Skip to content

GCP parity types

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

Four AssetType values were added for the GCP depth mapping, where no existing value fit. The GCP mapping also fills many existing types for the first time on GCP; the full type table is cloudg/inventory/catalogs/gcp_asset_types.yaml.

CONTAINER_IMAGE

  • An Artifact Registry Docker image (one digest).
  • GCP Cloud Asset Inventory: artifactregistry.googleapis.com/DockerImage
  • Providers: GCP
  • Metadata keys: create_time, description, folders, gcp_asset_type, location, network_tags, organization, parent_asset_type, parent_full_resource_name, project, project_id, project_number, state, tags (list), upload_time (str), uri (str), vulnerabilities (object: severity -> count, from Artifact Analysis)
  • Declared relations: CONTAINS ← CONTAINER_REGISTRY
  • Edges in: CONTAINS ← CONTAINER_REGISTRY; MONITORS / MONITORED_BY ← VULNERABILITY_SCANNER
  • Aliases: the image URI (us-docker.pkg.dev/p/repo/img@sha256:...) with and without https://, which is how Artifact Analysis names it. At most inventory.max_images_per_repository newest images per repository are kept.

DATA_TABLE

  • A table or view: BigQuery table / view / materialized view, Bigtable table and authorized view.
  • GCP Cloud Asset Inventory: bigquery.googleapis.com/Table (was OTHER), bigtableadmin.googleapis.com/Table, bigtableadmin.googleapis.com/AuthorizedView, bigtableadmin.googleapis.com/LogicalView, bigtableadmin.googleapis.com/MaterializedView
  • Providers: GCP
  • Metadata keys: change_stream (bool), deletion_protection (bool), partitioned (bool), table_type (str), num_rows, num_bytes, require_partition_filter, expiration_time, plus the common GCP keys
  • Declared relations: CONTAINS ← DATA_WAREHOUSE / DYNAMODB_TABLE; REFERENCES / READS_FROM → DATA_TABLE (view query sources), GCS_BUCKET (external tables); REFERENCES / DEPENDS_ON → SOURCE_CONNECTION; REFERENCES / BACKUP_TO ← (snapshot base table)
  • Edges in: GOVERNS / COMPLIANCE_GOVERNS ← GUARDRAIL (row access policy); MONITORS / MONITORED_BY ← ETL_JOB (Dataplex scan); REFERENCES / READS_FROM ← DATA_CATALOG, JOB_DEFINITION, ML_ENDPOINT

TAG

  • A Resource Manager tag key or tag value.
  • GCP Cloud Asset Inventory: cloudresourcemanager.googleapis.com/TagKey, cloudresourcemanager.googleapis.com/TagValue (tag bindings are folded into relations, see INVENTORY_INTERNALS.md 9.7)
  • Providers: GCP
  • Metadata keys: namespaced_name (str), short_name (str), purpose (str), plus the common GCP keys
  • Declared relations: CONTAINS ← ORGANIZATION / CLOUD_ACCOUNT (key), ← TAG (value); ATTACHED_TO → VPC (firewall-purpose keys)
  • Edges in: REFERENCES / TAGGED_WITH ← any tagged resource
  • Aliases: tagKeys/<id> / tagValues/<id> and the namespaced name (999/env/prod).

FLEET

  • A GKE fleet, fleet membership, membership binding or fleet scope.
  • GCP Cloud Asset Inventory: gkehub.googleapis.com/Fleet, gkehub.googleapis.com/Membership, gkehub.googleapis.com/MembershipBinding, gkehub.googleapis.com/Scope
  • Providers: GCP
  • Metadata keys: workload_identity_pool, issuer, unique_id (memberships), display_name, plus the common GCP keys
  • Declared relations: MANAGES / OWNED_BY → GKE_CLUSTER (membership); CONTAINS → FLEET (membership binding); REFERENCES / DEPENDS_ON → FLEET (binding to scope)
  • Edges in: MANAGES / OWNED_BY ← CLUSTER_ADDON (fleet feature)