Relationship vocabulary

From docs/INVENTORY_CATALOG.md on GitHub

relationship values are RelationType names from cloudg/graph/ontology_rules.py (64 in all), so the ontology export can use the declared relation. On CONTAINS, ATTACHED_TO and the typed edges (INVOKES, USES_IMAGE, ASSUMES_ROLE, GRANTS_ACCESS, LOGS_TO, PROTECTS, MONITORS, MANAGES, GOVERNS, REFERENCES) the declared relation replaces the one the ontology would infer. On SECURITY_GROUP_RULE, IAM_TRUST, IAM_POLICY_ATTACHMENT, LOAD_BALANCER_TARGET, ROUTE, PEERING and INTERNET_EXPOSED edges it comes first and the inferred relations are added after it. The inventory uses:

Relationship	Meaning
ACCOUNT_CONTAINS_REGION	Account (or subscription) contains a resource or resource group. Used for the hierarchy edges add_account_hierarchy adds (properties.hierarchy: true).
BACKUP_TO	Data is backed up to the target (backup plan → vault, Firehose backup bucket, ...).
CERTIFICATE_SECURES	A certificate secures the source endpoint (listener, distribution, custom domain).
CLUSTER_CONTAINS_SERVICE	A cluster contains a service, node group, namespace or workload (ECS, EKS, AKS, GKE, App Service plans).
COMPLIANCE_GOVERNS	A non-SCP organization policy, Control Tower control / baseline, Azure Policy or GCP org policy governs the target.
CROSS_ACCOUNT_TRUST	IAM trust that crosses an account boundary.
DEPENDS_ON	Generic functional dependency (environment references, private endpoint connections, Kubernetes services).
DNS_RESOLVED	A DNS record or namespace resolves to the target.
ENCRYPTED_BY_KMS	Encrypted with the target key (KMS, Key Vault key, Cloud KMS).
INVOKES	Calls or delivers to the target (notifications, rule targets, state machine tasks, integrations).
LB_TARGETS_INSTANCE	Load balancer / target group → registered target.
LOAD_BALANCED_BY	The source sits behind the target load balancer (often declared reverse).
LOGS_TO	Sends logs to the target destination.
MONITORED_BY	Monitored by the target (alarms, Inspector coverage, flow logs, Security Hub sources).
NAT_TRANSLATED	Route via a NAT gateway.
ORG_CONTAINS_ACCOUNT	OU / root contains an account; management group contains a subscription.
OWNED_BY	Ownership / management (stack → resource, landing zone → shared accounts, permission set → SSO role).
POLICY_ALLOWS_ACTION	A policy or role assignment grants the principal access to the target.
PROTECTED_BY_NACL	Declared on PROTECTS edges from an AWS Network Firewall or a Route 53 Resolver DNS Firewall rule group to the VPC or transit gateway it protects. The ontology also infers it for a resource ATTACHED_TO a network ACL.
PROTECTED_BY_SG	Resource protected by a security group / NSG.
PROTECTED_BY_WAF	Resource protected by a WAF web ACL / Cloud Armor / WAF policy.
READS_FROM	Reads data from the target (sources, mounted volumes, secrets, parameters).
REPLICATES_TO	Replicates data to the target (S3 replication, DynamoDB replicas, secret replicas).
ROLE_ASSUMES_ROLE	A principal may assume or impersonate the target identity.
ROTATES_SECRET	A function rotates the target secret.
RUNS_ON	Runs as an identity, or on an image / compute platform.
SCALES_WITH	Scaling relationship (alarm → scaling policy, capacity provider → ASG).
SCHEDULED_BY	Scheduled by the target (maintenance windows, schedules).
SCP_RESTRICTS	A service control policy restricts the target OU or account.
SERVES_TRAFFIC_TO	Forwards client traffic to the target (origins, routes, backends, ingress backends).
STREAMS_TO	Streams records to the target (SNS → SQS, Firehose, log subscriptions).
SUBNET_CONTAINS_INSTANCE	Subnet (or network) contains the resource.
TRANSIT_ROUTED	Traffic routed via the target (route tables, transit gateway attachments).
TRIGGERED_BY	The target is triggered by the source (event source mappings, permissions with a SourceArn).
VPC_CONTAINS_SUBNET	VPC / VNet contains a subnet.
VPC_PEERED	VPC peering.
WRITES_TO	Writes data to the target (dead-letter queues, destinations, output locations).