Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
AWS - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="integration-benefits">Integration Benefits</h2> <ul><li>Visualize AWS cloud resources across several services in the JupiterOne graph.</li> <li>Map AWS users to employees in your JupiterOne account.</li> <li><p>Monitor visibility and governance of your AWS cloud environment by leveraging<br> hundreds of out of the box queries.</p></li> <li><p>Monitor compliance against the AWS CIS Framework and other security benchmarks<br> using the JupiterOne compliance app.</p></li> <li><p>Monitor AWS vulnerabilities and findings from multiple services within the<br> alerts app.</p></li> <li><p>Monitor changes to your AWS cloud resources using multiple JupiterOne alert<br> rule packs specific to AWS.</p></li> <li><p>Monitor several out of the box dashboards of your security across AWS<br> services.</p></li> <li><p>Create automated workflows in JupiterOne alerts using SNS & SQS to remediate<br> configuration gaps in AWS.</p></li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li><p>JupiterOne periodically fetches users and cloud resources from AWS to update<br> the graph.</p></li> <li><p>Enable CloudTrail event delivery through EventBridge to capture additional<br> details on supported entities. See the setup guide<br><a rel="nofollow" href="https://support.jupiterone.io/hc/en-us/articles/360051794213-AWS-CloudTrail-Event-Streaming">AWS CloudTrail Event Streaming</a>.</p></li> <li><p>Enable configuration of AWS accounts through Organizations and ingest<br> Organization specific data. See the setup guide<br><a rel="nofollow" href="https://support.jupiterone.io/hc/en-us/articles/1500005364921-AWS-Organizations">AWS Organizations</a>.</p></li> <li><p>Write JupiterOne queries to review and monitor updates to the graph, or<br> leverage existing queries.</p></li> <li><p>Configure alerts to take action when the JupiterOne graph changes, or leverage<br> existing alerts.</p></li> </ul><p>Note:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Information is ingested from all AWS regions that do not require additional contractual arrangements with AWS. Please submit a JupiterOne support request if you need to monitor additional regions. </pre> <h2 data-id="requirements">Requirements</h2> <ul><li><p>JupiterOne provides a policy statement that defines the needed AWS<br> permissions. An AWS IAM Role must be configured for JupiterOne that allows<br> reading configuration details of supported resources. The Role must be<br> configured to include an External ID provided by JupiterOne.</p></li> <li><p>You must have permission in JupiterOne to install new integrations.</p></li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <p>The integration instance configuration requires the customer's <code class="code codeInline" spellcheck="false" tabindex="0">roleArn</code> to<br> assume in order to read infrastructure information through AWS APIs. The role is<br> configured to require an <code class="code codeInline" spellcheck="false" tabindex="0">externalId</code>; this also must be maintained in the<br> instance configuration.</p> <h3 data-id="in-aws">In AWS</h3> <ol><li>Detailed setup instructions and a pre-built CloudFormation Stack are provided<br> in the application and maintained in the public <a rel="nofollow" href="https://github.com/jupiterone/jupiterone-aws-integration">JupiterOne AWS<br> CloudFormation</a> project on Github. Follow the steps under <strong>In<br> JupiterOne</strong> to capture the auto-generated <strong>External ID</strong> specific to the<br> integration instance.</li> </ol><h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>AWS</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this AWS account in<br> JupiterOne. Ingested entities will have this value stored in <code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code><br> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Enter the <strong>Role ARN</strong> of the IAM role to assume in order to authenticate with<br> AWS.</p></li> </ul><ol start="4"><li>Click <strong>Create Configuration</strong> once all values are provided.</li> </ol><p>Do not select the **Auto-configure additional integrations... **option yet.</p> <h3 data-id="set-permissions">Set Permissions</h3> <p>The AWS integration requires security auditor permissions into the target AWS<br> account, as defined by a combination of the <a rel="nofollow" href="https://console.aws.amazon.com/iam/home#policies/arn:aws:iam::aws:policy/SecurityAudit">SecurityAudit</a> IAM policy<br> managed by AWS, and a few additional <code class="code codeInline" spellcheck="false" tabindex="0">List*</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Get*</code>, and <code class="code codeInline" spellcheck="false" tabindex="0">Describe*</code><br> permissions missing from the AWS managed policy. The exact policy and permission<br> statements can be found in the public <a rel="nofollow" href="https://github.com/jupiterone/jupiterone-aws-integration">JupiterOne AWS CloudFormation</a> project<br> on Github.</p> <p>See the <a rel="nofollow" href="https://community.askj1.com/kb/articles/845-jupiterone-data-model-for-aws-iam-access-and-trusts">AWS data model map</a> for more information about the IAM access and<br> trusts.</p> <h3 data-id="manage-sub-accounts">Manage Sub-Accounts</h3> <p>After you have configured your AWS Organization master account in JupiterOne,<br> and have attached specific policies and are using a specific external trust ID.<br> When adding or configuring sub-accounts, remember to note the IAM role name,<br> policies, and external trust ID that you have used for the master account.</p> <p>Use your preferred infrastructure-as-code method to systematically generate an<br> identical J1 IAM role in each of your sub-accounts. Ensure you name the IAM Role<br> identically, attach the same policies, and use the same external trust ID as you<br> used with the master account configuration.</p> <p>In the J1 Integrations UI, select a polling interval and the <strong>Auto-configure<br> additional integrations...</strong> option in your master account configuration.</p> <p>Jupiter1 automatically ingests all sub-accounts from the Organization the next<br> time it polls your environment.</p> <p>To omit specific sub-accounts when auto-configuring J1 AWS integrations from an<br> Organizations master account, add the optional <code class="code codeInline" spellcheck="false" tabindex="0">j1-integration: SKIP</code> tag to the<br> sub-account in your infrastructure-as-code or from the AWS Organizations web<br> console.</p> <h3 data-id="service-control-provider-issues">Service Control Provider Issues</h3> <p>Errors may occur after configuring one or many AWS integrations if there is a<br> Service Control Policy (SCP) blocking specified services or regions. Any AWS<br> Services that JupiterOne cannot ingest are listed in logs of the <em>Integration<br> Jobs</em> found in <strong>Integrations > Configurations > Settings > Jobs</strong>.</p> <p>For each SCP that is blocking JupiterOne ingestion, add the following condition<br> element to your SCP JSON:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">"Condition": { "ArnNotLike": { "aws:PrincipalARN": [ "arn:aws:iam::*:role/JupiterOne*" ] } } </pre> <p>Ensure this ARN matches the IAM Role ARN you used to configure your JupiterOne<br> AWS integration.</p> <p>See the<br><a rel="nofollow" href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html">AWS Service control policies documentation</a><br> for the latest information.