asset-map.json and compliance-map.json

Section 19 · From docs/INVENTORY_REFERENCE.md on GitHub

Written by cloudg map --findings … or InventoryMapper.export_merged(result, findings, dir), which returns {"asset_map": Path, "compliance_map": Path}.

19.1 asset-map.json (build_asset_map)

A finding is matched to an asset by AssetIndex.resolve_finding(): the asset's id, then an ARN taken from resource_id or resource_arn, then a name or an ARN tail that only one asset has. A name shared by several assets matches none of them. compliance-map.json uses the same matching.

Key	Type	Meaning
total_assets	int	Every inventory asset.
assets_with_findings	int	Assets with at least one finding.
assets	list[object]	One entry per asset, sorted by descending finding_count.

assets[]:

Key	Type	Meaning
id, arn, name	str	From the asset.
type	str	asset_type.
provider, region, account_id	str	From the asset.
internet_exposed	bool	is_internet_exposed.
finding_count	int	Matched findings.
severity_breakdown	dict[str, int]	Severity → count, only severities present.
finding_ids	list[str]	Matched Finding.id values.

{
  "total_assets": 2459,
  "assets_with_findings": 2,
  "assets": [
    {
      "id": "92649f95-d721-44b8-838a-2daa38b93b50",
      "arn": "arn:aws:ec2:us-east-1:123456789012:security-group/sg-b4e351810f4ebd730",
      "name": "default",
      "type": "SECURITY_GROUP",
      "provider": "AWS",
      "region": "us-east-1",
      "account_id": "123456789012",
      "internet_exposed": false,
      "finding_count": 1,
      "severity_breakdown": {"HIGH": 1},
      "finding_ids": ["c61c2f13-6054-4c5c-a019-64601657a104"]
    }
  ]
}

19.2 compliance-map.json (build_compliance_map)

Key	Type	Meaning
frameworks	dict[str, object]	Framework name → entry, sorted by name.
total_frameworks	int	Number of frameworks.
total_inventory_assets	int	Every inventory asset.

frameworks[<name>]:

Key	Type	Meaning
findings	int	Findings tagged with the framework.
severity_breakdown	dict[str, int]	Severity → count.
affected_assets	list[str]	Sorted identifiers (arn, else id) of the inventory assets those findings hit; a finding whose resource is not in the inventory contributes its resource_arn.
affected_asset_count	int	len(affected_assets).

{
  "frameworks": {
    "CIS": {
      "findings": 2,
      "severity_breakdown": {"HIGH": 2},
      "affected_assets": [
        "arn:aws:ec2:us-east-1:123456789012:security-group/sg-a1c39e0ced3e8f2c6",
        "arn:aws:ec2:us-east-1:123456789012:security-group/sg-b4e351810f4ebd730"
      ],
      "affected_asset_count": 2
    }
  },
  "total_frameworks": 2,
  "total_inventory_assets": 2459
}

---