Networking

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

VPC

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:vpc

• GCP Cloud Asset Inventory: compute.googleapis.com/Network

• Providers: AWS, GCP

• Metadata keys: cidr_block (str), create_time (null), description (null), folders (list), gcp_asset_type (str), is_default (bool), location (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), project (str), project_id (str), project_number (str), state (null | str), vpc_id (str)
• Carries aliases: yes
• Declared relations: REFERENCES
• Edges out:
  CONTAINS → DNS_RESOLVER, SUBNET
CONTAINS / VPC_CONTAINS_SUBNET → SUBNET
LOGS_TO / LOGS_TO → LOG_SINK
PEERING / VPC_PEERED → PEERING_CONNECTION
REFERENCES → CLOUD_ACCOUNT
• Edges in:
  ATTACHED_TO ← ACCESS_POINT, CLOUD_SQL, INTERNET_GATEWAY, SECURITY_GROUP, SERVICE_NETWORK, VPC_LINK, VPN_GATEWAY
ATTACHED_TO / DNS_RESOLVED ← DNS_RESOLVER
CONTAINS ← CLOUD_ACCOUNT
MONITORS / MONITORED_BY ← FLOW_LOG
PEERING / VPC_PEERED ← PEERING_CONNECTION
PROTECTS / PROTECTED_BY_NACL ← NETWORK_FIREWALL
REFERENCES ← EC2, GCE_INSTANCE, GKE_CLUSTER, LOAD_BALANCER, NACL, ROUTE_TABLE, SECURITY_GROUP, SUBNET, TARGET_GROUP
ROUTE / TRANSIT_ROUTED ← ROUTE_TABLE, TRANSIT_GATEWAY

VNET

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.network/virtualnetworks

• Providers: AZURE

• Metadata keys: address_space (list), collected_via (str), kind (null), properties (object), resource_group (str), resource_type (str), sku (null), subnet_ids (list)
• Declared relations: CONTAINS ←, PEERING / VPC_PEERED
• Edges out:
  CONTAINS / VPC_CONTAINS_SUBNET → SUBNET
PEERING / VPC_PEERED → CLOUD_ACCOUNT, VNET
• Edges in:
  CONTAINS ← RESOURCE_GROUP
PEERING / VPC_PEERED ← VNET

SUBNET

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:subnet
• Azure ARM: microsoft.network/virtualnetworks/subnets

• GCP Cloud Asset Inventory: compute.googleapis.com/Subnetwork

• Providers: AWS, AZURE, GCP

• Metadata keys: address_prefix (str), address_prefixes (list), availability_zone (str), cidr_block (str), collected_via (str), create_time (null), delegations (list), description (null), flow_logs_enabled (bool), folders (list), gcp_asset_type (str), ip_cidr_range (str), kind (null), location (str), map_public_ip (bool), nat_gateway (null), network (str), network_tags (list), nsg_id (null | str), organization (str), parent_asset_type (null), parent_full_resource_name (str), parent_resource (str), private_endpoint_ids (list), private_endpoint_network_policies (null), project (str), project_id (str), project_number (str), properties (object), resource_group (str), resource_type (str), route_table (null | str), secondary_ranges (list), service_endpoints (list), sku (null), state (null), subnet_id (str), vnet_id (str), vpc_id (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO ←, CONTAINS / VPC_CONTAINS_SUBNET ←
• Edges out:
  ATTACHED_TO / PROTECTED_BY_SG → NSG
CONTAINS / SUBNET_CONTAINS_INSTANCE → APP_SERVICE, BIG_DATA_CLUSTER, CACHE_CLUSTER, CONTAINER_SERVICE, DATABASE_PROXY, DATA_CATALOG, DATA_WAREHOUSE, DNS_RESOLVER, EC2, EKS_CLUSTER, FARGATE_PROFILE, FILE_SYSTEM, GCE_INSTANCE, GKE_CLUSTER, LOAD_BALANCER, MESSAGE_BROKER, ML_MODEL, ML_WORKSPACE, NAT_GATEWAY, NETWORK_FIREWALL, NETWORK_INTERFACE, NODE_GROUP, RDS_INSTANCE, VPC_ENDPOINT, VPC_LINK
GRANTS_ACCESS / POLICY_ALLOWS_ACTION → KEY_VAULT
REFERENCES → VPC
• Edges in:
  ATTACHED_TO ← APP_SERVICE, ROUTE_TABLE
CONTAINS ← CLOUD_ACCOUNT, VPC
CONTAINS / VPC_CONTAINS_SUBNET ← VNET, VPC
GRANTS_ACCESS / DEPENDS_ON ← RESOURCE_SHARE
REFERENCES ← AKS_CLUSTER, NACL