</p> <h2 data-id="how-to-uninstall">How to Uninstall</h2> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>AWS</strong> integration tile and click it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entity resources and their metadata (not actual contents) are<br> ingested when the integration runs:</p> <table><thead><tr><th>AWS Service</th> <th>AWS Entity Resource</th> <th>_type : _class of the Entity</th> </tr></thead><tbody><tr><td>Account</td> <td>n/a</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_account</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Account</code></td> </tr><tr><td>ACM</td> <td>ACM Certificate</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_acm_certificate</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Certificate</code></td> </tr><tr><td>API Gateway</td> <td>REST API</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_rest_api</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td>API Gateway V2</td> <td>API</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_api</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td></td> <td>Route</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_route</code> : <code class="code codeInline" spellcheck="false" tabindex="0">ApplicationEndpoint</code></td> </tr><tr><td></td> <td>Authorizer</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_integration</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td></td> <td>Integration</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_authorizer</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>Batch</td> <td>Batch Compute Environment</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_compute_environment</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td></td> <td>Batch Job</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_job</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Process</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Task</code></td> </tr><tr><td></td> <td>Batch Job Definition</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_job_definition</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Function</code></td> </tr><tr><td></td> <td>Batch Job Queue</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_job_queue</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Queue</code></td> </tr><tr><td>CloudFormation</td> <td>Stack</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudformation_stack</code>: <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>CloudFront</td> <td>Distribution</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution</code>: <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td></td> <td></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution_origin</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>CloudWatch</td> <td>Event Rule</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudwatch_metric_alarm</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Monitor</code></td> </tr><tr><td></td> <td>Log Group</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudwatch_log_group</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Logs</code></td> </tr><tr><td>CodeCommit</td> <td>Repository</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_codecommit_repository</code> : <code class="code codeInline" spellcheck="false" tabindex="0">CodeRepo</code></td> </tr><tr><td>CodePipeline</td> <td>Pipeline</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_codepipeline_pipeline</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Workflow</code></td> </tr><tr><td>Config</td> <td>Config Rule</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_config_rule</code> : <code class="code codeInline" spellcheck="false" tabindex="0">ControlPolicy</code></td> </tr><tr><td>DynamoDB</td> <td>DynamoDB Table</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_dynamodb_table</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Database</code></td> </tr><tr><td>EC2</td> <td>AMI Image</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ami</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Image</code></td> </tr><tr><td></td> <td>EC2 Instance</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Host</code></td> </tr><tr><td></td> <td>EC2 Key Pair</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_key_pair</code> : <code class="code codeInline" spellcheck="false" tabindex="0">AccessKey</code></td> </tr><tr><td></td> <td>EBS Volume</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_volume</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Disk</code></td> </tr><tr><td></td> <td>EBS Volume Snapshot*</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_snapshot</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Disk</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Image</code></td> </tr><tr><td></td> <td></td> <td>* To prevent API rate limits and slowing ingestion speed, accounts with >1000 <code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_snapshot</code> entities do not include the <code class="code codeInline" spellcheck="false" tabindex="0">public</code>, <code class="code codeInline" spellcheck="false" tabindex="0">shared</code>, <code class="code codeInline" spellcheck="false" tabindex="0">sharedWithAccounts</code>, and <code class="code codeInline" spellcheck="false" tabindex="0">restorableByUserIds</code> properties</td> </tr><tr><td></td> <td>Elastic IP</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_eip</code> : <code class="code codeInline" spellcheck="false" tabindex="0">IpAddress</code></td> </tr><tr><td></td> <td>Internet Gateway</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_internet_gateway</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td></td> <td>Launch Template</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_launch_template</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td></td> <td>NAT Gateway</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_nat_gateway</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td></td> <td>Network ACL</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_network_acl</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Firewall</code></td> </tr><tr><td></td> <td>Network Interface</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_eni</code> : <code class="code codeInline" spellcheck="false" tabindex="0">NetworkInterface</code></td> </tr><tr><td></td> <td>Route Table</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_route_table</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td></td> <td>Security Group</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Firewall</code></td> </tr><tr><td></td> <td>Subnet</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_subnet</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Network</code></td> </tr><tr><td></td> <td>VPC</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Network</code></td> </tr><tr><td></td> <td>VPN Gateway</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpn_gateway</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td>AutoScaling</td> <td>Auto Scaling Group</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_autoscaling_group</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Deployment</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Group</code></td> </tr><tr><td>ECR</td> <td>ECR Container Repository</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecr_repository</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Repository</code></td> </tr><tr><td></td> <td>ECR Container Image</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecr_image</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Image</code></td> </tr><tr><td></td> <td>ECR