5.6 AWS service modules¶
What each module collects, the asset types it creates, and the (edge, relationship) pairs it
declares (none = no asset type or no relationship). Generated from the source; see the
catalog for the metadata keys of each type.
aws_services (top level)
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_services._base |
helpers | none | GRANTS_ACCESS/POLICY_ALLOWS_ACTION, INVOKES/TRIGGERED_BY |
aws_services._policy_grants |
helpers | none | GRANTS_ACCESS/READS_FROM |
aws_services.identity |
iam |
IAM_GROUP, IAM_POLICY, IAM_ROLE, IAM_USER, IDENTITY_PROVIDER, INSTANCE_PROFILE |
ASSUMES_ROLE/RUNS_ON, CONTAINS, GRANTS_ACCESS/POLICY_ALLOWS_ACTION, IAM_POLICY_ATTACHMENT, IAM_TRUST/CROSS_ACCOUNT_TRUST, IAM_TRUST/ROLE_ASSUMES_ROLE, REFERENCES/PERMISSION_BOUNDARY_LIMITS |
aws_services.cloudcontrol |
cloud_control |
OTHER |
none |
application
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_services.application._common |
helpers | none | ASSUMES_ROLE/RUNS_ON, GRANTS_ACCESS/POLICY_ALLOWS_ACTION, REFERENCES/DEPENDS_ON, REFERENCES/READS_FROM |
aws_services.application.alarms |
cloudwatch_alarms |
ALARM |
INVOKES/INVOKES, INVOKES/SCALES_WITH, MONITORS/MONITORED_BY, REFERENCES/DEPENDS_ON |
aws_services.application.backup |
backup_plans, backup_vaults |
BACKUP_PLAN, BACKUP_VAULT |
MANAGES/BACKUP_TO, REFERENCES/BACKUP_TO, REFERENCES/ENCRYPTED_BY_KMS |
aws_services.application.batch |
batch |
BATCH_ENVIRONMENT, JOB_DEFINITION, JOB_QUEUE |
LOGS_TO/LOGS_TO, MANAGES, REFERENCES/DEPENDS_ON, REFERENCES/RUNS_ON, USES_IMAGE/RUNS_ON |
aws_services.application.build_deploy |
codebuild, codedeploy |
BUILD_PROJECT, DEPLOYMENT_GROUP |
INVOKES/INVOKES, LOGS_TO/LOGS_TO, MANAGES, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/MONITORED_BY, REFERENCES/READS_FROM, REFERENCES/SERVES_TRAFFIC_TO, REFERENCES/WRITES_TO, USES_IMAGE/RUNS_ON |
aws_services.application.cicd |
codepipeline, codeconnections |
CI_PIPELINE, SOURCE_CONNECTION |
ASSUMES_ROLE/RUNS_ON, INVOKES/INVOKES, MANAGES, REFERENCES, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/WRITES_TO |
aws_services.application.compute |
apprunner, elasticbeanstalk |
APP_SERVICE, VPC_LINK |
CONTAINS, LOGS_TO/LOGS_TO, MANAGES, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/RUNS_ON, USES_IMAGE/RUNS_ON |
aws_services.application.containers_ext |
ecs_capacity_providers, ecs_container_instances, cloudmap |
CAPACITY_PROVIDER, DNS_RECORD, DNS_ZONE, ECS_CLUSTER, SERVICE_REGISTRY |
ASSUMES_ROLE/RUNS_ON, CONTAINS, MANAGES/SCALES_WITH, REFERENCES/DNS_RESOLVED, REFERENCES/RUNS_ON, REFERENCES/SCALES_WITH |
aws_services.application.firehose |
firehose |
DELIVERY_STREAM |
INVOKES/INVOKES, INVOKES/STREAMS_TO, INVOKES/TRIGGERED_BY, LOGS_TO/LOGS_TO, REFERENCES/BACKUP_TO, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM |
aws_services.application.integration |
scheduler, pipes, eventbridge_api_destinations, eventbridge_archives |
API_DESTINATION, EVENT_ARCHIVE, EVENT_PIPE, SCHEDULE |
INVOKES/INVOKES, INVOKES/TRIGGERED_BY, LOGS_TO/LOGS_TO, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/WRITES_TO |
