Skip to content

aws.md

Latest commit

 

History

History
3864 lines (2375 loc) · 118 KB

aws.md

File metadata and controls

3864 lines (2375 loc) · 118 KB
Raw
title aws Dialect
description See which types this Dialect interprets and which architectural facts its Rules can establish.
Version and compatibility

Version: 0.1.0.

Provider bindings and declared compatibility

  • hashicorp/aws: = 6.62.0.

All official Dialects

Interpreted types

Each row identifies a type and instance kind. Conditional Rules retain their individual conditions in the details below.

Terraform type Kind Classification Rules
aws_alb_target_group resource load-balancer-component alb-target-group
aws_alb resource load-balancer alb
aws_api_gateway_integration resource api-component api-gateway-integration
aws_api_gateway_model resource api-component api-gateway-model
aws_api_gateway_resource resource api-component api-gateway-resource
aws_api_gateway_rest_api resource api-gateway api-gateway-rest-api
aws_api_gateway_stage resource api-component api-gateway-stage
aws_apigatewayv2_api resource api-gateway apigatewayv2-api
aws_apigatewayv2_model resource api-component apigatewayv2-model
aws_appsync_datasource resource appsync-component appsync-datasource
aws_appsync_function resource appsync-component appsync-function
aws_appsync_graphql_api resource appsync-api appsync-graphql-api
aws_appsync_resolver resource appsync-component appsync-resolver
aws_bedrockagent_agent_action_group resource bedrock-agent-component bedrockagent-agent-action-group
aws_bedrockagent_agent resource bedrockagent-agent bedrockagent-agent
aws_cloudwatch_event_bus resource event-bus cloudwatch-event-bus
aws_cloudwatch_event_rule resource event-component cloudwatch-event-rule
aws_cloudwatch_event_target resource event-component cloudwatch-event-target
aws_cognito_user_group resource cognito-component cognito-user-group
aws_cognito_user_pool_domain resource cognito-component cognito-user-pool-domain
aws_cognito_user_pool resource cognito-user-pool cognito-user-pool
aws_connect_contact_flow resource connect-component connect-contact-flow
aws_connect_instance resource connect-instance connect-instance
aws_connect_queue resource connect-component connect-queue
aws_connect_routing_profile resource connect-component connect-routing-profile
aws_connect_security_profile resource connect-component connect-security-profile
aws_connect_user_hierarchy_group resource connect-component connect-user-hierarchy-group
aws_dax_cluster resource managed-cache dax-cluster
aws_db_instance resource managed-database db-instance
aws_db_proxy_default_target_group resource db-proxy-component db-proxy-default-target-group
aws_db_proxy_endpoint resource db-proxy-component db-proxy-endpoint
aws_db_proxy resource db-proxy db-proxy
aws_docdb_cluster_instance resource managed-database-component docdb-cluster-instance
aws_docdb_cluster resource managed-database docdb-cluster
aws_dsql_cluster resource managed-database dsql-cluster
aws_dynamodb_global_secondary_index resource dynamodb-component dynamodb-global-secondary-index
aws_dynamodb_table resource dynamodb-table dynamodb-table
aws_ec2_transit_gateway_vpc_attachment resource transit-gateway-attachment ec2-transit-gateway-vpc-attachment
aws_ec2_transit_gateway resource transit-gateway ec2-transit-gateway
aws_ecr_lifecycle_policy resource repository-configuration ecr-lifecycle-policy
aws_ecr_repository resource container-repository ecr-repository
aws_ecs_cluster resource ecs-cluster ecs-cluster
aws_ecs_service resource ecs-service ecs-service
aws_efs_file_system resource managed-file-storage efs-file-system
aws_eks_cluster resource kubernetes-cluster eks-cluster
aws_eks_fargate_profile resource eks-compute-profile eks-fargate-profile
aws_eks_node_group resource kubernetes-node-pool eks-node-group
aws_elasticache_cluster resource managed-cache elasticache-cluster
aws_elasticache_replication_group resource managed-cache elasticache-replication-group
aws_elb resource load-balancer elb
aws_emr_cluster resource emr-cluster emr-cluster
aws_emr_instance_fleet resource emr-cluster-component emr-instance-fleet