SECURITY_GROUP

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:security-group
• Azure ARM: microsoft.network/applicationsecuritygroups

• GCP Cloud Asset Inventory: compute.googleapis.com/Firewall, compute.googleapis.com/FirewallPolicy, compute.googleapis.com/NetworkFirewallPolicy, compute.googleapis.com/RegionNetworkFirewallPolicy

• Providers: AWS, AZURE, GCP

• Metadata keys: action (str), allows_internet_ingress (bool), collected_via (str), create_time (null), description (null | str), direction (str), disabled (bool), egress_rules (list), folders (list), gcp_asset_type (str), group_id (str), ingress_rules (list), internet_source (bool), kind (null), location (str), logging_enabled (bool), network (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), priority (int), project (str), project_id (str), project_number (str), properties (object), resource_group (str), resource_type (str), sku (null), source_ranges (list), state (null), target_service_accounts (list), target_tags (list), vpc_id (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO, CONTAINS ←
• Edges out:
  ATTACHED_TO → VPC
REFERENCES → SECURITY_GROUP, VPC
• Edges in:
  ATTACHED_TO / PROTECTED_BY_SG ← BIG_DATA_CLUSTER, CACHE_CLUSTER, CONTAINER_SERVICE, DATABASE_PROXY, DATA_CATALOG, DATA_WAREHOUSE, DNS_RESOLVER, EC2, EKS_CLUSTER, GCE_INSTANCE, LAUNCH_TEMPLATE, LOAD_BALANCER, MESSAGE_BROKER, ML_MODEL, ML_WORKSPACE, NETWORK_INTERFACE, RDS_INSTANCE, VPC_LINK
CONTAINS ← CLOUD_ACCOUNT, RESOURCE_GROUP
MANAGES ← IAC_STACK
REFERENCES ← SECURITY_GROUP

NSG

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.network/networksecuritygroups

• Providers: AZURE

• Metadata keys: collected_via (str), egress_rules (list), ingress_rules (list), kind (null), network_interface_ids (list), properties (object), resource_group (str), resource_type (str), sku (null), subnet_ids (list)
• Declared relations: CONTAINS ←
• Edges in:
  ATTACHED_TO / PROTECTED_BY_SG ← NETWORK_INTERFACE, SUBNET
CONTAINS ← RESOURCE_GROUP

NACL

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:network-acl

• Providers: AWS

• Metadata keys: associations (list), entries (list), is_default (bool), network_acl_id (str), vpc_id (str)
• Edges out:
  REFERENCES → SUBNET, VPC

ROUTE_TABLE

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:route-table, ec2:transit-gateway-route-table
• AWS CloudFormation (Cloud Control): AWS::EC2::TransitGatewayRouteTable
• Azure ARM: microsoft.network/routetables

• GCP Cloud Asset Inventory: compute.googleapis.com/Route

• Providers: AWS, AZURE

• Metadata keys: associated_attachments (list), associations (list), bgp_route_propagation_disabled (null), collected_via (str), default_association (bool), default_propagation (bool), kind (null), propagating_attachments (list), properties (object), resource_group (str), resource_kind (str), resource_type (str), route_table_id (str), routes (list), sku (null), state (str), subnet_ids (list), tgw_id (str), tgw_route_table_id (str), tgw_routes (list), tgw_routes_truncated (bool), vpc_id (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO, CONTAINS ←, ROUTE / TRANSIT_ROUTED
• Edges out:
  ATTACHED_TO → SUBNET
REFERENCES → PEERING_CONNECTION, VPC
ROUTE / TRANSIT_ROUTED → INTERNET_GATEWAY, NETWORK_FIREWALL, VPC
• Edges in:
  CONTAINS ← RESOURCE_GROUP, TRANSIT_GATEWAY

INTERNET_GATEWAY

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:egress-only-internet-gateway, ec2:internet-gateway

• AWS CloudFormation (Cloud Control): AWS::EC2::EgressOnlyInternetGateway

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: attached_vpcs (list), attachments (list), egress_only (bool), internet_gateway_id (str), ip_version (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO
• Edges out:
  ATTACHED_TO → VPC
• Edges in:
  ROUTE / TRANSIT_ROUTED ← ROUTE_TABLE

