Identifier formats¶
What can appear in arn, in metadata.aliases and as a relation target. The linker
(INVENTORY_INTERNALS.md) resolves any of these.
| Format | Example | Used for |
|---|---|---|
| AWS ARN | arn:aws:sqs:us-east-1:123456789012:orders |
every AWS resource that has an ARN; partitions aws-cn, aws-us-gov are accepted |
| AWS synthetic ARN | arn:aws:ec2:us-east-1:123456789012:route-table/rtb-… |
EC2 sub-resources whose API returns no ARN; built the same way AWS would |
| AWS account node | arn:aws:iam::123456789012:root |
CLOUD_ACCOUNT (mapped or external) and account principals ("123456789012" in a policy resolves here) |
| cloudg AWS synthetic | cloudg:aws:<service>:<region>:<account>:<id> |
resources without any native identifier, not-enabled security services, the organization when its ARN is unknown (cloudg:aws:organization:<id>), the landing zone fallback (cloudg:aws:controltower:landing-zone) |
| Cloud Control synthetic | cloudcontrol:<CFN type>:<region>:<account>:<identifier> |
Cloud Control hits whose model has no ARN |
| AWS security alias | aws-security:<service>:<region>:<account> |
"the GuardDuty / Inspector / … deployment here", an alias on the real asset and on the placeholder |
| EKS Kubernetes object | k8s://<cluster ARN>/<namespace>/<Kind>/<name> |
namespaces use namespace _cluster; e.g. k8s://arn:aws:eks:…:cluster/prod/payments/Deployment/api |
| Azure resource ID | /subscriptions/<sub>/resourceGroups/<rg>/providers/<ns>/<type>/<name> |
every Azure resource; compared case-insensitively (lower-cased copies are indexed) |
| Azure subscription | /subscriptions/<sub> |
subscription CLOUD_ACCOUNT |
| Azure management group | /providers/Microsoft.Management/managementGroups/<name> |
management group ORG_UNIT |
| Entra principal | entra:principal/<objectId> |
users, groups, service principals, managed identities (lower case) |
| Log Analytics | loganalytics:<customerId> |
alias of a Log Analytics workspace, for references by workspace ID |
| Azure security alias | azure-security:<service>:<subscription> |
Defender plan assets |
| Azure host names | <name>.azurecr.io, <name>.vault.azure.net, <app>.azurewebsites.net |
lower-case aliases; image references resolve to their registry login server |
| GCP full resource name | //compute.googleapis.com/projects/p/zones/z/instances/i |
every GCP resource (CAI name) |
| GCP project node | //cloudresourcemanager.googleapis.com/projects/<id> |
project CLOUD_ACCOUNT / container |
| GCP service account ref | serviceAccount:<email> |
alias of every service account; how relations name them |
| GCP principal | gcp-principal:user:alice@example.com |
IAM members that are not collected resources |
GCP parity identifiers:
| Format | Example | Used for |
|---|---|---|
| GCP security service | gcp-security:scc:organizations/999 |
Alias of an enabled security service and of its "not enabled" placeholder. SCC notification configs, exports and mute rules target it. |
| GCP API-only resource | //dns.googleapis.com/projects/p/managedZones/z/rrsets/www.example.com./A |
Resources read from a service API instead of Cloud Asset Inventory, named in the same //<service>.googleapis.com/ form |
| GCP predefined role | //iam.googleapis.com/roles/storage.admin |
IAM_ROLE assets for bound predefined roles (custom roles keep their CAI name) |
| GCP authorizer | <API config name>/authorizers/<provider> |
JWT providers of an API Gateway config |
| GCP instance by number | gcp-instance-id:<project>/<instance id>, //compute.googleapis.com/projects/p/zones/z/instances/<id> |
Aliases of a VM, for Monitoring filters and OS Config reports that name it by number |
| GKE Kubernetes SA | k8s-gke://<pool project>/<namespace>/<ksa> | Workload Identity Kubernetes service accounts |
| Short IDs and names | vpc-0897edd53e9ac20d7, orders-worker, sg-… | indexed for every asset (name, last ARN segment, known *_id metadata keys); resolved with account/region scoping |
| Endpoints | https://sqs.us-east-1.amazonaws.com/1234…/orders, web-alb-1.us-east-1.elb.amazonaws.com, orders-uploads.s3.amazonaws.com, <repo URI> | queue URLs, load balancer and CloudFront DNS names, bucket domains, ECR repository URIs |
Identifiers added with the Azure parity work:
| Format | Example | Used for |
|---|---|---|
| Entra tenant | entra:tenant/<tenantId> |
the tenant ORGANIZATION from Microsoft Graph; target of directory-role grants and gallery sharing with a tenant |
| Entra application | entra:application/<objectId>, alias entra:app/<appId> |
app registrations (APP_REGISTRATION) |
| Entra directory role | entra:directoryRole/<roleDefinitionId> |
directory role definitions (IAM_POLICY) |
| Entra user principal name | entra:upn/<upn> |
alias of an Entra user |
| Client ID | azure-client-id:<clientId> |
alias of a user-assigned identity and of a service principal; what the AKS Workload ID annotation names |
| Azure role definition | azure-role:<guid>, plus /subscriptions/<sub>/providers/Microsoft.Authorization/roleDefinitions/<guid> |
RBAC role definitions (IAM_POLICY); built-in roles use /providers/Microsoft.Authorization/roleDefinitions/<guid> as arn |
| Policy definition | azure-policy-definition:<guid> |
alias of a policy definition with a GUID name |
| Messaging entity | <namespace>.servicebus.windows.net/<entity>, servicebus:<namespace>/<entity>, servicebus-queue:<name>, servicebus-topic:<name>, eventhub:<name> |
Service Bus queues and topics and Event Hubs; the host form is what Stream Analytics and action groups name, the bare forms what function bindings name |
| Defender aggregates | cloudg:azure:defender-cspm:<sub>, cloudg:azure:defender-alerts:<sub> |
the recommendations (SECURITY_HUB) and alerts (THREAT_DETECTOR) assets |
| Synthetic children | <listener ID> under .../applicationGateways/<gw>/httpListeners/<name>, <function ID>/timers/<binding>, <workflow ID>/triggers/<name>, <api ID>/authorizers/jwt, <account ID>/regions/<region> |
assets built from embedded properties: Application Gateway listeners, function timers, Logic Apps recurrence triggers, APIM JWT validation, Cosmos DB replica regions |
| AKS Kubernetes object | k8s://<cluster resource ID>/<namespace>/<Kind>/<name> |
in-cluster AKS objects, same scheme as EKS |
| OIDC issuer | the AKS oidcIssuerProfile.issuerURL, with and without the trailing slash |
alias of the AKS cluster, so federated credentials resolve to it |