Edge types and direction

Section 6 · From docs/INVENTORY_REFERENCE.md on GitHub

Direction always reads source verb target. The dependency column is how DependencyGraph turns the edge into a "dependent needs dependency" arrow (cloudg.inventory.dependencies.DEPENDENCY_DIRECTION): forward means the source depends on the target, reverse means the target depends on the source, ignored means the edge does not take part in dependency analysis.

edge_type	Reads as	Typical source → target	Dependency
REFERENCES	uses / points at	function → secret, table → KMS key, queue → DLQ, anything → anything (generic pass)	forward
ATTACHED_TO	is attached to	instance → security group, volume → instance, ENI → instance, IGW → VPC	forward
ROUTE	routes through / forwards to	route table → gateway, DNS record → load balancer, transit gateway → attachment, Ingress → Service	forward
PEERING	peers with	VPC → peering connection → VPC	forward
USES_IMAGE	runs the image of	task definition / workload / function / build project → container registry	forward
ASSUMES_ROLE	runs as	function, task, nodegroup, Kubernetes SA, instance profile, GCP workload → role / service account	forward
LOGS_TO	sends logs to	trail, flow log, LB, API stage, function → log destination	forward
LOAD_BALANCER_TARGET	sends traffic to	load balancer → target group → instance / IP / function; Kubernetes Service → workload	forward
GRANTS_ACCESS	is granted access to	principal → resource its policy names; principal → EKS cluster; Azure principal → scope	forward
IAM_POLICY_ATTACHMENT	has policy	user / group / role → managed policy	forward
IAM_TRUST	may assume	principal / account / provider → role	forward
CONTAINS	contains	VPC → subnet, subnet → instance, cluster → namespace, account → resource, OU → account	reverse
INVOKES	triggers / calls	bucket → function, queue → function, rule → target, topic → queue	reverse
PROTECTS	protects	WAF → ALB / API / distribution, firewall → VPC, Shield → resource	reverse
MONITORS	monitors	Inspector → instance / repository / function, GuardDuty → account, alarm → resource	reverse
MANAGES	manages	stack → resource, ASG → instance, landing zone → OU / account, permission set → SSO role	reverse
GOVERNS	governs	SCP / RCP / control / Azure Policy / GCP org policy → OU, account, folder, project	reverse
SECURITY_GROUP_RULE	allows traffic	CIDR → SG (ingress), SG → CIDR (egress)	ignored
NACL_RULE	allows traffic	network ACL rules	ignored
INTERNET_EXPOSED	exposes	0.0.0.0/0 → exposed asset	ignored

CONTAINS edges whose container is an ORGANIZATION, ORG_UNIT or CLOUD_ACCOUNT are skipped by DependencyGraph unless it is built with include_hierarchy=True: they say where something lives, not what breaks with it.

---