IAM

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

IAM_USER

Catalog entries that classify native resources as this type:

• AWS ARN: iam:user

• Providers: AWS

• Metadata keys: attached_policies (list), create_date (str), groups (list), inline_policies (list), is_admin (bool), password_last_used (str), user_id (str)
• Declared relations: CONTAINS ←
• Edges out:
  CONTAINS → ACCESS_KEY
GRANTS_ACCESS / POLICY_ALLOWS_ACTION → KMS_KEY
• Edges in:
  CONTAINS ← IAM_GROUP

IAM_ROLE

Catalog entries that classify native resources as this type:

• AWS ARN: iam:role

• GCP Cloud Asset Inventory: iam.googleapis.com/Role, rbac.authorization.k8s.io/ClusterRole, rbac.authorization.k8s.io/Role

• Providers: AWS

• Metadata keys: assume_role_policy (object), attached_policies (list), inline_policies (list), is_admin (bool), last_used (str), last_used_region (null), max_session_duration (int), path (str), publicly_assumable (bool), role_id (str), service_linked (bool), trusted_external_accounts (list), trusted_federated (list), trusted_services (list)
• Declared relations: GRANTS_ACCESS / POLICY_ALLOWS_ACTION, IAM_POLICY_ATTACHMENT / ROLE_HAS_POLICY, IAM_TRUST ←, IAM_TRUST / CROSS_ACCOUNT_TRUST ←, IAM_TRUST / ROLE_ASSUMES_ROLE ←
• Edges out:
  GRANTS_ACCESS / POLICY_ALLOWS_ACTION → DATA_CATALOG, MESSAGE_QUEUE, PRODUCT_PORTFOLIO, SEARCH_DOMAIN
IAM_POLICY_ATTACHMENT / ROLE_HAS_POLICY → IAM_POLICY
IAM_TRUST / CROSS_ACCOUNT_TRUST → IAM_ROLE
• Edges in:
  ASSUMES_ROLE / ROLE_ASSUMES_ROLE ← IDENTITY_POOL, PERMISSION_SET
ASSUMES_ROLE / RUNS_ON ← AI_AGENT, APP_SERVICE, BACKUP_PLAN, BATCH_ENVIRONMENT, BIG_DATA_CLUSTER, BUILD_PROJECT, CACHE_CLUSTER, CI_PIPELINE, DATABASE_PROXY, DATA_TRANSFER, DATA_WAREHOUSE, DELIVERY_STREAM, DEPLOYMENT_GROUP, EKS_CLUSTER, ETL_JOB, EVENT_PIPE, FARGATE_PROFILE, FLOW_LOG, IDENTITY_USER, INSTANCE_PROFILE, JOB_DEFINITION, K8S_SERVICE_ACCOUNT, KNOWLEDGE_BASE, LAMBDA_FUNCTION, LOG_SINK, ML_MODEL, ML_WORKSPACE, NODE_GROUP, PROVISIONED_PRODUCT, SCHEDULE, TASK_DEFINITION, VIRTUAL_MACHINE
IAM_TRUST ← CLOUD_ACCOUNT
IAM_TRUST / CROSS_ACCOUNT_TRUST ← CLOUD_ACCOUNT, IAM_ROLE
IAM_TRUST / ROLE_ASSUMES_ROLE ← IDENTITY_PROVIDER
MANAGES / OWNED_BY ← PERMISSION_SET

IAM_POLICY

Catalog entries that classify native resources as this type:

• AWS ARN: iam:policy

• GCP Cloud Asset Inventory: rbac.authorization.k8s.io/ClusterRoleBinding, rbac.authorization.k8s.io/RoleBinding

• Providers: AWS

• Metadata keys: attachment_count (int), default_version (str), grants_admin (bool), path (str), policy_id (null)
• Edges in:
  IAM_POLICY_ATTACHMENT / ROLE_HAS_POLICY ← IAM_ROLE

IAM_GROUP

Catalog entries that classify native resources as this type:

• AWS ARN: iam:group

• Providers: AWS

• Metadata keys: attached_policies (list), group_id (str), inline_policies (list), is_admin (bool)
• Edges out:
  CONTAINS → IAM_USER

SERVICE_PRINCIPAL

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.managedidentity/userassignedidentities

• GCP Cloud Asset Inventory: iam.googleapis.com/ServiceAccount

• Providers: AZURE, GCP

• Also discovered via: entra-principal-reference, iam_policy, workload_reference
• Metadata keys: client_id (null | str), collected_via (str), create_time (null), description (null), disabled (bool), discovered_via (str), email (str), folders (list), gcp_asset_type (str), google_managed (bool), home_project (str), kind (null), location (str), member (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), placeholder (bool), principal_id (str), principal_type (str), project (str), project_id (str), project_number (str), properties (object), resource_group (str), resource_type (str), sku (null), state (null), unique_id (str)
• Carries aliases: yes
• Declared relations: CONTAINS ←, GRANTS_ACCESS / POLICY_ALLOWS_ACTION
• Edges out:
  GRANTS_ACCESS / POLICY_ALLOWS_ACTION → CLOUD_ACCOUNT, CONTAINER_REGISTRY, KEY_VAULT
• Edges in:
  ASSUMES_ROLE / ROLE_ASSUMES_ROLE ← IDENTITY_USER, K8S_SERVICE_ACCOUNT
ASSUMES_ROLE / RUNS_ON ← AKS_CLUSTER, APP_SERVICE, CONTAINER_SERVICE, GCE_INSTANCE, GKE_CLUSTER, MESSAGE_QUEUE, NODE_GROUP
CONTAINS ← CLOUD_ACCOUNT, RESOURCE_GROUP