Hybrid and edge networking

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

VPN_CONNECTION

VPN connection / tunnel.

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:vpn-connection
• AWS CloudFormation (Cloud Control): AWS::EC2::VPNConnection
• Azure ARM: microsoft.network/connections

• GCP Cloud Asset Inventory: compute.googleapis.com/VpnTunnel

• Providers: AWS

• Metadata keys: acceleration (null), category (null), core_network_arn (null), customer_gateway_id (str), local_ipv4_cidr (null), outside_ip_type (null), remote_ipv4_cidr (null), state (str), static_routes (list), static_routes_only (null), tgw_id (null), tunnels (list), tunnels_up (int), type (str), vpn_connection_id (str), vpn_gateway_id (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO / TRANSIT_ROUTED, ROUTE / TRANSIT_ROUTED
• Edges out:
  ATTACHED_TO / TRANSIT_ROUTED → VPN_GATEWAY
ROUTE / TRANSIT_ROUTED → CUSTOMER_GATEWAY

VPN_GATEWAY

VGW, Azure VNet gateway, GCP target VPN gateway.

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:vpn-gateway
• AWS CloudFormation (Cloud Control): AWS::EC2::VPNGateway
• Azure ARM: microsoft.network/virtualnetworkgateways, microsoft.network/vpngateways

• GCP Cloud Asset Inventory: compute.googleapis.com/TargetVpnGateway, compute.googleapis.com/VpnGateway

• Providers: AWS

• Metadata keys: amazon_side_asn (null), state (str), type (str), vpc_attachments (list), vpn_gateway_id (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO
• Edges out:
  ATTACHED_TO → VPC
• Edges in:
  ATTACHED_TO / TRANSIT_ROUTED ← VPN_CONNECTION
ROUTE / TRANSIT_ROUTED ← DIRECT_CONNECT

CUSTOMER_GATEWAY

CGW, local network gateway, external VPN gateway.

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:customer-gateway
• AWS CloudFormation (Cloud Control): AWS::EC2::CustomerGateway
• Azure ARM: microsoft.network/localnetworkgateways

• GCP Cloud Asset Inventory: compute.googleapis.com/ExternalVpnGateway

• Providers: AWS

• Metadata keys: bgp_asn (str), customer_gateway_id (str), device_name (null), ip_address (str), state (str), type (str)
• Carries aliases: yes
• Edges in:
  ROUTE / TRANSIT_ROUTED ← VPN_CONNECTION

DIRECT_CONNECT

DX connection / VIF / gateway, ExpressRoute, Interconnect.

Catalog entries that classify native resources as this type:

• AWS ARN: directconnect
• AWS CloudFormation (Cloud Control): AWS::DirectConnect::Connection
• Azure ARM: microsoft.network/expressroutecircuits, microsoft.network/expressroutegateways

• GCP Cloud Asset Inventory: compute.googleapis.com/Interconnect, compute.googleapis.com/InterconnectAttachment

• Providers: AWS

• Metadata keys: address_family (null), allows_hosted_connections (null), amazon_side_asn (int | null), asn (null), associations (list), aws_device (null), bandwidth (str), bgp_peers (list), connection_id (str), connections_bandwidth (null), dx_gateway_id (str), encryption_mode (null), has_logical_redundancy (null), interface_type (str), jumbo_frames (null), lag_id (str), location (null | str), macsec_capable (null), member_connections (list), minimum_links (null), mtu (null), number_of_connections (null), owner_account (str), partner_name (null), port_encryption_status (null), provider_name (null), resource_kind (str), route_filter_prefixes (int), site_link (null), state (str), vgw_id (null), vif_attachments (list), virtual_interface_id (str), vlan (null)
• Carries aliases: yes
• Declared relations: ATTACHED_TO, CONTAINS ←, ROUTE / TRANSIT_ROUTED, ROUTE / TRANSIT_ROUTED ←
• Edges out:
  ATTACHED_TO → DIRECT_CONNECT
CONTAINS → DIRECT_CONNECT
ROUTE / TRANSIT_ROUTED → CLOUD_ACCOUNT, DIRECT_CONNECT, TRANSIT_GATEWAY, VPN_GATEWAY
• Edges in:
  ATTACHED_TO ← DIRECT_CONNECT
CONTAINS ← DIRECT_CONNECT
ROUTE / TRANSIT_ROUTED ← DIRECT_CONNECT

ROUTER

GCP Cloud Router, Azure virtual hub router.

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: compute.googleapis.com/Router

Not exercised by the fixtures. Produced by collectors or catalogs for resources the test estates do not contain; carries the common keys above plus collector-specific fields.

PREFIX_LIST

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:prefix-list
• AWS CloudFormation (Cloud Control): AWS::EC2::PrefixList

• Azure ARM: microsoft.network/ipgroups, microsoft.network/publicipprefixes

• Providers: AWS

• Metadata keys: address_family (str), entries (list), entry_count (int), max_entries (int), owner_id (str), prefix_list_id (str), state (str), version (int)
• Carries aliases: yes

ENDPOINT_SERVICE

PrivateLink service, private link service, PSC attachment.