aws_emr_instance_group resource emr-cluster-component emr-instance-group
aws_fsx_lustre_file_system resource managed-file-storage fsx-lustre-file-system
aws_fsx_ontap_file_system resource managed-file-storage fsx-ontap-file-system
aws_fsx_openzfs_file_system resource managed-file-storage fsx-openzfs-file-system
aws_fsx_windows_file_system resource managed-file-storage fsx-windows-file-system
aws_globalaccelerator_accelerator resource global-accelerator globalaccelerator-accelerator
aws_globalaccelerator_custom_routing_accelerator resource global-accelerator globalaccelerator-custom-routing-accelerator
aws_globalaccelerator_custom_routing_endpoint_group resource global-accelerator-component globalaccelerator-custom-routing-endpoint-group
aws_globalaccelerator_custom_routing_listener resource global-accelerator-component globalaccelerator-custom-routing-listener
aws_globalaccelerator_endpoint_group resource global-accelerator-component globalaccelerator-endpoint-group
aws_globalaccelerator_listener resource global-accelerator-component globalaccelerator-listener
aws_iam_group resource identity-group iam-group
aws_iam_instance_profile resource instance-profile iam-instance-profile
aws_iam_role_policy_attachment resource service-identity-binding iam-role-policy-attachment
aws_iam_role resource iam-role iam-role
aws_identitystore_group resource identity-group identitystore-group
aws_instance resource compute-instance instance
aws_internet_gateway resource internet-gateway internet-gateway
aws_kms_alias resource key-alias kms-alias
aws_kms_key resource encryption-key kms-key
aws_lb_listener resource load-balancer-component lb-listener
aws_lb_target_group resource load-balancer-component lb-target-group
aws_lb resource load-balancer lb
aws_memorydb_cluster resource managed-cache memorydb-cluster
aws_nat_gateway resource managed-nat nat-gateway
aws_neptune_cluster_instance resource managed-database-component neptune-cluster-instance
aws_neptune_cluster resource managed-database neptune-cluster
aws_network_acl resource network-acl network-acl
aws_pinpoint_adm_channel resource pinpoint-component pinpoint-adm-channel
aws_pinpoint_apns_channel resource pinpoint-component pinpoint-apns-channel
aws_pinpoint_apns_sandbox_channel resource pinpoint-component pinpoint-apns-sandbox-channel
aws_pinpoint_apns_voip_channel resource pinpoint-component pinpoint-apns-voip-channel
aws_pinpoint_apns_voip_sandbox_channel resource pinpoint-component pinpoint-apns-voip-sandbox-channel
aws_pinpoint_app resource pinpoint-app pinpoint-app
aws_pinpoint_baidu_channel resource pinpoint-component pinpoint-baidu-channel
aws_pinpoint_email_channel resource pinpoint-component pinpoint-email-channel
aws_pinpoint_event_stream resource pinpoint-component pinpoint-event-stream
aws_pinpoint_gcm_channel resource pinpoint-component pinpoint-gcm-channel
aws_pinpoint_sms_channel resource pinpoint-component pinpoint-sms-channel
aws_rds_cluster_activity_stream resource managed-database-component rds-cluster-activity-stream
aws_rds_cluster_endpoint resource managed-database-component rds-cluster-endpoint
aws_rds_cluster_instance resource managed-database-component rds-cluster-instance
aws_rds_cluster resource managed-database rds-cluster
aws_route_table resource route-table route-table
aws_s3_bucket_server_side_encryption_configuration resource storage-configuration s3-bucket-server-side-encryption-configuration
aws_s3_bucket_versioning resource storage-configuration s3-bucket-versioning
aws_s3_bucket resource object-storage-container s3-bucket
aws_s3_directory_bucket resource object-storage-container s3-directory-bucket
aws_security_group resource security-group security-group
aws_sns_topic_subscription resource message-subscription sns-topic-subscription
aws_sns_topic resource message-topic sns-topic
aws_subnet resource subnet subnet
aws_vpc_endpoint resource private-endpoint vpc-endpoint
aws_vpc resource virtual-network vpc
aws_vpn_connection resource vpn-connection vpn-connection
aws_vpn_gateway resource vpn-gateway vpn-gateway

Local vocabulary

Concepts

aws.concept.ai-inference-endpoint Source

A managed endpoint that serves model inference requests.

