Deployment / provisioning

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

STACK_SET

Catalog entries that classify native resources as this type:

• AWS ARN: cloudformation:stackset

• AWS CloudFormation (Cloud Control): AWS::CloudFormation::StackSet

• Providers: AWS

• Metadata keys: accounts (list), administration_role (str), auto_deployment (bool), call_as (str), capabilities (list), control_tower (bool), description (null), drift_status (null), execution_role_name (str), instance_count (int), instance_status (object), organizational_unit_ids (list), permission_model (str), regions (list), retain_on_account_removal (null), stack_set_id (str), status (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, MANAGES / OWNED_BY
• Edges out:
  MANAGES / OWNED_BY → CLOUD_ACCOUNT, IAC_STACK

PROVISIONED_PRODUCT

Service Catalog / Account Factory.

Catalog entries that classify native resources as this type:

• AWS ARN: servicecatalog:stack

• AWS CloudFormation (Cloud Control): AWS::ServiceCatalog::CloudFormationProvisionedProduct

• Providers: AWS

• Metadata keys: control_tower_account_factory (bool), created (null), launch_role (str), output_keys (list), physical_id (str), product_id (str), product_name (str), provisioned_by (null), provisioned_product_id (str), provisioning_artifact (null), status (str), type (str), vended_account_id (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, MANAGES / OWNED_BY, REFERENCES / DEPENDS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
MANAGES / OWNED_BY → CLOUD_ACCOUNT, IAC_STACK
REFERENCES / DEPENDS_ON → PRODUCT_PORTFOLIO

PRODUCT_PORTFOLIO

Catalog entries that classify native resources as this type:

• AWS ARN: catalog:portfolio

• AWS CloudFormation (Cloud Control): AWS::ServiceCatalog::Portfolio

• Providers: AWS

• Metadata keys: control_tower (bool), created (null), description (null), portfolio_id (str), principals (list), products (list), provider (str), shared_accounts (list)
• Carries aliases: yes
• Declared relations: GRANTS_ACCESS / POLICY_ALLOWS_ACTION ←
• Edges in:
  GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← IAM_ROLE
REFERENCES / DEPENDS_ON ← PROVISIONED_PRODUCT

CI_PIPELINE

Catalog entries that classify native resources as this type:

• AWS ARN: codepipeline
• AWS CloudFormation (Cloud Control): AWS::CodePipeline::Pipeline

• GCP Cloud Asset Inventory: clouddeploy.googleapis.com/DeliveryPipeline

• Providers: AWS

• Metadata keys: artifact_buckets (list), cross_account_actions (int), execution_mode (null), pipeline_type (null), providers (list), service (str), stages (list), trigger_providers (list), updated (str), variable_names (list), version (int)
• Declared relations: ASSUMES_ROLE / RUNS_ON, INVOKES / INVOKES, REFERENCES / READS_FROM, REFERENCES / WRITES_TO
• Edges out:
  ASSUMES_ROLE / RUNS_ON → CLOUD_ACCOUNT, IAM_ROLE
INVOKES / INVOKES → BUILD_PROJECT
REFERENCES / READS_FROM → SOURCE_CONNECTION
REFERENCES / WRITES_TO → S3_BUCKET

BUILD_PROJECT

Catalog entries that classify native resources as this type:

• AWS ARN: codebuild:project
• AWS CloudFormation (Cloud Control): AWS::CodeBuild::Project

• GCP Cloud Asset Inventory: cloudbuild.googleapis.com/BuildTrigger

• Providers: AWS

• Metadata keys: badge_enabled (bool), compute_type (str), concurrent_build_limit (null), encryption_key (str), environment_type (str), environment_variable_names (list), environment_variable_types (object), image (str), image_pull_credentials (null), privileged_mode (bool), secondary_sources (list), service (str), service_role (str), source_location (str), source_type (str), timeout_minutes (int), visibility (null), vpc_config (null), vpc_id (null), webhook_enabled (bool), webhook_filter_groups (int)
• Declared relations: ASSUMES_ROLE / RUNS_ON, LOGS_TO / LOGS_TO, REFERENCES / ENCRYPTED_BY_KMS, REFERENCES / READS_FROM, REFERENCES / WRITES_TO, USES_IMAGE / RUNS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
REFERENCES / READS_FROM → PARAMETER, S3_BUCKET
USES_IMAGE / RUNS_ON → CONTAINER_REGISTRY
• Edges in:
  INVOKES / INVOKES ← CI_PIPELINE

DEPLOYMENT_GROUP

Catalog entries that classify native resources as this type:

• AWS ARN: codedeploy:deploymentgroup
• AWS CloudFormation (Cloud Control): AWS::CodeDeploy::DeploymentGroup

• GCP Cloud Asset Inventory: clouddeploy.googleapis.com/Target

• Providers: AWS

• Metadata keys: application_name (str), auto_rollback (bool), auto_scaling_groups (list), compute_platform (str), deployment_config (null), deployment_group_id (str), deployment_style (null), ecs_services (list), github_repository (null), last_successful_deployment (null), revision_type (null), service (str), tag_filters (list)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, INVOKES / INVOKES, MANAGES, REFERENCES / MONITORED_BY
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
INVOKES / INVOKES → NOTIFICATION_TOPIC
MANAGES → AUTOSCALING_GROUP, CONTAINER_SERVICE, TARGET_GROUP
REFERENCES / MONITORED_BY → ALARM