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:vpc-endpoint-service
• AWS CloudFormation (Cloud Control): AWS::EC2::VPCEndpointService
• Azure ARM: microsoft.network/privatelinkservices

• GCP Cloud Asset Inventory: compute.googleapis.com/ServiceAttachment

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: acceptance_required (bool), allowed_principals (list), allows_any_principal (bool), auth_policy_public (bool), auth_policy_state (str), auth_type (str), availability_zones (list), base_endpoint_dns_names (list), consumer_count (int), consumers (list), custom_domain_name (str), dns_name (str), listeners (list), private_dns_name (null | str), private_dns_verification (null), resource_kind (str), service_id (str), service_name (str), service_types (list), state (null | str), status (str), supported_regions (list), unauthenticated (bool)
• Carries aliases: yes
• Declared relations: GRANTS_ACCESS / POLICY_ALLOWS_ACTION ←, LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO, ROUTE / SERVES_TRAFFIC_TO ←
• Edges out:
  LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO → LOAD_BALANCER
• Edges in:
  CONTAINS ← SERVICE_NETWORK
GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← CLOUD_ACCOUNT
ROUTE / SERVES_TRAFFIC_TO ← CLOUD_ACCOUNT

VPC_LINK

Catalog entries that classify native resources as this type:

• AWS ARN: apigateway:vpclinks
• AWS CloudFormation (Cloud Control): AWS::ApiGateway::VpcLink, AWS::ApiGatewayV2::VpcLink

• GCP Cloud Asset Inventory: vpcaccess.googleapis.com/Connector

• Providers: AWS, GCP

• Metadata keys: api_type (str), create_time (null), description (null), folders (list), gcp_asset_type (str), kind (str), location (str), network (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), project (str), project_id (str), project_number (str), revision (null), security_groups (list), service (str), state (null), status (null | str), subnet_ids (list), target_arns (list), version (str), vpc_config (object), vpc_link_id (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO
• Edges out:
  ATTACHED_TO → VPC
ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO → LOAD_BALANCER
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
REFERENCES / DEPENDS_ON ← APP_SERVICE
ROUTE / TRANSIT_ROUTED ← CONTAINER_SERVICE

CUSTOM_DOMAIN

Catalog entries that classify native resources as this type:

• AWS ARN: apigateway:domainnames
• AWS CloudFormation (Cloud Control): AWS::ApiGateway::DomainName, AWS::ApiGatewayV2::DomainName
• Azure ARM: microsoft.cdn/profiles/customdomains

• GCP Cloud Asset Inventory: run.googleapis.com/DomainMapping

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: api_mappings (list), distribution_domain_name (str), endpoint_types (list), mutual_tls (bool), private (bool), regional_domain_name (str), security_policy (null), status (null | str)
• Carries aliases: yes
• Declared relations: REFERENCES / CERTIFICATE_SECURES, ROUTE / SERVES_TRAFFIC_TO
• Edges out:
  REFERENCES / CERTIFICATE_SECURES → CERTIFICATE
ROUTE / SERVES_TRAFFIC_TO → API_GATEWAY
• Edges in:
  ROUTE / DNS_RESOLVED ← DNS_RECORD

DNS_RESOLVER

Catalog entries that classify native resources as this type:

• AWS ARN: route53resolver:resolver-endpoint, route53resolver:resolver-rule
• AWS CloudFormation (Cloud Control): AWS::Route53Resolver::ResolverEndpoint, AWS::Route53Resolver::ResolverRule
• Azure ARM: microsoft.network/dnsresolvers

• GCP Cloud Asset Inventory: dns.googleapis.com/Policy, dns.googleapis.com/ResponsePolicy

• Providers: AWS

• Metadata keys: associated_vpcs (list), direction (str), domain_name (str), endpoint_type (null), ip_addresses (list), ip_count (int), outpost_arn (null), owner_id (str), protocols (list), resolver_endpoint_id (null | str), resource_kind (str), rule_type (str), security_groups (list), share_status (str), shared_from_other_account (bool), status (null | str), target_ips (list), vpc_id (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO / DNS_RESOLVED, CONTAINS ←, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, ROUTE / DNS_RESOLVED
• Edges out:
  ATTACHED_TO / DNS_RESOLVED → VPC
ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
ROUTE / DNS_RESOLVED → DNS_RESOLVER
• Edges in:
  CONTAINS ← VPC
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
ROUTE / DNS_RESOLVED ← DNS_RESOLVER

GLOBAL_ACCELERATOR

Catalog entries that classify native resources as this type:

• AWS ARN: globalaccelerator

• AWS CloudFormation (Cloud Control): AWS::GlobalAccelerator::Accelerator

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: accelerator_type (str), dns_name (str), dual_stack_dns_name (null), enabled (bool), endpoint_groups (list), endpoints (list), ip_address_type (null), ip_addresses (list), listeners (list), status (str)
• Carries aliases: yes
• Declared relations: LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO
• Edges out:
  LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO → LOAD_BALANCER

SERVICE_NETWORK

VPC Lattice, Cloud WAN, NCC hub.

Catalog entries that classify native resources as this type:

• AWS ARN: networkmanager, vpc-lattice:servicenetwork
• AWS CloudFormation (Cloud Control): AWS::NetworkManager::CoreNetwork, AWS::VpcLattice::ServiceNetwork
• Azure ARM: microsoft.network/networkmanagers, microsoft.network/virtualwans

• GCP Cloud Asset Inventory: networkconnectivity.googleapis.com/Hub

• Providers: AWS

• Metadata keys: associated_vpcs (list), auth_policy_public (bool), auth_policy_state (null), auth_type (str), description (str), global_network_id (str), network_attachments (list), owner_account (str), registered_transit_gateways (list), resource_kind (str), segments (list), services (list), state (str), unauthenticated (bool)
• Carries aliases: yes
• Declared relations: ATTACHED_TO, CONTAINS, CONTAINS ←
• Edges out:
  ATTACHED_TO → VPC
CONTAINS → ENDPOINT_SERVICE, SERVICE_NETWORK
• Edges in:
  CONTAINS ← SERVICE_NETWORK