No Rule in this Dialect uses this definition.

aws.concept.api-component Source

A route, stage, integration, or model contributing to an AWS API boundary.

Used by 5 Rules
aws.concept.api-gateway Source

A managed gateway that exposes and governs APIs.

Used by 7 Rules
aws.concept.appsync-api Source

An AWS AppSync GraphQL API boundary.

Used by 4 Rules
aws.concept.appsync-component Source

An AWS AppSync data source, function, or resolver contributing to an API.

Used by appsync-datasource, appsync-function, appsync-resolver.

aws.concept.backup-plan Source

A managed policy scheduling and retaining backups.

No Rule in this Dialect uses this definition.

aws.concept.backup-vault Source

A managed vault storing protected recovery data.

No Rule in this Dialect uses this definition.

aws.concept.bedrock-agent-component Source

Configuration contributing to an Amazon Bedrock agent.

Used by bedrockagent-agent-action-group.

aws.concept.bedrockagent-agent Source

Amazon Bedrock agent as a durable AWS architecture entity.

Used by bedrockagent-agent, bedrockagent-agent-action-group.

aws.concept.block-storage-volume Source

A durable block-storage volume attachable to compute workloads.

No Rule in this Dialect uses this definition.

aws.concept.cognito-component Source

Configuration contributing to an Amazon Cognito user pool.

Used by cognito-user-group, cognito-user-pool-domain.

aws.concept.cognito-user-pool Source

Amazon Cognito user pool as a durable AWS architecture scope.

Used by cognito-user-group, cognito-user-pool, cognito-user-pool-domain.

aws.concept.compute-instance Source

A provisioned compute instance running a workload.

Used by instance.

aws.concept.connect-component Source

Routing or contact configuration contributing to an Amazon Connect instance.

Used by 5 Rules
aws.concept.connect-instance Source

Amazon Connect instance as a durable AWS architecture entity.

Used by 6 Rules
aws.concept.container-repository Source

An Amazon ECR repository storing container images.

Used by ecr-lifecycle-policy, ecr-repository.

aws.concept.db-proxy Source

Amazon RDS DB proxy as a durable AWS architecture entity.

Used by db-proxy, db-proxy-default-target-group, db-proxy-endpoint.

aws.concept.db-proxy-component Source

An endpoint or target group contributing to an Amazon RDS Proxy.

Used by db-proxy-default-target-group, db-proxy-endpoint.

aws.concept.dedicated-interconnect Source

A dedicated private connection between an external network and a cloud provider.

No Rule in this Dialect uses this definition.

aws.concept.dns-zone Source

A managed DNS namespace containing resource records.

No Rule in this Dialect uses this definition.

aws.concept.dynamodb-component Source

An index contributing to an Amazon DynamoDB table.

Used by dynamodb-global-secondary-index.

aws.concept.dynamodb-table Source

An Amazon DynamoDB table, distinct from a managed database service instance.

Used by dynamodb-global-secondary-index, dynamodb-table.

aws.concept.ecs-cluster Source

An Amazon ECS cluster providing container scheduling capacity.

Used by ecs-cluster, ecs-service.

aws.concept.ecs-service Source

An Amazon ECS service maintaining a container workload.

Used by ecs-service.

aws.concept.eks-compute-profile Source

An Amazon EKS Fargate profile contributing serverless pod capacity.

Used by eks-fargate-profile.

aws.concept.emr-cluster Source

AWS EMR cluster as a durable AWS architecture entity.

Used by emr-cluster, emr-instance-fleet, emr-instance-group.

aws.concept.emr-cluster-component Source

Capacity contributing to an Amazon EMR cluster.

Used by emr-instance-fleet, emr-instance-group.

aws.concept.encryption-key Source

A managed key used for cryptographic operations.

Used by kms-alias, kms-key.

aws.concept.event-bus Source

An Amazon EventBridge event bus.

Used by cloudwatch-event-bus, cloudwatch-event-rule.

aws.concept.event-component Source

An Amazon EventBridge rule or target contributing to an event bus.

Used by cloudwatch-event-rule, cloudwatch-event-target.

aws.concept.global-accelerator Source

An AWS Global Accelerator traffic entry point.

Used by 4 Rules
aws.concept.global-accelerator-component Source

A listener or endpoint group contributing to an AWS Global Accelerator.

