Organization / governance

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

ORGANIZATION

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: cloudresourcemanager.googleapis.com/Organization

• Providers: AWS, GCP

• Metadata keys: control_tower (bool), create_time (null), delegated_administrators (object), description (null), directory_customer_id_present (bool), display_name (str), enabled_services (list), feature_set (str), folders (list), gcp_asset_type (str), location (str), management_account_id (str), network_tags (list), organization (str), organization_id (str), parent_asset_type (null), parent_full_resource_name (str), project (null), project_id (null), project_number (null), state (null)
• Carries aliases: yes
• Declared relations: MANAGES / OWNED_BY ←
• Edges out:
  CONTAINS → ORG_UNIT
CONTAINS / ORG_CONTAINS_ACCOUNT → CLOUD_ACCOUNT, ORG_UNIT
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT
MANAGES / COMPLIANCE_GOVERNS ← LANDING_ZONE
MANAGES / OWNED_BY ← CLOUD_ACCOUNT

ORG_UNIT

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.management/managementgroups

• GCP Cloud Asset Inventory: cloudresourcemanager.googleapis.com/Folder

• Providers: AWS, AZURE, GCP

• Metadata keys: alz_archetype (str), ancestors (list), create_time (null), description (null), display_name (str), folders (list), gcp_asset_type (str), is_root (bool), is_tenant_root (bool), landing_zone (bool), location (str), management_group_id (str), network_tags (list), organization (str), ou_id (str), parent_asset_type (null), parent_full_resource_name (str), parent_management_group (str), path (list), project (null), project_id (null), project_number (null), resource_type (str), state (null), tenant_id (str)
• Carries aliases: yes
• Declared relations: CONTAINS ←, CONTAINS / ORG_CONTAINS_ACCOUNT ←
• Edges out:
  CONTAINS → ORG_UNIT
CONTAINS / ORG_CONTAINS_ACCOUNT → CLOUD_ACCOUNT, ORG_UNIT
GRANTS_ACCESS / CROSS_ACCOUNT_TRUST → RESOURCE_SHARE
• Edges in:
  CONTAINS ← ORGANIZATION, ORG_UNIT
CONTAINS / ORG_CONTAINS_ACCOUNT ← ORGANIZATION, ORG_UNIT
GOVERNS / COMPLIANCE_GOVERNS ← GUARDRAIL, ORG_POLICY
GOVERNS / SCP_RESTRICTS ← ORG_POLICY

CLOUD_ACCOUNT

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.resources/subscriptions

• GCP Cloud Asset Inventory: cloudresourcemanager.googleapis.com/Project

• Providers: AWS, AZURE, GCP

• Also discovered via: azure-subscription, collection scope, cross-account reference
• Metadata keys: account_id (str), control_tower_role (null | str), create_time (null), delegated_admin_for (list), description (null), discovered_via (str), display_name (null | str), email (str), external (bool), folders (list), gcp_asset_type (str), joined (str), joined_method (str), lifecycle_state (str), location (str), management_account (bool), management_group_path (list), network_tags (list), organization (str), ou_path (list), parent_asset_type (null), parent_full_resource_name (str), parent_management_group (str), project (str), project_id (str), project_number (str), resource_type (str), state (null | str), status (str), subscription_id (str), tenant_id (null | str)
• Carries aliases: yes
• Declared relations: CONTAINS / ORG_CONTAINS_ACCOUNT ←
• Edges out:
  CONTAINS → AUTOSCALING_GROUP, CERTIFICATE, CLOUD_SQL, CONTAINER_REGISTRY, CONTAINER_SERVICE, DATA_WAREHOUSE, EBS_VOLUME, ELASTIC_IP, GCE_INSTANCE, GCS_BUCKET, GKE_CLUSTER, KMS_KEY, LOAD_BALANCER, LOG_SINK, MESSAGE_QUEUE, NODE_GROUP, NOTIFICATION_TOPIC, ORGANIZATION, ORG_POLICY, SECRET, SECURITY_GROUP, SERVICE_PRINCIPAL, SUBNET, TARGET_GROUP, VPC, VPC_LINK, WAF_WEB_ACL
CONTAINS / ACCOUNT_CONTAINS_REGION → RESOURCE_GROUP
GRANTS_ACCESS / CROSS_ACCOUNT_TRUST → DYNAMODB_TABLE, KMS_KEY, MACHINE_IMAGE, RESOURCE_SHARE, SECRET, SNAPSHOT
GRANTS_ACCESS / POLICY_ALLOWS_ACTION → BACKUP_VAULT, DATA_CATALOG, ENDPOINT_SERVICE, LOG_SINK, MESSAGE_BROKER, RUNBOOK
IAM_TRUST → IAM_ROLE
IAM_TRUST / CROSS_ACCOUNT_TRUST → IAM_ROLE
MANAGES / OWNED_BY → ORGANIZATION, RESOURCE_SHARE
ROUTE / SERVES_TRAFFIC_TO → ENDPOINT_SERVICE
• Edges in:
  ASSUMES_ROLE / RUNS_ON ← CI_PIPELINE
CONTAINS / ORG_CONTAINS_ACCOUNT ← ORGANIZATION, ORG_UNIT
GOVERNS / COMPLIANCE_GOVERNS ← GUARDRAIL, ORG_POLICY
GOVERNS / SCP_RESTRICTS ← ORG_POLICY
GRANTS_ACCESS / DEPENDS_ON ← RESOURCE_SHARE
GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← IDENTITY_GROUP, IDENTITY_USER, SERVICE_PRINCIPAL
INVOKES / STREAMS_TO ← LOG_SINK
MANAGES / OWNED_BY ← LANDING_ZONE, PERMISSION_SET, PROVISIONED_PRODUCT, STACK_SET
MONITORS / MONITORED_BY ← DATA_SECURITY_SCANNER, THREAT_DETECTOR
PEERING / TRANSIT_ROUTED ← PEERING_CONNECTION
PEERING / VPC_PEERED ← VNET
REFERENCES ← KMS_KEY, VPC
REFERENCES / BACKUP_TO ← BACKUP_PLAN
REFERENCES / DEPENDS_ON ← IDENTITY_PROVIDER
ROUTE / TRANSIT_ROUTED ← DIRECT_CONNECT

