Images, snapshots, backups

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

MACHINE_IMAGE

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:image
• AWS CloudFormation (Cloud Control): AWS::EC2::Image
• Azure ARM: microsoft.compute/galleries/images, microsoft.compute/galleries/images/versions, microsoft.compute/images

• GCP Cloud Asset Inventory: compute.googleapis.com/Image, compute.googleapis.com/MachineImage

• Providers: AWS

• Metadata keys: architecture (str), created (str), deprecation_time (null), encrypted (bool), image_id (str), imds_support (null), last_launched (null), platform (str), public (bool), root_device_type (str), shared_accounts (list), shared_organizations (list), sharing_known (bool), snapshots (list), source_image_id (null), state (str)
• Carries aliases: yes
• Declared relations: GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ←, REFERENCES, REFERENCES / DEPENDS_ON
• Edges out:
  REFERENCES / DEPENDS_ON → SNAPSHOT
• Edges in:
  GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ← CLOUD_ACCOUNT

SNAPSHOT

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:snapshot, rds:cluster-snapshot, rds:snapshot
• AWS CloudFormation (Cloud Control): AWS::EC2::Snapshot
• Azure ARM: microsoft.compute/snapshots

• GCP Cloud Asset Inventory: compute.googleapis.com/Snapshot, file.googleapis.com/Backup, pubsub.googleapis.com/Snapshot

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: created (str), description (null | str), encrypted (bool), engine (str), engine_version (str), kms_key_id (null | str), public (bool), shared_accounts (list), sharing_known (bool), size_gb (int), snapshot_id (str), snapshot_type (str), source_identifier (str), source_volume_id (str), started (str), state (str), status (str), storage_tier (str), vpc_id (null)
• Carries aliases: yes
• Declared relations: GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ←, REFERENCES, REFERENCES / ENCRYPTED_BY_KMS
• Edges out:
  REFERENCES → AURORA_CLUSTER, EBS_VOLUME, RDS_INSTANCE
• Edges in:
  GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ← CLOUD_ACCOUNT
REFERENCES / DEPENDS_ON ← MACHINE_IMAGE

BACKUP_PLAN

Catalog entries that classify native resources as this type:

• AWS ARN: backup:backup-plan
• AWS CloudFormation (Cloud Control): AWS::Backup::BackupPlan

• GCP Cloud Asset Inventory: compute.googleapis.com/ResourcePolicy

• Providers: AWS

• Metadata keys: advanced_settings (list), last_execution (null), plan_id (str), rules (list), selections (list), service (str), version_id (null | str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, MANAGES / BACKUP_TO, REFERENCES / BACKUP_TO
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
MANAGES / BACKUP_TO → DYNAMODB_TABLE
REFERENCES / BACKUP_TO → BACKUP_VAULT, CLOUD_ACCOUNT

BACKUP_VAULT

Catalog entries that classify native resources as this type:

• AWS ARN: backup:backup-vault
• AWS CloudFormation (Cloud Control): AWS::Backup::BackupVault

• Azure ARM: microsoft.dataprotection/backupvaults, microsoft.recoveryservices/vaults

• Providers: AWS

• Metadata keys: has_access_policy (bool), kms_key_id (null | str), lock_date (null), locked (bool), max_retention_days (null), min_retention_days (null), policy_allows_public (bool), protected_resource_types (list), protected_resources (int), recovery_points (int | null), service (str), state (null), vault_type (null)
• Declared relations: GRANTS_ACCESS / POLICY_ALLOWS_ACTION ←, REFERENCES / BACKUP_TO ←, REFERENCES / ENCRYPTED_BY_KMS
• Edges out:
  REFERENCES / ENCRYPTED_BY_KMS → KMS_KEY
• Edges in:
  GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← CLOUD_ACCOUNT
REFERENCES / BACKUP_TO ← BACKUP_PLAN, DYNAMODB_TABLE