aws_services.application.logs |
log_subscriptions, log_destinations, oam |
IAM_POLICY, LOG_SINK |
INVOKES/STREAMS_TO, REFERENCES/DEPENDS_ON, REFERENCES/WRITES_TO |
aws_services.application.operations |
ssm_parameters, ssm_managed_instances, ssm_documents, ssm_associations, ssm_maintenance_windows |
OTHER, PARAMETER, RUNBOOK, SCHEDULE, VIRTUAL_MACHINE |
GRANTS_ACCESS/POLICY_ALLOWS_ACTION, INVOKES/INVOKES, LOGS_TO/LOGS_TO, MANAGES, MANAGES/SCHEDULED_BY, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS |
aws_services.application.serverless_ext |
lambda_aliases |
LAMBDA_FUNCTION |
REFERENCES/DEPENDS_ON |
containers
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_services.containers.ecr |
ecr |
CONTAINER_REGISTRY |
REFERENCES/ENCRYPTED_BY_KMS |
aws_services.containers.ecs |
ecs |
CONTAINER_SERVICE, ECS_CLUSTER, TASK_DEFINITION |
ASSUMES_ROLE/DEPENDS_ON, ASSUMES_ROLE/RUNS_ON, CONTAINS/CLUSTER_CONTAINS_SERVICE, CONTAINS/SUBNET_CONTAINS_INSTANCE, LOAD_BALANCER_TARGET/LOAD_BALANCED_BY, LOGS_TO/LOGS_TO, MANAGES/SCHEDULED_BY, REFERENCES/DEPENDS_ON, REFERENCES/DNS_RESOLVED, REFERENCES/READS_FROM, USES_IMAGE/RUNS_ON |
aws_services.containers.eks |
eks, eks_cluster |
CLUSTER_ADDON, EKS_CLUSTER, FARGATE_PROFILE, K8S_SERVICE_ACCOUNT, NODE_GROUP |
ASSUMES_ROLE/ROLE_ASSUMES_ROLE, ASSUMES_ROLE/RUNS_ON, ATTACHED_TO/PROTECTED_BY_SG, CONTAINS, CONTAINS/CLUSTER_CONTAINS_SERVICE, CONTAINS/SUBNET_CONTAINS_INSTANCE, GRANTS_ACCESS/POLICY_ALLOWS_ACTION, MANAGES/SCALES_WITH, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS |
data_ml
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_services.data_ml._common |
helpers | none | CONTAINS/SUBNET_CONTAINS_INSTANCE, GRANTS_ACCESS/POLICY_ALLOWS_ACTION |
aws_services.data_ml.analytics |
emr, emr_serverless, athena |
BIG_DATA_CLUSTER, QUERY_WORKGROUP |
ASSUMES_ROLE/RUNS_ON, LOGS_TO/LOGS_TO, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/RUNS_ON, REFERENCES/WRITES_TO, USES_IMAGE/RUNS_ON |
aws_services.data_ml.bedrock |
bedrock |
AI_AGENT, AI_GUARDRAIL, KNOWLEDGE_BASE, LOG_SINK |
ASSUMES_ROLE/RUNS_ON, INVOKES/INVOKES, LOGS_TO/LOGS_TO, PROTECTS, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/WRITES_TO |
aws_services.data_ml.databases |
rds_proxies, rds_global_clusters, memorydb, dax |
AURORA_CLUSTER, CACHE_CLUSTER, DATABASE_PROXY |
ASSUMES_ROLE/RUNS_ON, CONTAINS, LOAD_BALANCER_TARGET/SERVES_TRAFFIC_TO, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/REPLICATES_TO, REFERENCES/WRITES_TO |
aws_services.data_ml.glue |
glue |
DATA_CATALOG |
CONTAINS, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS |
aws_services.data_ml.glue_etl |
helpers | DATA_CATALOG, ETL_JOB, EVENT_RULE |
ASSUMES_ROLE/RUNS_ON, INVOKES/INVOKES, INVOKES/TRIGGERED_BY, LOGS_TO/LOGS_TO, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/WRITES_TO |
aws_services.data_ml.lakeformation |
lakeformation |
DATA_CATALOG |
ASSUMES_ROLE/RUNS_ON, GOVERNS/COMPLIANCE_GOVERNS, GRANTS_ACCESS/POLICY_ALLOWS_ACTION |
aws_services.data_ml.messaging |
msk, amazon_mq |
MESSAGE_BROKER |
