Skip to content

cloudg

inventory

morpheuslord/cloudg

`inventory`¶

Scanner-independent full-infrastructure mapping (cloudg map).

Keys¶

Key	Type	Default	Description
`tagging_sweep`	`bool`	`true`	AWS: sweep the Resource Groups Tagging API (tagged resources only)
`cloud_control`	`bool`	`true`	AWS: list every resource type with a Cloud Control list handler, tagged or not, for services without a dedicated collector
`cloud_control_types`	`list`	`[]`	Only these CloudFormation types or prefixes (e.g. AWS::SSM::, AWS::Glue::Job)
`cloud_control_exclude`	`list`	`[]`	CloudFormation types or prefixes the Cloud Control sweep skips.
`cloud_control_concurrency`	`int`	`6`	Parallel Cloud Control list calls (1 to 32).
`link_references`	`bool`	`true`	Derive cross-service REFERENCES edges from asset metadata
`services`	`list`	`[all]`	Service families or collector names to map: all, network, compute, containers, kubernetes, serverless, integration, data, storage, identity, security, dns, iac, logging
`exclude_services`	`list`	`[]`	Service families or collector names to skip.
`kubernetes`	`bool`	`true`	Read workloads, services, ingresses and service accounts from inside EKS clusters through the Kubernetes API (needs a cluster access entry)
`kubernetes_timeout`	`int`	`10`	Seconds to wait on each Kubernetes API call (1 to 120).
`iam_resource_edges`	`bool`	`true`	Link IAM principals to the concrete resources their policies grant
`max_images_per_repository`	`int`	`20`	Image digests sampled per ECR repository (0 to 1000).
`stack_resources`	`bool`	`true`	Link CloudFormation stacks to the resources they manage
`account_hierarchy`	`bool`	`true`	Add account nodes and account -> top-level resource containment

In config.yaml¶

config.yaml (inventory)

inventory:
  tagging_sweep: true      # AWS: Resource Groups Tagging API sweep (tagged resources only)
  cloud_control: true      # AWS: list every Cloud Control resource type, tagged or not
  cloud_control_types: []  # Only these CloudFormation types / prefixes (e.g. AWS::Glue::)
  cloud_control_exclude: []
  cloud_control_concurrency: 6
  link_references: true    # Derive cross-service REFERENCES edges from metadata
  services: [all]          # Families: network, compute, containers, kubernetes, serverless,
                           # integration, storage, data, identity, security, logging, dns, iac
  exclude_services: []
  kubernetes: true         # Map workloads inside EKS clusters (needs an EKS access entry)
  kubernetes_timeout: 10
  iam_resource_edges: true # Link IAM principals to the resources their policies grant
  max_images_per_repository: 20
  stack_resources: true    # Link CloudFormation stacks to the resources they manage
  account_hierarchy: true  # Account nodes containing their top-level resources

Read from the annotated example config.yaml and the CloudGConfig models in cloudg/config.py.