summary

Section 9 · From docs/INVENTORY_REFERENCE.md on GitHub

InventoryResult.summary, also the summary object of inventory-map.json.

Key	Type	How it is computed
total_assets	int	len(assets).
total_edges	int	len(edges), all edge kinds.
providers	list[str]	Same as InventoryResult.providers.
assets_by_type	dict[str, int]	Count per asset_type, sorted by descending count.
assets_by_service	dict[str, int]	Count per cloud service, sorted by descending count. The service is derived from the identifier: the third field of an ARN (lambda, ec2, iam), kubernetes for k8s:// and k8s-gke://, iam for gcp-principal:, entra for entra:, the third field of a cloudg: identifier (inspector2), the lower-cased provider namespace for Azure (microsoft.network), the API host prefix for GCP (compute, storage), else unknown (Cloud Control synthetic identifiers land here).
assets_by_region	dict[str, int]	Count per region, in first-seen order.
assets_by_account	dict[str, int]	Count per account_id, "unknown" for None, first-seen order. External placeholders count under their account.
edges_by_type	dict[str, int]	Count per edge_type, first-seen order.
edges_by_relationship	dict[str, int]	Count per relationship (edges without one are not counted), descending.
unlinked_assets	int	Assets that are an endpoint of no edge except hierarchy edges, not counting ORGANIZATION, ORG_UNIT and CLOUD_ACCOUNT. A high number means many assets are only attached to their account.
internet_exposed	int	Assets with is_internet_exposed.
accounts	int	Distinct account_id values other than unknown, including external accounts.
cross_account_edges	int	Non-hierarchy edges whose two endpoints are assets in different accounts, excluding edges between two hierarchy-type assets.
external_accounts	int	CLOUD_ACCOUNT assets with metadata.external true.
security_service_gaps	int	Assets with metadata.security_service set and metadata.enabled exactly False.
unresolved_references	int	len(unresolved_references); 2000 means the cap was hit.
organization	dict	Only when an organization was mapped: {"id", "accounts", "ous", "control_tower", "governed_regions"}, see below.
throttling	dict	Only when a cloud API throttled the run: {"totals", "messages", "skipped"} from InventoryResult.throttling.

summary.organization:

Key	Type	Meaning
id	str \| None	Organization ID, o-….
accounts	int	Accounts in the organization (all, not only the selected ones).
ous	int	Organizational units, roots not counted.
control_tower	bool	A landing zone was found.
governed_regions	list[str]	Control Tower governed regions, empty without Control Tower.

Example (counts dictionaries shortened):

{
  "total_assets": 2459,
  "total_edges": 2547,
  "providers": ["aws"],
  "assets_by_type": {"SNAPSHOT": 2354, "SUBNET": 14, "SECURITY_GROUP": 5, "ROUTE_TABLE": 5, "VPC": 4, "…": 0},
  "assets_by_service": {"ec2": 2395, "iam": 11, "organizations": 7, "elasticloadbalancing": 3, "ecs": 3, "…": 0},
  "assets_by_region": {"global": 21, "us-east-1": 2438},
  "assets_by_account": {"123456789012": 1252, "552289857375": 1206, "999999999999": 1},
  "edges_by_type": {"SECURITY_GROUP_RULE": 6, "CONTAINS": 2467, "MANAGES": 1, "GOVERNS": 13, "INVOKES": 4, "…": 0},
  "edges_by_relationship": {"ACCOUNT_CONTAINS_REGION": 2410, "SUBNET_CONTAINS_INSTANCE": 11, "RUNS_ON": 9, "…": 0},
  "unlinked_assets": 2372,
  "internet_exposed": 5,
  "accounts": 3,
  "cross_account_edges": 5,
  "external_accounts": 1,
  "security_service_gaps": 9,
  "unresolved_references": 2000,
  "organization": {
    "id": "o-1wietecbs4",
    "accounts": 2,
    "ous": 2,
    "control_tower": false,
    "governed_regions": []
  }
}

The 2354 snapshots and the capped unresolved_references are an artefact of the simulator, which returns a large set of public EBS snapshots; a real account lists its own snapshots only.

---