LOGS_TO/LOGS_TO, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/REPLICATES_TO |
aws_services.data_ml.registry |
ecr_public |
CONTAINER_REGISTRY |
none |
aws_services.data_ml.sagemaker |
sagemaker |
ML_ENDPOINT, ML_MODEL, ML_WORKSPACE |
ASSUMES_ROLE/RUNS_ON, ATTACHED_TO, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/WRITES_TO, USES_IMAGE/RUNS_ON |
aws_services.data_ml.serverless_data |
opensearch_serverless, redshift_serverless |
DATA_WAREHOUSE, SEARCH_DOMAIN |
ASSUMES_ROLE/RUNS_ON, REFERENCES/CERTIFICATE_SECURES, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM |
aws_services.data_ml.transfer |
transfer_family, datasync, fsx |
DATA_TRANSFER, FILE_SYSTEM, IDENTITY_USER |
ASSUMES_ROLE/RUNS_ON, ATTACHED_TO, CONTAINS, INVOKES/INVOKES, LOGS_TO/LOGS_TO, REFERENCES/CERTIFICATE_SECURES, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/WRITES_TO |
governance
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_services.governance._common |
helpers | none | GRANTS_ACCESS |
aws_services.governance.cognito |
cognito_user_pools, cognito_identity_pools |
IDENTITY_POOL, USER_POOL |
ASSUMES_ROLE/ROLE_ASSUMES_ROLE, ASSUMES_ROLE/RUNS_ON, INVOKES/INVOKES, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS |
aws_services.governance.data_protection |
kms, secrets_manager, dynamodb |
DYNAMODB_TABLE, KMS_KEY, SECRET |
GRANTS_ACCESS, INVOKES/ROTATES_SECRET, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/REPLICATES_TO, REFERENCES/STREAMS_TO |
aws_services.governance.iam_extras |
iam_saml_providers, iam_access_keys, rolesanywhere |
ACCESS_KEY, IDENTITY_PROVIDER, PERMISSION_SET |
ASSUMES_ROLE/ROLE_ASSUMES_ROLE, CONTAINS, IAM_POLICY_ATTACHMENT/ROLE_HAS_POLICY, IAM_TRUST/ROLE_ASSUMES_ROLE, REFERENCES/DEPENDS_ON |
aws_services.governance.identity_center |
identity_center |
IDENTITY_GROUP, IDENTITY_PROVIDER, IDENTITY_USER, PERMISSION_SET |
ASSUMES_ROLE/ROLE_ASSUMES_ROLE, CONTAINS, GRANTS_ACCESS, IAM_POLICY_ATTACHMENT/ROLE_HAS_POLICY, MANAGES/OWNED_BY, REFERENCES/PERMISSION_BOUNDARY_LIMITS |
aws_services.governance.ram |
ram_shares |
RESOURCE_SHARE |
GRANTS_ACCESS, GRANTS_ACCESS/DEPENDS_ON, MANAGES/OWNED_BY |
aws_services.governance.s3_access_points |
s3_access_points, s3_multi_region_access_points |
ACCESS_POINT |
ATTACHED_TO, REFERENCES/CROSS_ACCOUNT_TRUST, REFERENCES/READS_FROM |
aws_services.governance.service_catalog |
service_catalog |
PRODUCT_PORTFOLIO, PROVISIONED_PRODUCT |
ASSUMES_ROLE/RUNS_ON, GRANTS_ACCESS/CROSS_ACCOUNT_TRUST, GRANTS_ACCESS/POLICY_ALLOWS_ACTION, MANAGES/OWNED_BY, REFERENCES/DEPENDS_ON |
aws_services.governance.sharing |
ebs_snapshots, machine_images, rds_snapshots |
MACHINE_IMAGE, SNAPSHOT |
GRANTS_ACCESS, REFERENCES, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS |
aws_services.governance.stack_sets |
stack_sets |
STACK_SET |
ASSUMES_ROLE/RUNS_ON, MANAGES/OWNED_BY, REFERENCES/DEPENDS_ON |
network_ext
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_services.network_ext.__init__ |
cloudfront |
none | none |
aws_services.network_ext.apigateway |
apigateway_authorizers, apigateway_vpc_links, apigateway_domains |
