Storage

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

S3_BUCKET

Catalog entries that classify native resources as this type:

• AWS ARN: s3

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: access_logging_target (null), account_public_access_block (null | object), acl_grants (int), creation_date (str), encryption (bool), eventbridge_notifications (bool), kms_key_id (null), policy_allows_public (bool), public_access_block (null), replication_rules (int), sse_algorithm (null)
• Carries aliases: yes
• Declared relations: INVOKES / INVOKES
• Edges out:
  INVOKES / INVOKES → LAMBDA_FUNCTION, MESSAGE_QUEUE
• Edges in:
  INVOKES / STREAMS_TO ← DELIVERY_STREAM
LOGS_TO / LOGS_TO ← BIG_DATA_CLUSTER, CLOUDFRONT, LOG_SINK
REFERENCES ← CLOUDTRAIL
REFERENCES / BACKUP_TO ← DELIVERY_STREAM
REFERENCES / DEPENDS_ON ← DATA_CATALOG, DATA_TRANSFER
REFERENCES / READS_FROM ← ACCESS_POINT, BUILD_PROJECT, ETL_JOB, IDENTITY_USER, KNOWLEDGE_BASE, ML_MODEL
REFERENCES / WRITES_TO ← CI_PIPELINE, DATA_TRANSFER, ETL_JOB, QUERY_WORKGROUP
ROUTE / SERVES_TRAFFIC_TO ← CLOUDFRONT

BLOB_STORAGE

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.storage/storageaccounts

• Providers: AZURE

• Metadata keys: access_tier (null), collected_via (str), hns_enabled (null), https_only (null), kind (str), min_tls_version (null), network_default_action (str), properties (object), provisioning_state (null), public_blob_access (bool), public_network_access (str), resource_group (str), resource_type (str), shared_key_access (null), sku (str)
• Carries aliases: yes
• Declared relations: CONTAINS ←, REFERENCES, REFERENCES / ENCRYPTED_BY_KMS
• Edges out:
  REFERENCES / ENCRYPTED_BY_KMS → KEY_VAULT
• Edges in:
  CONTAINS ← RESOURCE_GROUP
REFERENCES / DEPENDS_ON ← VPC_ENDPOINT

GCS_BUCKET

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: storage.googleapis.com/Bucket

• Providers: GCP

• Metadata keys: create_time (null), description (null), folders (list), gcp_asset_type (str), location (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), project (str), project_id (str), project_number (str), public_acl (list), retention_locked (bool), state (null), uniform_bucket_level_access (bool), versioning (bool), website (bool)
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT
LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO ← LOAD_BALANCER
LOGS_TO / LOGS_TO ← LOG_SINK

EBS_VOLUME

Catalog entries that classify native resources as this type:

• AWS ARN: ec2:volume
• Azure ARM: microsoft.compute/disks

• GCP Cloud Asset Inventory: compute.googleapis.com/Disk, compute.googleapis.com/RegionDisk

• Providers: AWS, AZURE, GCP

• Metadata keys: attached_instance_id (str), attached_instance_ids (list), collected_via (str), create_time (null), description (null), disk_encryption_set (str), encrypted (bool), encryption (str), folders (list), gcp_asset_type (str), kind (null), kms_keys (list), location (str), managed_by (str), network_access_policy (null), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), project (str), project_id (str), project_number (str), properties (object), resource_group (str), resource_type (str), size_gb (int), sku (null), state (null | str), volume_id (str), volume_type (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO, CONTAINS ←, REFERENCES / ENCRYPTED_BY_KMS
• Edges out:
  ATTACHED_TO → EC2, GCE_INSTANCE, VIRTUAL_MACHINE
REFERENCES / ENCRYPTED_BY_KMS → KMS_KEY
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT, RESOURCE_GROUP
REFERENCES ← SNAPSHOT

ACCESS_POINT

S3 (multi-region) access point, EFS access point.

Catalog entries that classify native resources as this type:

• AWS ARN: elasticfilesystem:access-point, s3:accesspoint, s3:mrap

• Providers: AWS

• Metadata keys: account_public_access_block (object), alias (str), bucket (str), bucket_account_id (null), buckets (list), created (str), data_source_type (null), endpoint_kind (str), network_origin (str), policy_public (null), public_access_block (object), regions (list), restricted_by_public_access_block (bool), status (str), vpc_id (str)
• Carries aliases: yes
• Declared relations: ATTACHED_TO, REFERENCES / READS_FROM
• Edges out:
  ATTACHED_TO → VPC
REFERENCES / READS_FROM → S3_BUCKET