPTED_BY_KMS
• Edges out:
  ASSUMES_ROLE / RUNS_ON → SERVICE_PRINCIPAL
CONTAINS / CLUSTER_CONTAINS_SERVICE → NODE_GROUP
REFERENCES → VPC
REFERENCES / ENCRYPTED_BY_KMS → KMS_KEY
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET

APP_SERVICE

Catalog entries that classify native resources as this type:

• AWS ARN: apprunner:service, elasticbeanstalk:application, elasticbeanstalk:environment
• AWS CloudFormation (Cloud Control): AWS::AppRunner::Service, AWS::ElasticBeanstalk::Environment
• Azure ARM: microsoft.web/hostingenvironments, microsoft.web/serverfarms, microsoft.web/sites, microsoft.web/sites/slots, microsoft.web/staticsites

• GCP Cloud Asset Inventory: appengine.googleapis.com/Application, appengine.googleapis.com/Service

• Providers: AWS, AZURE

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: application (str), auto_deployments (null), cname (str), collected_via (str), configuration_templates (list), cpu (null), default_host_name (str), egress_type (str), elb_scheme (str), endpoint (null | str), environment_id (str), environment_type (null), environment_variable_names (list), health (str), https_only (null), identity (object), image (str), image_repository_type (str), images (list), instance_profile (null | str), kind (str), load_balancer_type (null), managed_resources (object), memory (null), platform (str), properties (object), public_network_access (null), publicly_accessible (bool), repository_url (null), resource_group (str), resource_type (str), role (str), secret_names (list), security_groups (list), service (str), service_role (null | str), service_url (str), site_count (int), sku (null | str), solution_stack (str), source_type (str), state (null), status (str), tier (str), version_label (null | str), versions (int), vnet_integration_subnet (str), vpc_config (null | object), vpc_id (null), workers (null)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, ATTACHED_TO, CONTAINS ←, CONTAINS / CLUSTER_CONTAINS_SERVICE ←, LOGS_TO / LOGS_TO, MANAGES, REFERENCES / DEPENDS_ON, REFERENCES / READS_FROM, REFERENCES / RUNS_ON, USES_IMAGE / RUNS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE, SERVICE_PRINCIPAL
ATTACHED_TO → SUBNET
CONTAINS → APP_SERVICE
CONTAINS / CLUSTER_CONTAINS_SERVICE → APP_SERVICE, CLOUD_FUNCTION
MANAGES → AUTOSCALING_GROUP, EC2, LOAD_BALANCER
REFERENCES / DEPENDS_ON → VPC_LINK
REFERENCES / READS_FROM → SECRET
REFERENCES / RUNS_ON → INSTANCE_PROFILE
USES_IMAGE / RUNS_ON → CONTAINER_REGISTRY
• Edges in:
  CONTAINS ← APP_SERVICE, RESOURCE_GROUP
CONTAINS / CLUSTER_CONTAINS_SERVICE ← APP_SERVICE
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO ← LOAD_BALANCER