NAT_GATEWAY

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:natgateway

• Azure ARM: microsoft.network/natgateways

• Providers: AWS

• Metadata keys: connectivity_type (null), nat_gateway_id (str), state (str), subnet_id (str), vpc_id (str)
• Edges in:
  CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET

LOAD_BALANCER

Catalog entries that classify native resources as this type:

• AWS ARN: elasticloadbalancing:loadbalancer
• Azure ARM: microsoft.network/applicationgateways, microsoft.network/loadbalancers, microsoft.network/trafficmanagerprofiles

• GCP Cloud Asset Inventory: compute.googleapis.com/BackendBucket, compute.googleapis.com/BackendService, compute.googleapis.com/ForwardingRule, compute.googleapis.com/GlobalForwardingRule, compute.googleapis.com/RegionBackendService, compute.googleapis.com/RegionTargetHttpProxy, compute.googleapis.com/RegionTargetHttpsProxy, compute.googleapis.com/RegionTargetTcpProxy, compute.googleapis.com/RegionUrlMap, compute.googleapis.com/TargetGrpcProxy, compute.googleapis.com/TargetHttpProxy, compute.googleapis.com/TargetHttpsProxy, compute.googleapis.com/TargetSslProxy, compute.googleapis.com/TargetTcpProxy, compute.googleapis.com/UrlMap

• Providers: AWS, AZURE, GCP

• Also discovered via: tagging-api
• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: backend_addresses (list), backend_network_interfaces (list), cdn_enabled (bool), collected_via (str), create_time (null), deletion_protection (bool), description (null), discovered_via (str), dns_name (str), drops_invalid_headers (bool), folders (list), frontend_public_ip_ids (list), gcp_asset_type (str), hosts (list), iap_enabled (bool), ip_address (str), ip_protocol (str), kind (null), listeners (list), load_balancing_scheme (str), location (str), logging_enabled (bool), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), ports (list), project (str), project_id (str), project_number (str), properties (object), psc (bool), resource_group (str), resource_type (str), scheme (null | str), security_groups (list), security_policy (str), service (str), sku (null | str), state (null | str), type (str), vpc_id (str), waf_enabled (bool)
• Carries aliases: yes
• Declared relations: ATTACHED_TO ←, CONTAINS ←, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, LOAD_BALANCER_TARGET / LB_TARGETS_INSTANCE, LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO, PROTECTS / PROTECTED_BY_WAF ←, REFERENCES / CERTIFICATE_SECURES ←, ROUTE / SERVES_TRAFFIC_TO
• Edges out:
  ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
CONTAINS → LB_LISTENER
LOAD_BALANCER_TARGET / LB_TARGETS_INSTANCE → AUTOSCALING_GROUP, NETWORK_FIREWALL, NETWORK_INTERFACE, TARGET_GROUP
LOAD_BALANCER_TARGET / LOAD_BALANCED_BY → TARGET_GROUP
LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO → APP_SERVICE, GCS_BUCKET
REFERENCES → VPC
ROUTE / LOAD_BALANCED_BY → K8S_SERVICE
ROUTE / SERVES_TRAFFIC_TO → LOAD_BALANCER
• Edges in:
  ATTACHED_TO ← ELASTIC_IP
CONTAINS ← CLOUD_ACCOUNT, RESOURCE_GROUP
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO ← ENDPOINT_SERVICE, GLOBAL_ACCELERATOR, VPC_LINK
MANAGES ← APP_SERVICE
PROTECTS / PROTECTED_BY_WAF ← WAF_WEB_ACL
REFERENCES / CERTIFICATE_SECURES ← CERTIFICATE
ROUTE / DNS_RESOLVED ← DNS_RECORD
ROUTE / SERVES_TRAFFIC_TO ← CLOUDFRONT, LOAD_BALANCER

CLOUDFRONT

Catalog entries that classify native resources as this type:

• AWS ARN: cloudfront:distribution

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: cache_behaviors (list), cnames (list), comment (str), distribution_id (str), domain_name (str), edge_functions (list), enabled (bool), geo_restriction (str), http_version (str), ipv6 (bool), logging_bucket (null | str), logging_enabled (bool), origin_details (list), origin_groups (list), origins (list), price_class (str), realtime_log_config_arn (str), staging (null), status (str), viewer_certificate (object), viewer_protocol_policy (str), web_acl_id (str)
• Carries aliases: yes
• Declared relations: LOGS_TO / LOGS_TO, REFERENCES / CERTIFICATE_SECURES, ROUTE / SERVES_TRAFFIC_TO
• Edges out:
  LOGS_TO / LOGS_TO → S3_BUCKET
REFERENCES / CERTIFICATE_SECURES → CERTIFICATE
ROUTE / SERVES_TRAFFIC_TO → LOAD_BALANCER, S3_BUCKET
• Edges in:
  ROUTE / DNS_RESOLVED ← DNS_RECORD

CDN

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.cdn/profiles, microsoft.cdn/profiles/afdendpoints, microsoft.cdn/profiles/endpoints, microsoft.network/frontdoors

Not exercised by the fixtures. Produced by collectors or catalogs for resources the test estates do not contain; carries the common keys above plus collector-specific fields.

TRANSIT_GATEWAY

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:transit-gateway

• Azure ARM: microsoft.network/virtualhubs

• Providers: AWS

• Metadata keys: owner_id (str), state (str), transit_gateway_id (str)
• Edges out:
  CONTAINS → ROUTE_TABLE
PEERING / TRANSIT_ROUTED → PEERING_CONNECTION
ROUTE / TRANSIT_ROUTED → VPC
• Edges in:
  ROUTE / TRANSIT_ROUTED ← DIRECT_CONNECT

PEERING_CONNECTION

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:vpc-peering-connection

• GCP Cloud Asset Inventory: networkconnectivity.googleapis.com/Spoke

• Providers: AWS

• Metadata keys: accepter (object), accepter_vpc_id (str), cross_account (bool), cross_region (bool), dynamic_routing (null), peering_connection_id (str), requester (object), requester_vpc_id (str), resource_kind (str), state (str), status (null | str), tgw_attachment_id (str)
• Carries aliases: yes
• Declared relations: PEERING / TRANSIT_ROUTED, PEERING / TRANSIT_ROUTED ←
• Edges out:
  PEERING / TRANSIT_ROUTED → CLOUD_ACCOUNT
PEERING / VPC_PEERED → VPC
• Edges in:
  PEERING / TRANSIT_ROUTED ← TRANSIT_GATEWAY
PEERING / VPC_PEERED ← VPC
REFERENCES ← ROUTE_TABLE

ELASTIC_IP

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:elastic-ip
• Azure ARM: microsoft.network/publicipaddresses

• GCP Cloud Asset Inventory: compute.googleapis.com/Address, compute.googleapis.com/GlobalAddress

• Providers: AWS, AZURE, GCP

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: address (str), address_type (str), allocation_id (str), allocation_method (null), attached_instance_id (str), collected_via (str), create_time (null), description (null), folders (list), fqdn (null), gcp_asset_type (str), kind (null), location (str), network_interface_id (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), project (str), project_id (str), project_number (str), properties (object), public_ip (str), resource_group (str), resource_type (str), sku (null), state (null)
• Carries aliases: yes
• Declared relations: ATTACHED_TO, CONTAINS ←
• Edges out:
  ATTACHED_TO → LOAD_BALANCER, NETWORK_FIREWALL, NETWORK_INTERFACE
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT, RESOURCE_GROUP

NETWORK_INTERFACE

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:network-interface

• Azure ARM: microsoft.network/networkinterfaces

• Providers: AWS, AZURE

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: attached_instance_id (null | str), collected_via (str), description (str), interface_type (str), ip_forwarding (bool), kind (null), mac_address (null), network_interface_id (str), nsg_id (str), private_endpoint_id (null), private_ip (str), private_ips (list), properties (object), public_ip (null | str), public_ip_id (str), public_ip_ids (list), resource_group (str), resource_type (str), security_groups (list), sku (null), subnet_id (str), subnet_ids (list), vpc_id (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO ←, CONTAINS ←, LOAD_BALANCER_TARGET / LB_TARGETS_INSTANCE ←
• Edges out:
  ATTACHED_TO → EC2, VIRTUAL_MACHINE
ATTACHED_TO / PROTECTED_BY_SG → NSG, SECURITY_GROUP
• Edges in:
  ATTACHED_TO ← ELASTIC_IP
CONTAINS ← RESOURCE_GROUP
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
LOAD_BALANCER_TARGET / LB_TARGETS_INSTANCE ← LOAD_BALANCER