ORG_POLICY

SCP, RCP, tag/backup policy.

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: orgpolicy.googleapis.com/Policy

• Providers: AWS, GCP

• Metadata keys: attached_to (str), aws_managed (bool), constraint (str), create_time (null), description (null), dry_run (bool), enforced (bool), folders (list), gcp_asset_type (str), location (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), policy_id (str), policy_type (str), project (str), project_id (str), project_number (str), rules (list), state (null), target_count (int)
• Carries aliases: yes
• Declared relations: GOVERNS / COMPLIANCE_GOVERNS, GOVERNS / SCP_RESTRICTS
• Edges out:
  GOVERNS / COMPLIANCE_GOVERNS → CLOUD_ACCOUNT, ORG_UNIT
GOVERNS / SCP_RESTRICTS → CLOUD_ACCOUNT, ORG_UNIT
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT

LANDING_ZONE

• Providers: AWS
• Metadata keys: drift_status (null), governed_regions (list), home_region (str), latest_available_version (null), shared_accounts (object), status (str), version (str)
• Declared relations: MANAGES / COMPLIANCE_GOVERNS, MANAGES / OWNED_BY
• Edges out:
  MANAGES / COMPLIANCE_GOVERNS → ORGANIZATION
MANAGES / OWNED_BY → CLOUD_ACCOUNT

GUARDRAIL

Control Tower control / baseline, policy assignment, perimeter.

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.authorization/policyassignments, microsoft.authorization/policyexemptions

• GCP Cloud Asset Inventory: accesscontextmanager.googleapis.com/ServicePerimeter

• Providers: AWS, AZURE, GCP

• Metadata keys: access_levels (list), access_policy (str), assignment_identity (str), control_identifier (str), drift_status (null), dry_run_restricted_services (list), egress_policy_count (int), enforced (bool), enforcement_mode (str), exemption (bool), exemption_category (str), gcp_asset_type (str), guardrail_kind (str), ingress_policy_count (int), initiative (bool), kind (str), member_count (int), not_scopes (list), perimeter_type (str), policy_assignment_id (str), policy_definition_id (str), resource_type (str), restricted_services (list), scope (str), status (str), title (str), uses_dry_run_spec (bool), vpc_accessible_services_restricted (bool), vpc_allowed_services (list)
• Carries aliases: yes
• Declared relations: GOVERNS / COMPLIANCE_GOVERNS, REFERENCES / DEPENDS_ON
• Edges out:
  GOVERNS / COMPLIANCE_GOVERNS → CLOUD_ACCOUNT, ORG_UNIT, RESOURCE_GROUP
REFERENCES → RESOURCE_GROUP
REFERENCES / DEPENDS_ON → GUARDRAIL
• Edges in:
  REFERENCES / DEPENDS_ON ← GUARDRAIL

RESOURCE_GROUP

Azure resource group.

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.resources/resourcegroups, microsoft.resources/subscriptions/resourcegroups

• Providers: AZURE

• Also discovered via: arm-sweep
• Metadata keys: collected_via (str), discovered_via (str), kind (null), managed_by (str), properties (object), resource_group (str), resource_type (str), sku (null)
• Declared relations: CONTAINS / ACCOUNT_CONTAINS_REGION ←, MANAGES / OWNED_BY ←
• Edges out:
  CONTAINS → AKS_CLUSTER, APP_SERVICE, AUTOSCALING_GROUP, AZURE_SQL, BLOB_STORAGE, CLOUD_FUNCTION, CONTAINER_REGISTRY, EBS_VOLUME, ELASTIC_IP, KEY_VAULT, KMS_KEY, LOAD_BALANCER, LOG_GROUP, NETWORK_FIREWALL, NETWORK_INTERFACE, NSG, ROUTE_TABLE, SECURITY_GROUP, SERVICE_PRINCIPAL, VIRTUAL_MACHINE, VNET, VPC_ENDPOINT, WAF_WEB_ACL
• Edges in:
  CONTAINS / ACCOUNT_CONTAINS_REGION ← CLOUD_ACCOUNT
GOVERNS / COMPLIANCE_GOVERNS ← GUARDRAIL
MANAGES / OWNED_BY ← AKS_CLUSTER
REFERENCES ← GUARDRAIL