AUTHORIZER, CUSTOM_DOMAIN, VPC_LINK |
ASSUMES_ROLE/RUNS_ON, CONTAINS/SUBNET_CONTAINS_INSTANCE, INVOKES/INVOKES, LOAD_BALANCER_TARGET/SERVES_TRAFFIC_TO, REFERENCES/CERTIFICATE_SECURES, REFERENCES/DEPENDS_ON, ROUTE/SERVES_TRAFFIC_TO |
aws_services.network_ext.cloudfront |
cloudfront_deep |
CLOUDFRONT, EDGE_FUNCTION |
INVOKES/INVOKES, LOGS_TO/LOGS_TO, REFERENCES/CERTIFICATE_SECURES, ROUTE/SERVES_TRAFFIC_TO |
aws_services.network_ext.direct_connect |
direct_connect, direct_connect_gateways |
DIRECT_CONNECT |
ATTACHED_TO, CONTAINS, ROUTE/TRANSIT_ROUTED |
aws_services.network_ext.elb_rules |
elb_rules |
CERTIFICATE, LB_LISTENER |
CONTAINS, REFERENCES/CERTIFICATE_SECURES, REFERENCES/DEPENDS_ON, ROUTE/SERVES_TRAFFIC_TO |
aws_services.network_ext.global_accelerator |
global_accelerator |
GLOBAL_ACCELERATOR |
LOAD_BALANCER_TARGET/SERVES_TRAFFIC_TO |
aws_services.network_ext.lattice |
vpc_lattice |
ENDPOINT_SERVICE, SERVICE_NETWORK, TARGET_GROUP |
ATTACHED_TO, CONTAINS, LOAD_BALANCER_TARGET/LB_TARGETS_INSTANCE, LOAD_BALANCER_TARGET/LOAD_BALANCED_BY, REFERENCES/CERTIFICATE_SECURES |
aws_services.network_ext.network_manager |
network_manager |
SERVICE_NETWORK |
CONTAINS, MONITORS/MONITORED_BY, ROUTE/TRANSIT_ROUTED |
aws_services.network_ext.privatelink |
egress_only_igw, prefix_lists, endpoint_services |
ENDPOINT_SERVICE, INTERNET_GATEWAY, PREFIX_LIST |
ATTACHED_TO, GRANTS_ACCESS/POLICY_ALLOWS_ACTION, LOAD_BALANCER_TARGET/SERVES_TRAFFIC_TO, ROUTE/SERVES_TRAFFIC_TO |
aws_services.network_ext.resolver |
route53_resolver |
DNS_RESOLVER, LOG_SINK, NETWORK_FIREWALL |
ATTACHED_TO/DNS_RESOLVED, CONTAINS, CONTAINS/SUBNET_CONTAINS_INSTANCE, LOGS_TO/LOGS_TO, PROTECTS/PROTECTED_BY_NACL, ROUTE/DNS_RESOLVED |
aws_services.network_ext.tgw |
tgw_routing |
PEERING_CONNECTION, ROUTE_TABLE |
CONTAINS, PEERING/TRANSIT_ROUTED, ROUTE/TRANSIT_ROUTED |
aws_services.network_ext.vpn |
vpn |
CUSTOMER_GATEWAY, VPN_CONNECTION, VPN_GATEWAY |
ATTACHED_TO, ATTACHED_TO/TRANSIT_ROUTED, REFERENCES/CERTIFICATE_SECURES, REFERENCES/DEPENDS_ON, ROUTE/TRANSIT_ROUTED |
platform
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_services.platform.compute_fabric |
autoscaling, launch_templates, vpc_endpoints, flow_logs |
AUTOSCALING_GROUP, FLOW_LOG, LAUNCH_TEMPLATE, VPC_ENDPOINT |
ASSUMES_ROLE/RUNS_ON, CONTAINS, CONTAINS/SUBNET_CONTAINS_INSTANCE, LOAD_BALANCER_TARGET/LOAD_BALANCED_BY, LOGS_TO/LOGS_TO, MANAGES/SCALES_WITH, MONITORS/MONITORED_BY, REFERENCES/DEPENDS_ON, ROUTE/SERVES_TRAFFIC_TO, ROUTE/TRANSIT_ROUTED |
aws_services.platform.data |
rds, elasticache, opensearch, redshift |
AURORA_CLUSTER, CACHE_CLUSTER, DATA_WAREHOUSE, RDS_INSTANCE, SEARCH_DOMAIN |
ASSUMES_ROLE/RUNS_ON, CONTAINS, CONTAINS/SUBNET_CONTAINS_INSTANCE, LOGS_TO/LOGS_TO, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/REPLICATES_TO |
aws_services.platform.dns_iac_ops |
route53, cloudformation, log_groups, acm |
CERTIFICATE, DNS_RECORD, DNS_ZONE, IAC_STACK, LOG_GROUP |
ASSUMES_ROLE/RUNS_ON, ATTACHED_TO/DNS_RESOLVED, CONTAINS, MANAGES/OWNED_BY, REFERENCES/CERTIFICATE_SECURES, REFERENCES/ENCRYPTED_BY_KMS, ROUTE/DNS_RESOLVED |