Image Scan Finding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecr_image_scan_finding</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>ECS</td> <td>ECS Cluster</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_cluster</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Cluster</code></td> </tr><tr><td></td> <td>ECS Container Instance</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_container_instance</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Host</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Container</code></td> </tr><tr><td></td> <td>ECS Service</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_service</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td></td> <td>ECS Task Definition</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task_definition</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Function</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td></td> <td>ECS Task</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Task</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Process</code></td> </tr><tr><td>EFS</td> <td>EFS File System</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_efs_file_system</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code></td> </tr><tr><td></td> <td>EFS Mount Target</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_efs_mount_target</code> : <code class="code codeInline" spellcheck="false" tabindex="0">NetworkEndpoint</code></td> </tr><tr><td>EKS</td> <td>EKS Cluster</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_eks_cluster</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Cluster</code></td> </tr><tr><td>ELB</td> <td>Application Load Balancer</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_alb</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td></td> <td>Network Load Balancer</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_nlb</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td></td> <td>Classic Load Balancer</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elb</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td></td> <td>Target Group</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_target_group</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Group</code></td> </tr><tr><td></td> <td>Listener</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_listener</code> : <code class="code codeInline" spellcheck="false" tabindex="0">ApplicationEndpoint</code></td> </tr><tr><td></td> <td>ListenerRule</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_listener_rule</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Rule</code></td> </tr><tr><td>ElastiCache</td> <td>Cache Cluster (Memcached)</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticache_memcached_cluster</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Cluster</code></td> </tr><tr><td></td> <td>Replication Group (Redis)</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticache_redis_cluster</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Cluster</code></td> </tr><tr><td></td> <td>Node Group Member</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticache_cluster_node</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Host</code></td> </tr><tr><td></td> <td>Snapshot</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticache_snapshot</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Image</code>,<code class="code codeInline" spellcheck="false" tabindex="0">Backup</code></td> </tr><tr><td>Elasticsearch</td> <td>Elasticsearch Domain</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticsearch_domain</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Cluster</code></td> </tr><tr><td>GuardDuty</td> <td>GuardDuty Detector</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_guardduty_detector</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Assessment</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Scanner</code></td> </tr><tr><td></td> <td>GuardDuty Finding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_guardduty_finding</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>IAM</td> <td>Account Password Policy</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_account_password_policy</code> : <code class="code codeInline" spellcheck="false" tabindex="0">PasswordPolicy</code></td> </tr><tr><td></td> <td>IAM User</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user</code> : <code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr><tr><td></td> <td>IAM User Access Key</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_access_key</code> : <code class="code codeInline" spellcheck="false" tabindex="0">AccessKey</code></td> </tr><tr><td></td> <td>IAM User MFA Device</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">mfa_device</code> : <code class="code codeInline" spellcheck="false" tabindex="0">AccessKey</code></td> </tr><tr><td></td> <td>IAM Group</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_group</code> : <code class="code codeInline" spellcheck="false" tabindex="0">UserGroup</code></td> </tr><tr><td></td> <td>IAM Role</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code> : <code class="code codeInline" spellcheck="false" tabindex="0">AccessRole</code></td> </tr><tr><td></td> <td>IAM User Policy</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user_policy</code> : <code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code></td> </tr><tr><td></td> <td>IAM Group Policy</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_group_policy</code> : <code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code></td> </tr><tr><td></td> <td>IAM Role Policy</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role_policy</code> : <code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code></td> </tr><tr><td></td> <td>IAM Managed Policy</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_policy</code> : <code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code></td> </tr><tr><td></td> <td>IAM SAML Provider</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_saml_provider</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td></td> <td>IAM OpenIDConnect Provider</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_oidc_provider</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td>Access Analyzer</td> <td>Access Analyzer</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_accessanalyzer_analyzer</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Accessment</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Scanner</code></td> </tr><tr><td></td> <td>Access Analyzer Finding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_accessanalyzer_finding</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>Inspector</td> <td>Inspector Assessment Run</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_inspector_assessment</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Assessment</code></td> </tr><tr><td></td> <td>Inspector Finding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_inspector_finding</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>Kinesis</td> <td>Kinesis Stream</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_kinesis_stream</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataCollection</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Queue</code></td> </tr><tr><td>KMS</td> <td>KMS Key</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_kms_key</code> : <code class="code codeInline" spellcheck="false" tabindex="0">CryptoKey</code></td> </tr><tr><td>Lambda</td> <td>Lambda