Skip to content

5.10 Security services and coverage gaps

The AWS deep collector · From docs/INVENTORY_INTERNALS.md on GitHub

Security collectors (GuardDuty, Security Hub, Inspector, Macie, Config, Access Analyzer, Detective, CloudTrail, WAF, Network Firewall, Shield) produce, per account and region:

  • when enabled, an asset with metadata.security_service, enabled: true, the alias aws-security:<service>:<region>:<account>, and MONITORS / PROTECTS relations to what it covers (Inspector: every scanned instance, repository and function from its coverage list; GuardDuty / Config / CloudTrail / Macie: the account; Security Hub: the services it ingests from; WAF: the associated resources);
  • when not enabled (or access is denied), _disabled_asset(): a placeholder with enabled: false and the same alias, so other relations that target "the GuardDuty of this account" still resolve and the gap is visible.

security_coverage() and summary.security_service_gaps are computed from these assets.