Secrets / Keys

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

KMS_KEY

Catalog entries that classify native resources as this type:

• AWS ARN: kms:key
• Azure ARM: microsoft.compute/diskencryptionsets, microsoft.keyvault/managedhsms

• GCP Cloud Asset Inventory: cloudkms.googleapis.com/CryptoKey

• Providers: AWS, AZURE, GCP

• Metadata keys: collected_via (str), create_time (null), created (str), custom_key_store_id (null), deletion_date (null), description (null | str), enabled (bool), external_accounts (list), folders (list), gcp_asset_type (str), grant_count (int), grantees (list), key_manager (str), key_spec (str), key_state (str), key_url (str), key_usage (null | str), kind (null), location (str), multi_region (bool), multi_region_type (null), network_tags (list), next_rotation (null), organization (str), origin (str), parent_asset_type (null), parent_full_resource_name (str), pending_deletion (bool), policy_principals (list), project (str), project_id (str), project_number (str), properties (object), public_policy (bool), purpose (str), resource_group (str), resource_type (str), rotation_enabled (bool), rotation_period_days (null), sku (null), state (null)
• Carries aliases: yes
• Declared relations: CONTAINS ←, GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ←, GRANTS_ACCESS / POLICY_ALLOWS_ACTION ←, REFERENCES / ENCRYPTED_BY_KMS
• Edges out:
  REFERENCES → CLOUD_ACCOUNT
REFERENCES / ENCRYPTED_BY_KMS → KEY_VAULT
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT, RESOURCE_GROUP
GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ← CLOUD_ACCOUNT
GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← IAM_USER
REFERENCES / ENCRYPTED_BY_KMS ← BACKUP_VAULT, DYNAMODB_TABLE, EBS_VOLUME, GKE_CLUSTER, MESSAGE_QUEUE, SECRET

SECRET

Catalog entries that classify native resources as this type:

• AWS ARN: secretsmanager:secret

• GCP Cloud Asset Inventory: secretmanager.googleapis.com/Secret

• Providers: AWS, GCP

• Metadata keys: create_time (null), created (str), deleted_date (null), description (null | str), external_accounts (list), folders (list), gcp_asset_type (str), kms_key_id (str), last_accessed (str), last_rotated (str), location (str), network_tags (list), next_rotation (null | str), organization (str), owning_service (null), parent_asset_type (null), parent_full_resource_name (str), policy_principals (list), primary_region (null), project (str), project_id (str), project_number (str), public_policy (bool), replica_regions (list), replication (str), rotation (bool), rotation_days (int | null), rotation_enabled (bool), rotation_lambda (null | str), rotation_schedule (null), state (null)
• Carries aliases: yes
• Declared relations: GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ←, INVOKES / ROTATES_SECRET, REFERENCES / ENCRYPTED_BY_KMS, REFERENCES / REPLICATES_TO
• Edges out:
  INVOKES / ROTATES_SECRET → LAMBDA_FUNCTION
REFERENCES / ENCRYPTED_BY_KMS → KMS_KEY
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT
GRANTS_ACCESS / CROSS_ACCOUNT_TRUST ← CLOUD_ACCOUNT
REFERENCES / READS_FROM ← APP_SERVICE, CONTAINER_SERVICE, DATABASE_PROXY

CERTIFICATE

Catalog entries that classify native resources as this type:

• AWS ARN: acm:certificate
• Azure ARM: microsoft.web/certificates

• GCP Cloud Asset Inventory: certificatemanager.googleapis.com/Certificate, compute.googleapis.com/RegionSslCertificate, compute.googleapis.com/SslCertificate, privateca.googleapis.com/CertificateAuthority

• Providers: AWS, GCP

• Metadata keys: certificate_type (str), create_time (null), description (null), domains (list), folders (list), gcp_asset_type (str), in_use_by (list), key_algorithm (str), location (str), network_tags (list), not_after (str), organization (str), parent_asset_type (null), parent_full_resource_name (str), project (str), project_id (str), project_number (str), renewal_eligibility (str), state (null), status (str), subject_alternative_names (list), type (str)
• Carries aliases: yes
• Edges out:
  REFERENCES / CERTIFICATE_SECURES → LOAD_BALANCER
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT
REFERENCES / CERTIFICATE_SECURES ← CLOUDFRONT, CUSTOM_DOMAIN

KEY_VAULT

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.keyvault/vaults

• GCP Cloud Asset Inventory: cloudkms.googleapis.com/KeyRing

• Providers: AZURE

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: access_policies (list), collected_via (str), kind (null), network_default_action (str), properties (object), public_network_access (str), purge_protection (null), rbac_authorization (bool), resource_group (str), resource_type (str), sku (null), soft_delete (null), vault_uri (str)
• Carries aliases: yes
• Declared relations: CONTAINS ←, GRANTS_ACCESS / POLICY_ALLOWS_ACTION ←
• Edges in:
  CONTAINS ← RESOURCE_GROUP
GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← SERVICE_PRINCIPAL, SUBNET, VIRTUAL_MACHINE
REFERENCES / ENCRYPTED_BY_KMS ← BLOB_STORAGE, KMS_KEY