Function</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda_function</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Function</code></td> </tr><tr><td>Macie</td> <td>Macie Service</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_macie</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td></td> <td>Macie Finding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_macie_finding</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>RedShift</td> <td>Redshift Cluster</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_redshift_cluster</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Cluster</code></td> </tr><tr><td>RDS</td> <td>RDS DB Cluster</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_rds_cluster</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Cluster</code></td> </tr><tr><td></td> <td>RDS DB Instance</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_db_instance</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Host</code></td> </tr><tr><td></td> <td>RDS DB Instance Snapshot</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_db_snapshot</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Image</code></td> </tr><tr><td></td> <td>RDS DB Cluster Snapshot</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_db_cluster_snapshot</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Database</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Image</code></td> </tr><tr><td>Route53</td> <td>Route53 Domain</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_route53_domain</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Domain</code></td> </tr><tr><td></td> <td>Route53 Hosted Zone</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_route53_zone</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DomainZone</code></td> </tr><tr><td></td> <td>Route53 RecordSet</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_route53_record</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DomainRecord</code>,</td> </tr><tr><td>S3</td> <td>S3 Bucket</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket</code> : <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code></td> </tr><tr><td></td> <td>S3 Bucket Policy</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket_policy</code> : <code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code></td> </tr><tr><td>SNS</td> <td>SNS Subscription</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_sns_subscription</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Subscription</code></td> </tr><tr><td></td> <td>SNS Topic</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_sns_topic</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Channel</code></td> </tr><tr><td>SQS</td> <td>SQS Queue</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_sqs_queue</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Queue</code></td> </tr><tr><td>SSM</td> <td>SSM Patch Baseline</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_baseline</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td></td> <td>SSM Patch Group</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_group</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Group</code></td> </tr><tr><td></td> <td>SSM Patch State</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_state</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Logs</code></td> </tr><tr><td></td> <td>SSM Parameter</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_secure_string_parameter</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Secret</code></td> </tr><tr><td></td> <td>Instance Inventory</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance_inventory</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>Transfer</td> <td>Transfer Server (SFTP)</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_transfer_server</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Host</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td></td> <td>Transfer User (SFTP)</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_transfer_user</code> : <code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr><tr><td>WAF</td> <td>Web ACL</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_waf_web_acl</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Firewall</code></td> </tr><tr><td>WAF V2</td> <td>Web ACL</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_waf_v2_web_acl</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Firewall</code></td> </tr><tr><td>WorkSpaces</td> <td>Workspace</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_workspace</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Host</code></td> </tr><tr><td></td> <td>Bundle</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_workspaces_bundle</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created/mapped:</p> <h4 data-id="basic-relationships-within-the-integration-instance-account-resources">Basic relationships within the integration instance account/resources</h4> <table><thead><tr><th>Relationships</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_account</code> (master) <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_account</code> (sub-account)</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_account</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">Service</code> (e.g. <code class="code codeInline" spellcheck="false" tabindex="0">aws_ec2</code>, <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam</code>, ...)</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_acm</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_acm_certificate</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_compute_environment</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_job_definition</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_job_queue</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_compute_environment</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_cluster</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_compute_environment</code> <strong>ASSIGNED</strong>|<strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_job_queue</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_batch_job</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_apigateway</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_rest_api</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_rest_api</code> <strong>TRIGGERS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda_function</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_api</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_route</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_route</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_integration</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_route</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_authorizer</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_integration</code> <strong>CONNECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">resource</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_authorizer</code> <strong>CONNECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">resource</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_autoscaling_launch_configuration</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ami</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution</code> <strong>CONNECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_rest_api</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution</code> <strong>CONNECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution</code> <strong>TRIGGERS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda_function</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_acm_certificate</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution_origin</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudtrail</code> <strong>LOGS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudtrail</code> <strong>LOGS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudwatch_log_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudwatch_event_rule</code> <strong>TRIGGERS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda_function</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_codecommit</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_codecommit_repository</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_codepipeline</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_codepipeline_pipeline</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_config</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_config_rule</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_config_rule</code> <strong>EVALUATES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_account</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_config_rule</code> <strong>EVALUATES</strong> <code