Architecture and data flow¶
┌───────────────────────────── InventoryMapper.map_inventory() ─────────────────────────────┐
│ │
config ──► │ 1 _discover_aws_organization ──► OrganizationTopology ──► target accounts, member role, │
│ governed regions │
│ 2 _discover_hierarchies ───────► Azure management groups / policy, GCP org / folders │
│ │
│ 3 MultiAccountCollector.collect_all() │
│ AWS accounts × regions ─► AWSDeepInventoryCollector (133 tasks, mixins) │
│ ├─ dedicated collectors (relations declared) │
│ ├─ Kubernetes API (EKS) │
│ ├─ Cloud Control sweep discovered_via │
│ └─ Tagging API sweep discovered_via │
│ Azure subscriptions ──────► AzureDeepInventoryCollector (Resource Graph | SDK) │
│ GCP org or projects ────► GCPDeepInventoryCollector (Cloud Asset Inventory + IAM) │
│ │
│ 4 topology.to_assets() + hierarchy assets + collected assets │
│ │
│ 5 _link: deduplicate ─► merge_gcp_principals ─► RelationshipLinker.link() │
│ ─► + external account placeholders ─► add_account_hierarchy │
│ │
└──► InventoryResult(assets, edges, coverage, providers, regions, organization, unresolved) │
│
├─ summary, analysis() ─► DependencyGraph, cross_account_edges, security_coverage
└─ export() ─► inventory-map.json, .graphml, inventory-graph.json,
inventory-dependencies.json, inventory-organization.json