Organization assets on the map

Section 18 · From docs/INVENTORY_REFERENCE.md on GitHub

topology.to_assets() (organization_assets.topology_assets) adds these assets to the map (with aws.organization.map_structure, on by default). All are provider: AWS; unless noted, account_id is the management account and region is global.

Asset	asset_type	arn	Metadata	Declared relations
Organization	ORGANIZATION	organization ARN	organization_id, feature_set, management_account_id, control_tower, enabled_services, delegated_administrators; alias the org ID	management account MANAGES / OWNED_BY → organization (reverse)
Root	ORG_UNIT	root ARN	ou_id, is_root: true, path: ["Root"]; alias the root ID	organization CONTAINS → root (reverse)
OU	ORG_UNIT	OU ARN	ou_id, is_root: false, path; alias the OU ID	parent CONTAINS → OU (reverse)
Account	CLOUD_ACCOUNT	arn:aws:iam::<id>:root	account_id, status, ou_path, email, joined_method, joined, management_account, control_tower_role, delegated_admin_for; aliases the Organizations ARN and the ID. account_id is the account itself.	parent CONTAINS / ORG_CONTAINS_ACCOUNT → account (reverse)
Policy	ORG_POLICY	policy ARN	policy_id, policy_type, aws_managed, target_count; alias the policy ID	GOVERNS / SCP_RESTRICTS (SCPs) or GOVERNS / COMPLIANCE_GOVERNS (other types) → each target
Landing zone	LANDING_ZONE	landing zone ARN	version, latest_available_version, status, drift_status, governed_regions, shared_accounts, home_region; region is the home region	MANAGES / COMPLIANCE_GOVERNS → organization; MANAGES / OWNED_BY → each shared account (property role)
Control	GUARDRAIL	control ARN	kind: "control", control_identifier, status, drift_status; region is the home region	GOVERNS / COMPLIANCE_GOVERNS → target OU
Baseline	GUARDRAIL	baseline ARN	kind: "baseline", baseline_identifier, baseline_version, status	GOVERNS / COMPLIANCE_GOVERNS → target

Because account nodes use arn:aws:iam::<id>:root, the same identifier IAM trust and resource policies use for account principals, cross-account grants from any collected account land on the organization's account nodes.

Azure management groups and GCP folders follow the same pattern (ORG_UNIT, CLOUD_ACCOUNT, GUARDRAIL for Azure Policy assignments, exemptions, GCP organization policies and VPC Service Controls perimeters); see INVENTORY_INTERNALS.md.

---