Identity federation and access

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

PERMISSION_SET

IAM Identity Center.

Catalog entries that classify native resources as this type:

• AWS ARN: sso:permissionSet

• AWS CloudFormation (Cloud Control): AWS::SSO::PermissionSet

• Providers: AWS

• Metadata keys: accept_role_session_name (null), assignment_count (int), created (str), customer_managed_policies (list), description (null), duration_seconds (null), enabled (bool), has_inline_policy (bool), has_session_policy (bool), instance_arn (str), is_admin (bool), managed_policies (list), managed_policy_arns (list), permissions_boundary (null), principal_count (int), profile_id (str), profile_type (str), provisioned_accounts (list), provisioned_role_path (str), provisioned_role_prefix (str), require_instance_properties (null), role_arns (list), session_duration (int)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / ROLE_ASSUMES_ROLE, ASSUMES_ROLE / ROLE_ASSUMES_ROLE ←, CONTAINS ←, IAM_POLICY_ATTACHMENT / ROLE_HAS_POLICY, IAM_TRUST / ROLE_ASSUMES_ROLE ←, MANAGES / OWNED_BY
• Edges out:
  ASSUMES_ROLE / ROLE_ASSUMES_ROLE → IAM_ROLE
MANAGES / OWNED_BY → CLOUD_ACCOUNT, IAM_ROLE
• Edges in:
  ASSUMES_ROLE / ROLE_ASSUMES_ROLE ← IDENTITY_GROUP
CONTAINS ← IDENTITY_PROVIDER
IAM_TRUST / ROLE_ASSUMES_ROLE ← IDENTITY_PROVIDER

IDENTITY_USER

Identity Center / Entra / workforce user.

• Providers: AWS, AZURE, GCP
• Also discovered via: entra-principal-reference, iam_policy
• Metadata keys: assigned_accounts (list), discovered_via (str), display_name (str), external_issuers (list), has_session_policy (bool), home_directory (str), home_directory_type (null), identity_store_id (str), member (str), placeholder (bool), principal_id (str), principal_type (str), server_id (str), service (str), ssh_key_count (int), user_id (str), user_name (str), user_type (null)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS ←, REFERENCES / READS_FROM
• Edges out:
  ASSUMES_ROLE / ROLE_ASSUMES_ROLE → SERVICE_PRINCIPAL
ASSUMES_ROLE / RUNS_ON → IAM_ROLE
GRANTS_ACCESS / POLICY_ALLOWS_ACTION → CLOUD_ACCOUNT
REFERENCES / READS_FROM → S3_BUCKET
• Edges in:
  CONTAINS ← DATA_TRANSFER, IDENTITY_GROUP, IDENTITY_PROVIDER

IDENTITY_GROUP

• Providers: AWS, GCP
• Also discovered via: iam_policy
• Metadata keys: assigned_accounts (list), description (null), discovered_via (str), external_issuers (list), group_id (str), identity_store_id (str), member (str), member_count (int), placeholder (bool), principal_type (str)
• Carries aliases: yes
• Declared relations: CONTAINS ←, GRANTS_ACCESS / POLICY_ALLOWS_ACTION
• Edges out:
  ASSUMES_ROLE / ROLE_ASSUMES_ROLE → PERMISSION_SET
CONTAINS → IDENTITY_USER
GRANTS_ACCESS / POLICY_ALLOWS_ACTION → CLOUD_ACCOUNT
• Edges in:
  CONTAINS ← IDENTITY_PROVIDER

ACCESS_KEY

IAM access key, service account key.

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: apikeys.googleapis.com/Key, iam.googleapis.com/ServiceAccountKey

• Providers: AWS

• Metadata keys: access_key_id (str), age_days (int), created (str), last_used (null), last_used_region (str), last_used_service (str), never_used (bool), stale (bool), status (str), user_arn (str), user_name (str)
• Declared relations: CONTAINS ←
• Edges in:
  CONTAINS ← IAM_USER

USER_POOL

Cognito user pool, B2C.

Catalog entries that classify native resources as this type:

• AWS ARN: cognito-idp:userpool

• AWS CloudFormation (Cloud Control): AWS::Cognito::UserPool

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: advanced_security (null), app_client_count (int), created (str), custom_domain (null), deletion_protection (null), domain (null), estimated_users (int), identity_providers (list), lambda_triggers (object), mfa (str), self_signup_enabled (bool), status (null), tier (null), user_pool_id (str)
• Carries aliases: yes
• Declared relations: INVOKES / INVOKES
• Edges out:
  INVOKES / INVOKES → LAMBDA_FUNCTION
• Edges in:
  REFERENCES / DEPENDS_ON ← IDENTITY_POOL

IDENTITY_POOL

Catalog entries that classify native resources as this type:

• AWS ARN: cognito-identity:identitypool

• AWS CloudFormation (Cloud Control): AWS::Cognito::IdentityPool

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: allow_classic_flow (null), allow_unauthenticated (bool), authenticated_role (null | str), cognito_providers (list), developer_provider (null), identity_pool_id (str), login_providers (list), unauthenticated_role (null | str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / ROLE_ASSUMES_ROLE, REFERENCES / DEPENDS_ON
• Edges out:
  ASSUMES_ROLE / ROLE_ASSUMES_ROLE → IAM_ROLE
REFERENCES / DEPENDS_ON → USER_POOL

RESOURCE_SHARE

AWS RAM.

Catalog entries that classify native resources as this type:

• AWS ARN: ram:resource-share

• AWS CloudFormation (Cloud Control): AWS::RAM::ResourceShare

• Providers: AWS

• Also discovered via: ram-incoming
• Metadata keys: allow_external_principals (bool | null), created (null), direction (str), discovered_via (str), external_principals (bool), feature_set (null), owning_account_id (str), principals (list), resource_count (int), resource_types (list), status (str)
• Declared relations: GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ←, GRANTS_ACCESS / DEPENDS_ON, MANAGES / OWNED_BY ←
• Edges out:
  GRANTS_ACCESS / DEPENDS_ON → CLOUD_ACCOUNT, SUBNET
• Edges in:
  GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ← CLOUD_ACCOUNT, ORG_UNIT
MANAGES / OWNED_BY ← CLOUD_ACCOUNT