Skip to content

Hierarchies beyond AWS

Section 10 · From docs/INVENTORY_INTERNALS.md on GitHub

Azure (discover_azure_hierarchy(credential, graph_client_factory=None, *, include_policies=True, errors=None)): one Resource Graph query over resourcecontainers returns the management group tree and every subscription with its ancestor chain; one over policyresources returns policy assignments and exemptions at every scope.

  • Management groups: ORG_UNIT, /providers/Microsoft.Management/managementGroups/<name>, is_tenant_root, landing_zone when named after an Azure Landing Zones archetype.
  • Subscriptions: CLOUD_ACCOUNT, /subscriptions/<id> (the same identifier the subscription collector uses, so they deduplicate), contained by their management group.
  • Policy assignments and exemptions: GUARDRAIL that GOVERNS / COMPLIANCE_GOVERNS its scope.

GCP (discover_gcp_hierarchy(credentials, organization_id, client=None, *, coverage=None, org_policies=True, access_policies=True)): the organization (ORGANIZATION), folders (ORG_UNIT) and projects (CLOUD_ACCOUNT, aliases projects/<number>, <number>, projects/<id>) with CONTAINS; organization policies as ORG_POLICY that GOVERN their resource; VPC Service Controls perimeters as GUARDRAIL that GOVERN their member projects and networks.