Platforms and data processing

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

MESSAGE_BROKER

MSK, Amazon MQ, Event Hubs Kafka, Managed Kafka.

Catalog entries that classify native resources as this type:

• AWS ARN: kafka:cluster, mq:broker
• AWS CloudFormation (Cloud Control): AWS::AmazonMQ::Broker, AWS::MSK::Cluster
• Azure ARM: microsoft.devices/iothubs

• GCP Cloud Asset Inventory: managedkafka.googleapis.com/Cluster

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: audit_logs (bool), auth_iam (bool), auth_scram (bool), auth_tls (bool), authentication_strategy (null), aws_owned_key (bool), broker_id (str), broker_nodes (int), cluster_type (str), configuration_arn (str), deployment_mode (str), encryption_in_transit (null), endpoints (list), engine (str), engine_version (str), general_logs (bool), instance_type (str), kafka_version (str), kms_key_id (null), ldap_hosts (list), policy_allows_public (bool), public_access (str), publicly_accessible (bool), security_groups (list), service (str), state (str), unauthenticated_access (bool), user_count (int)
• Carries aliases: yes
• Declared relations: CONTAINS / SUBNET_CONTAINS_INSTANCE ←, GRANTS_ACCESS / POLICY_ALLOWS_ACTION ←, LOGS_TO / LOGS_TO
• Edges out:
  ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
• Edges in:
  CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← CLOUD_ACCOUNT

BATCH_ENVIRONMENT

Catalog entries that classify native resources as this type:

• AWS ARN: batch:compute-environment
• AWS CloudFormation (Cloud Control): AWS::Batch::ComputeEnvironment

• Azure ARM: microsoft.batch/batchaccounts

• Providers: AWS

• Metadata keys: allocation_strategy (null), ec2_key_pair (null), image_id (null), instance_types (list), max_vcpus (null), orchestration (null), resource_type (null), service (str), state (null), status (str), type (str), vpc_config (null)
• Declared relations: ASSUMES_ROLE / RUNS_ON, MANAGES
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
• Edges in:
  REFERENCES / RUNS_ON ← JOB_QUEUE

JOB_QUEUE

Catalog entries that classify native resources as this type:

• AWS ARN: batch:job-queue

• AWS CloudFormation (Cloud Control): AWS::Batch::JobQueue

• Providers: AWS

• Metadata keys: priority (int), queue_type (null), service (str), state (str), status (str)
• Declared relations: REFERENCES / RUNS_ON
• Edges out:
  REFERENCES / RUNS_ON → BATCH_ENVIRONMENT

JOB_DEFINITION

Catalog entries that classify native resources as this type:

• AWS ARN: batch:job-definition
• AWS CloudFormation (Cloud Control): AWS::Batch::JobDefinition
• Azure ARM: microsoft.app/jobs

• GCP Cloud Asset Inventory: run.googleapis.com/Job

• Providers: AWS

• Metadata keys: active_revisions (int), containers (list), orchestration (null), parameter_names (list), platform_capabilities (list), revision (int), service (str), service_account (null), type (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, USES_IMAGE / RUNS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
USES_IMAGE / RUNS_ON → CONTAINER_REGISTRY

DATABASE_PROXY

Catalog entries that classify native resources as this type:

• AWS ARN: rds:db-proxy

• AWS CloudFormation (Cloud Control): AWS::RDS::DBProxy

• Providers: AWS

• Metadata keys: endpoint (str), engine_family (str), iam_auth (list), require_tls (null), security_groups (list), service (str), status (str), targets (list), vpc_id (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO, REFERENCES / READS_FROM
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO → RDS_INSTANCE
REFERENCES / READS_FROM → SECRET
• Edges in:
  CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET

DATA_CATALOG

Glue database/catalog, Purview.

Catalog entries that classify native resources as this type:

• AWS ARN: glue:database
• AWS CloudFormation (Cloud Control): AWS::Glue::Database
• Azure ARM: microsoft.purview/accounts