class="code codeInline" spellcheck="false" tabindex="0"><AWS Resource></code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_dynamodb</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_dynamodb_table</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_dynamodb_table</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_kms_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ec2</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ec2</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_subnet</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ec2</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_volume</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ec2</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_launch_template</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ec2</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_network_acl</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ec2</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_autoscaling_group</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_volume</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_eip</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_eni</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ami</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_volume</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_snapshot</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_volume</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_snapshot</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_volume</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_kms_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>LOGS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_state</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance_inventory</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_nat_gateway</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_eni</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_eip</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_eni</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_eip</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>CONTAINS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_subnet</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_nat_gateway</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_internet_gateway</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_vpn_gateway</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_route_table</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>LOGS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudwatch_log_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>LOGS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_subnet</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_subnet</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_route_table</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_network_acl</code> <strong>PROTECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_subnet</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecr</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecr_repository</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecr_repository</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecr_image</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecr_image</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecr_image_scan_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_cluster</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task_definition</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_cluster</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_service</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_cluster</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_container_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_cluster</code> <strong>RUNS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_container_instance</code> <strong>RUNS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task_definition</code> <strong>ASSIGNED</strong>|<strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task_definition</code> <strong>DEFINES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_service</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task_definition</code> <strong>DEFINES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_service</code> <strong>TRIGGERS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_task</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>RUNS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_ecs_container_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_efs</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_efs_file_system</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_efs_file_system</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_efs_mount_point</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_efs_mount_point</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_eni</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_subnet</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_efs_mount_point</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_eks</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_eks_cluster</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticloadbalancing</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_alb</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_nlb</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_elb</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticache_redis_cluster</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticache_cluster_node</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_alb</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_acm_certificate</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_alb</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_nlb</code> <strong>CONNECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_target_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_alb</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_nlb</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_elb</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_listener</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elb</code> <strong>CONNECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_target_group</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda_function</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_target_group</