aws_services.platform.load_balancing |
elbv2, elb_classic |
LOAD_BALANCER, TARGET_GROUP |
CONTAINS/SUBNET_CONTAINS_INSTANCE, LOAD_BALANCER_TARGET/LB_TARGETS_INSTANCE, LOAD_BALANCER_TARGET/LOAD_BALANCED_BY, LOGS_TO/LOGS_TO, REFERENCES/CERTIFICATE_SECURES |
aws_services.platform.storage |
s3, efs |
FILE_SYSTEM, S3_BUCKET |
ASSUMES_ROLE/RUNS_ON, CONTAINS/SUBNET_CONTAINS_INSTANCE, INVOKES/INVOKES, LOGS_TO/LOGS_TO, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/REPLICATES_TO |
security
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_services.security._common |
helpers | none | MONITORS/MONITORED_BY |
aws_services.security.detection |
guardduty, securityhub, inspector2, macie, detective |
DATA_SECURITY_SCANNER, SECURITY_HUB, THREAT_DETECTOR, VULNERABILITY_SCANNER |
ASSUMES_ROLE/RUNS_ON, MONITORS/MONITORED_BY, MONITORS/READS_FROM |
aws_services.security.network_protection |
wafv2, network_firewall, shield |
DDOS_PROTECTION, NETWORK_FIREWALL, WAF_WEB_ACL |
CONTAINS/SUBNET_CONTAINS_INSTANCE, PROTECTS/PROTECTED_BY_NACL, PROTECTS/PROTECTED_BY_WAF, REFERENCES/DEPENDS_ON |
aws_services.security.posture |
config, access_analyzer, cloudtrail |
ACCESS_ANALYZER, CLOUDTRAIL, CONFIG_RECORDER |
ASSUMES_ROLE/RUNS_ON, LOGS_TO/LOGS_TO, LOGS_TO/STREAMS_TO, REFERENCES/ENCRYPTED_BY_KMS |
serverless
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_services.serverless.apigateway |
apigateway, apigatewayv2 |
API_GATEWAY |
ASSUMES_ROLE/RUNS_ON, INVOKES/INVOKES, LOGS_TO/LOGS_TO, PROTECTS/PROTECTED_BY_WAF, ROUTE/SERVES_TRAFFIC_TO |
aws_services.serverless.functions |
lambda |
LAMBDA_FUNCTION |
ASSUMES_ROLE/RUNS_ON, INVOKES/TRIGGERED_BY, LOGS_TO/LOGS_TO, REFERENCES/DEPENDS_ON, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/READS_FROM, REFERENCES/WRITES_TO, USES_IMAGE/RUNS_ON |
aws_services.serverless.messaging |
sqs, sns, eventbridge, stepfunctions, kinesis |
DATA_STREAM, EVENT_BUS, EVENT_RULE, MESSAGE_QUEUE, NOTIFICATION_TOPIC, STATE_MACHINE |
ASSUMES_ROLE/RUNS_ON, CONTAINS, INVOKES/INVOKES, INVOKES/STREAMS_TO, LOGS_TO/LOGS_TO, REFERENCES/ENCRYPTED_BY_KMS, REFERENCES/WRITES_TO |
mapper-level modules
| Module | _collect_* methods |
Asset types | Declared edge / relationship |
|---|---|---|---|
aws_deep |
route_tables, internet_gateways, nat_gateways, network_interfaces, ebs_volumes, elastic_ips, nacls, vpc_peering, transit_gateways, tagging_sweep |
EBS_VOLUME, ELASTIC_IP, INTERNET_GATEWAY, NACL, NAT_GATEWAY, NETWORK_INTERFACE, PEERING_CONNECTION, ROUTE_TABLE, TRANSIT_GATEWAY |
ROUTE/TRANSIT_ROUTED |
kubernetes |
helpers | K8S_INGRESS, K8S_NAMESPACE, K8S_SERVICE, K8S_SERVICE_ACCOUNT, K8S_WORKLOAD |
ASSUMES_ROLE/RUNS_ON, CONTAINS/CLUSTER_CONTAINS_SERVICE, LOAD_BALANCER_TARGET/SERVES_TRAFFIC_TO, REFERENCES/RUNS_ON, ROUTE/LOAD_BALANCED_BY, ROUTE/SERVES_TRAFFIC_TO, USES_IMAGE/RUNS_ON |
organization_assets |
helpers | CLOUD_ACCOUNT, GUARDRAIL, LANDING_ZONE, ORGANIZATION, ORG_POLICY, ORG_UNIT |
CONTAINS, CONTAINS/ORG_CONTAINS_ACCOUNT, GOVERNS/COMPLIANCE_GOVERNS, GOVERNS/SCP_RESTRICTS, MANAGES/COMPLIANCE_GOVERNS, MANAGES/OWNED_BY |