• GCP Cloud Asset Inventory: dataplex.googleapis.com/Lake

• Providers: AWS

• Metadata keys: admins (list), authentication_type (null), availability_zone (null), connection_password_encryption (bool), connection_type (null), data_location_grants (list), database_count (int), encryption_mode (str), enforce_ssl (null), external_data_filtering (bool | null), federated (null), hosts (list), iam_allowed_principals_default (bool), kind (str), kms_key_id (null), location (str), permission_count (int), permissions_capped (bool), read_only_admins (list), registered_locations (list), resource_link (bool), security_groups (list), service (str), status (str), table_count (int), table_count_capped (bool), trusted_resource_owners (list)
• Declared relations: CONTAINS ←, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, GOVERNS / COMPLIANCE_GOVERNS, GRANTS_ACCESS / POLICY_ALLOWS_ACTION ←, REFERENCES / DEPENDS_ON, REFERENCES / READS_FROM
• Edges out:
  ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
CONTAINS → DATA_CATALOG
GOVERNS / COMPLIANCE_GOVERNS → DATA_CATALOG
REFERENCES / DEPENDS_ON → S3_BUCKET
• Edges in:
  CONTAINS ← DATA_CATALOG
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
GOVERNS / COMPLIANCE_GOVERNS ← DATA_CATALOG
GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← CLOUD_ACCOUNT, IAM_ROLE
REFERENCES / DEPENDS_ON ← ETL_JOB
REFERENCES / WRITES_TO ← ETL_JOB

ETL_JOB

Glue job/crawler, Data Factory pipeline, Dataflow.

Catalog entries that classify native resources as this type:

• AWS ARN: glue:crawler, glue:job
• AWS CloudFormation (Cloud Control): AWS::Glue::Crawler, AWS::Glue::Job
• Azure ARM: microsoft.datafactory/factories, microsoft.streamanalytics/streamingjobs

• GCP Cloud Asset Inventory: composer.googleapis.com/Environment, dataflow.googleapis.com/Job, datafusion.googleapis.com/Instance

• Providers: AWS

• Metadata keys: command (str), connections (list), database (str), glue_version (null), kind (str), lake_formation_credentials (null), schedule (null), script_location (str), security_configuration (null), service (str), source_control (null), state (str), target_types (list), worker_type (null), workers (null)
• Declared relations: ASSUMES_ROLE / RUNS_ON, REFERENCES / DEPENDS_ON, REFERENCES / READS_FROM, REFERENCES / WRITES_TO
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
REFERENCES / DEPENDS_ON → DATA_CATALOG
REFERENCES / READS_FROM → S3_BUCKET
REFERENCES / WRITES_TO → DATA_CATALOG, S3_BUCKET
• Edges in:
  INVOKES / INVOKES ← EVENT_RULE

BIG_DATA_CLUSTER

EMR, Dataproc, HDInsight, Databricks.

Catalog entries that classify native resources as this type:

• AWS ARN: elasticmapreduce:cluster
• AWS CloudFormation (Cloud Control): AWS::EMR::Cluster
• Azure ARM: microsoft.databricks/workspaces, microsoft.hdinsight/clusters

• GCP Cloud Asset Inventory: dataproc.googleapis.com/Cluster

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: applications (list), cluster_id (str), kerberos (bool), key_name (null), kms_key_id (null), log_uri (str), master_public_dns (str), release_label (str), security_configuration (null), security_groups (list), service (str), state (str), termination_protected (bool)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, LOGS_TO / LOGS_TO
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
LOGS_TO / LOGS_TO → S3_BUCKET
• Edges in:
  CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET

QUERY_WORKGROUP

Athena.

Catalog entries that classify native resources as this type:

• AWS ARN: athena:workgroup

• AWS CloudFormation (Cloud Control): AWS::Athena::WorkGroup

• Providers: AWS

• Metadata keys: bytes_scanned_cutoff (null), encryption (null), enforce_workgroup_configuration (bool), engine_version (str), identity_center (null), kms_key_id (null), managed_query_results (null), output_location (null | str), service (str), state (str)
• Declared relations: REFERENCES / WRITES_TO
• Edges out:
  REFERENCES / WRITES_TO → S3_BUCKET

DATA_TRANSFER

DataSync task, Transfer Family server.

Catalog entries that classify native resources as this type:

• AWS ARN: datasync:task, transfer:server

• AWS CloudFormation (Cloud Control): AWS::DataSync::Task, AWS::Transfer::Server

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: destination (str), directory_id (null), domain (str), endpoint_type (str), host (null | str), identity_provider_type (str), kind (str), location_type (str), location_uri (str), protocols (list), schedule (null), security_groups (list), security_policy (null), server_id (str), service (str), source (str), state (null), status (str), task_mode (null), user_count (null), verify_mode (null), vpc_id (null), workflows (list)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, INVOKES / INVOKES, REFERENCES / DEPENDS_ON, REFERENCES / READS_FROM, REFERENCES / WRITES_TO
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
CONTAINS → IDENTITY_USER
REFERENCES / DEPENDS_ON → S3_BUCKET
REFERENCES / READS_FROM → DATA_TRANSFER
REFERENCES / WRITES_TO → DATA_TRANSFER, S3_BUCKET
• Edges in:
  REFERENCES / READS_FROM ← DATA_TRANSFER
REFERENCES / WRITES_TO ← DATA_TRANSFER

ML_WORKSPACE

SageMaker domain/notebook, Vertex workbench, AML workspace.