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_eip</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_eni</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_listener</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_listener_rule</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_guardduty_detector</code> <strong>IDENTIFIED</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_guardduty_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_guardduty_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_group_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_oidc_provider</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_group</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_group_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_group</code> <strong>CONTAINS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_group</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_accessanalyzer_analyzer</code> <strong>IDENTIFIED</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_accessanalyzer_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_inspector_assessment</code> <strong>IDENTIFIED</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_inspector_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_inspectorv2</code> <strong>SCANS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_inspector_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_kinesis</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_kinesis_stream</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_kinesis_stream</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_kms_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda_function</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda_function</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda_function</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_redshift</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_redshift_cluster</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_redshift_cluster</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_rds</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_rds_cluster</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_rds</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_db_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_rds_cluster</code> <strong>CONTAINS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_db_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_rds_cluster</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_kms_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_rds_cluster</code> <strong>CONTAINS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_db_cluster_snapshot</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_db_instance</code> <strong>CONTAINS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_db_snapshot</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_route53</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_route53_domain</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_route53</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_route53_zone</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_route53_zone</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_route53_record</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_db_instance</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_kms_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_s3</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_kms_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_macie_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code> <strong>PROTECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">resource</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ec2</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_efs_mount_target</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_eks_cluster</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticache_cluster</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticache_cluster</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticache_snapshot</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elasticsearch_domain</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elb</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_nlb</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_alb</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lb</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_hsm</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_lambda_function</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_rds_cluster</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_db_resource</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_baseline</code> <strong>GENERATED</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_state</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_group</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_group</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_baseline</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_redshift_cluster</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_sns_topic</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_sns_subscription</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ssm</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_baseline</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ssm</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_patch_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ssm</code> <strong>MANAGES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_ssm</code> <strong>MANAGES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_secure_string_parameter</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_transfer_server</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_transfer_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_s3_bucket</code> <strong>ALLOWS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_transfer_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code> <strong>ASSIGNED</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_transfer_server</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code> <strong>ASSIGNED</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_transfer_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_waf</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_waf_web_acl</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_waf_v2</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_waf_v2_web_acl</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_waf_v2_web_acl</code> <strong>PROTECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">resource</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_waf_web_acl</code> <strong>PROTECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_cloudfront_distribution</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_workspace</code> <strong>USES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_workspaces_bundle</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_subnet</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_workspace</code></td> </tr></tbody></table><h3 data-id="mapped-relationships-connections-to-broader-entity-resources">Mapped Relationships - connections to broader entity resources</h3> <table><thead><tr><th>Relationships</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user</code> <strong>IS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">Person</code> <em>See Note 1</em></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_route53_record</code> <strong>CONNECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">Host</code> or <code class="code codeInline" spellcheck="false" tabindex="0">Gateway</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">Domain</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_route53_zone</code> <em>See Note 2</em></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_network_acl_rule</code> <strong>ALLOWS/DENIES</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_resource</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_security_group_rule</code> <strong>ALLOWS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_resource</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> <strong>CONNECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code> (VPC Peering Connections)</td> </tr></tbody></table><p>!!! note</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">1. This is mapped automatically only when the IAM user has an `Email` tag, or the `username` of the IAM User is an email that matches that of a `Person` entity in the graph. 2. `Domain` entities include domains registered on AWS Route53 (i.e. `aws_route53_domain`) and those registered outside of AWS and added into JupiterOne separately (e.g. a domain registered on GoDaddy). </pre> <h3 data-id="advanced-mappings">Advanced mappings</h3> <p>The AWS integration performs analysis of security group rules, IAM policies, and<br> assume role trust policies to determine the following mapping:</p> <table><thead><tr><th>Relationships</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code> <strong>TRUSTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_<service></code> (within the same account)</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code> <strong>TRUSTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_user</code> or <code class="code codeInline" spellcheck="false" tabindex="0">aws_account</code> (cross-account)</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_policy</code> <strong>ALLOWS</strong> <code class="code codeInline" spellcheck="false" tabindex="0"><Resource></code> <em>See notes below</em></td> </tr></tbody></table><p>!!! note</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">This creates permission relationships from an IAM policy -- including both managed policies (i.e. `aws_iam_policy`) and inline polices (i.e. `aws_iam_user_policy`, `aws_iam_group_policy` and `aws_iam_role_policy`) -- to other AWS entities based on the actions and resources specified by the policy document. **TIP** Use `AccessPolicy` class in a query to easily include all types of IAM policies. **TIP** The `actions` property on the permissions relationships/edges are normalized to all lowercase and stored in `normalizedActions` property. Use this property for case insensitive querying of IAM permissions. </pre> <h3 data-id="protips-and-best-practices">ProTips and Best Practices</h3> <ul><li><p>Tag your resources with the following tags:</p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">Classification</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">Owner</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">PII</code> or <code class="code codeInline" spellcheck="false" tabindex="0">PHI</code> or <code class="code codeInline" spellcheck="false" tabindex="0">PCI</code> (<code class="code codeInline" spellcheck="false" tabindex="0">boolean</code> to indicate data type)</li> </ul></li> <li><p>Use email address as the <code class="code codeInline" spellcheck="false" tabindex="0">username</code> for your <strong>IAM Users</strong>, or tag them with<br><code class="code codeInline" spellcheck="false" tabindex="0">Email</code> tag, so that they can be automatically mapped to a <code class="code codeInline" spellcheck="false" tabindex="0">Person</code> (i.e.<br><code class="code codeInline" spellcheck="false" tabindex="0">employee</code>) entity.</p></li> <li><p>Configure tagging as part of your integration configuration (in JupiterOne),<br> under Advanced Options, to tag the</p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">AccountName</code> and</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">Production</code> flag, if applicable.</li> </ul></li> <li><p>Configure your integration name to be the same as your AWS account alias.</p></li> </ul><h3 data-id="multi-region-support">Multi-region Support</h3> <p>Multi-region support is built-in to the integration to ensure maximum<br> visibility, especially to discover resources in an unauthorized region.</p> <h4 data-id="supported-regions">Supported Regions</h4> <p><strong>Americas:</strong></p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">ca-central-1</code> Montreal</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">us-east-1</code> N. Virginia</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">us-east-2</code> Ohio</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">us-west-1</code> N. California</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">us-west-2</code> Oregon</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">sa-east-1</code> São Paulo</li> </ul><p><strong>Europe:</strong></p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">eu-central-1</code> Frankfurt</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">eu-central-2</code> Zurich</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">eu-north-1</code> Stockholm</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">eu-west-1</code> Ireland</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">eu-west-2</code> London</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">eu-west-3</code> Paris</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">eu-south-1</code> Milan</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">eu-south-2</code> Spain</li> </ul><p><strong>Asia Pacific:</strong></p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">ap-northeast-1</code> Tokyo</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">ap-northeast-2</code> Seoul</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">ap-northeast-3</code> Osaka</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">ap-south-1</code> Mumbai</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">ap-south-2</code> Hyderabad</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">ap-southeast-1</code> Singapore</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">ap-southeast-2</code> Sydney</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">ap-southeast-3</code> Jakarta</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">ap-southeast-4</code> Melbourne</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">ap-east-1</code> Hong Kong</li> </ul><p><strong>Africa:</strong></p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">af-south-1</code> Cape Town</li> </ul><p><strong>Middle East</strong></p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">me-south-1</code> Bahrain</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">me-central-1</code> UAE</li> </ul><p><strong>GovCloud:</strong></p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">us-gov-east-1</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">us-gov-west-1</code></li> </ul><h3 data-id="unsupported-regions">Unsupported Regions</h3> <p>All AWS regions are supported except for the following:</p> <p><strong>China Regions:</strong></p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">cn-north-1</code> Beijing</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">cn-northwest-1</code> Ningxia</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line"><em>Customers who wish to use the China Regions are required to sign up for a<br> separate set of account credentials unique to China services.</em></p> </div></blockquote> </article> </main>
.png)