Catalog entries that classify native resources as this type:

• AWS ARN: sagemaker:domain, sagemaker:notebook-instance
• AWS CloudFormation (Cloud Control): AWS::SageMaker::Domain, AWS::SageMaker::NotebookInstance
• Azure ARM: microsoft.machinelearningservices/workspaces

• GCP Cloud Asset Inventory: notebooks.googleapis.com/Instance, notebooks.googleapis.com/Runtime

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: app_network_access (str), auth_mode (str), direct_internet_access (bool), domain_id (str), imds_min_version (null), instance_type (str), kind (str), kms_key_id (null), lifecycle_config (null), root_access (null), security_groups (list), service (str), status (str), url (str), vpc_id (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, REFERENCES / WRITES_TO
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
• Edges in:
  CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET

ML_ENDPOINT

Catalog entries that classify native resources as this type:

• AWS ARN: sagemaker:endpoint
• AWS CloudFormation (Cloud Control): AWS::SageMaker::Endpoint
• Azure ARM: microsoft.cognitiveservices/accounts, microsoft.machinelearningservices/workspaces/onlineendpoints

• GCP Cloud Asset Inventory: aiplatform.googleapis.com/Endpoint

• Providers: AWS

• Metadata keys: data_capture (bool), endpoint_config (str), instance_types (list), kms_key_id (null), models (list), network_isolation (null), security_groups (list), serverless (bool), service (str), status (str)
• Declared relations: REFERENCES / DEPENDS_ON
• Edges out:
  REFERENCES / DEPENDS_ON → ML_MODEL

ML_MODEL

Catalog entries that classify native resources as this type:

• AWS ARN: sagemaker:model
• AWS CloudFormation (Cloud Control): AWS::SageMaker::Model

• GCP Cloud Asset Inventory: aiplatform.googleapis.com/Model

• Providers: AWS

• Metadata keys: images (list), in_vpc (bool), network_isolation (bool), security_groups (list), service (str)
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, REFERENCES / READS_FROM, USES_IMAGE / RUNS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
REFERENCES / READS_FROM → S3_BUCKET
USES_IMAGE / RUNS_ON → CONTAINER_REGISTRY
• Edges in:
  CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
REFERENCES / DEPENDS_ON ← ML_ENDPOINT

AI_AGENT

Bedrock agent.

Catalog entries that classify native resources as this type:

• AWS ARN: bedrock:agent

• AWS CloudFormation (Cloud Control): AWS::Bedrock::Agent

• Providers: AWS

• Metadata keys: action_group_lambdas (list), action_groups (list), agent_id (str), collaboration (null), foundation_model (str), guardrail (str), kms_key_id (null), knowledge_bases (list), orchestration (null), service (str), status (null)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, INVOKES / INVOKES, PROTECTS ←, REFERENCES / READS_FROM
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
REFERENCES / READS_FROM → KNOWLEDGE_BASE
• Edges in:
  PROTECTS ← AI_GUARDRAIL

KNOWLEDGE_BASE

Catalog entries that classify native resources as this type:

• AWS ARN: bedrock:knowledge-base

• AWS CloudFormation (Cloud Control): AWS::Bedrock::KnowledgeBase

• Providers: AWS

• Metadata keys: data_sources (list), embedding_model (null), knowledge_base_id (str), service (str), status (null), storage_type (str), type (null), vector_store_endpoints (list)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, REFERENCES / READS_FROM
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
REFERENCES / READS_FROM → S3_BUCKET, SEARCH_DOMAIN
• Edges in:
  REFERENCES / READS_FROM ← AI_AGENT

AI_GUARDRAIL

Catalog entries that classify native resources as this type:

• AWS ARN: bedrock:guardrail

• AWS CloudFormation (Cloud Control): AWS::Bedrock::Guardrail

• Providers: AWS

• Metadata keys: content_policy (bool), contextual_grounding_policy (bool), cross_region_profile (null), guardrail_id (str), kms_key_id (null), sensitive_information_policy (bool), service (str), status (str), topic_policy (bool), version (str), word_policy (bool)
• Carries aliases: yes
• Edges out:
  PROTECTS → AI_AGENT