Used by 4 Rules
aws.concept.iam-role Source

An AWS IAM role, distinct from an explicitly non-human service principal.

Used by iam-instance-profile, iam-role, iam-role-policy-attachment.

aws.concept.identity-group Source

A managed group principal used to assign access collectively.

Used by iam-group, identitystore-group.

aws.concept.instance-profile Source

An AWS IAM instance profile associating an IAM role with compute.

Used by iam-instance-profile.

aws.concept.internet-gateway Source

Amazon VPC internet gateway as a durable AWS architecture entity.

Used by internet-gateway.

aws.concept.key-alias Source

An AWS KMS alias contributing to an encryption key.

Used by kms-alias.

aws.concept.kubernetes-node-pool Source

A node pool contributing compute capacity to a Kubernetes cluster.

Used by eks-node-group.

aws.concept.load-balancer Source

A load-balancing service composed from routing infrastructure.

Used by 4 Rules
aws.concept.load-balancer-component Source

A listener or target group contributing to an AWS load balancer.

Used by alb-target-group, lb-listener, lb-target-group.

aws.concept.managed-cache Source

A managed in-memory cache service.

Used by 4 Rules
aws.concept.managed-database-component Source

Capacity or an endpoint contributing to a managed database.

Used by 5 Rules
aws.concept.managed-file-storage Source

A managed shared file-storage service.

Used by 5 Rules
aws.concept.managed-nat Source

A managed network address translation service.

Used by nat-gateway.

aws.concept.managed-secret Source

A managed secret identity whose sensitive value stays outside architecture output.

No Rule in this Dialect uses this definition.

aws.concept.message-queue Source

A managed queue buffering work or messages for asynchronous consumers.

No Rule in this Dialect uses this definition.

aws.concept.message-subscription Source

A durable subscription consuming messages from a topic.

Used by sns-topic-subscription.

aws.concept.message-topic Source

A messaging topic receiving messages from publishers.

Used by sns-topic, sns-topic-subscription.

aws.concept.network-acl Source

Amazon VPC network ACL as a durable AWS architecture entity.

Used by network-acl.

aws.concept.network-peering Source

A direct private connectivity agreement between virtual networks.

No Rule in this Dialect uses this definition.

aws.concept.private-endpoint Source

A private endpoint exposing a service inside a virtual network.

Used by vpc-endpoint.

aws.concept.repository-configuration Source

Configuration contributing to an AWS artifact repository.

Used by ecr-lifecycle-policy.

aws.concept.route-table Source

Amazon VPC route table as a durable AWS architecture entity.

Used by route-table.

aws.concept.security-group Source

Amazon VPC security group as a durable AWS architecture entity.

Used by security-group.

aws.concept.serverless-function Source

A managed event-driven function runtime.

No Rule in this Dialect uses this definition.

aws.concept.service-identity-binding Source

An access-control binding that contributes to a service identity.

Used by iam-role-policy-attachment.

aws.concept.storage-configuration Source

Configuration contributing to an AWS storage container.

Used by s3-bucket-server-side-encryption-configuration, s3-bucket-versioning.

aws.concept.transit-gateway Source

An AWS Transit Gateway connecting multiple networks.

Used by ec2-transit-gateway, ec2-transit-gateway-vpc-attachment, vpn-connection.

aws.concept.transit-gateway-attachment Source

A network attachment contributing to an AWS Transit Gateway.

Used by ec2-transit-gateway-vpc-attachment.

aws.concept.vpn-connection Source

A virtual private network connection between network endpoints.

Used by vpn-connection.

aws.concept.vpn-gateway Source

A managed gateway terminating virtual private network connections.

Used by vpn-connection, vpn-gateway.

aws.concept.workflow Source

A managed workflow coordinating steps and service calls.

No Rule in this Dialect uses this definition.

Relations

aws.relation.subscribes-to Source

Introduced by a labeled emission. Used by sns-topic-subscription.

RF Vocabulary used

Rule details

Open a Rule for its declared behavior and source. Matching, emission resolution and composition define how evidence can establish it.

aws.rule.alb-target-group Source

Matches resource instances of aws_alb_target_group.

Classification: aws.concept.load-balancer-component.

aws.rule.alb Source

Matches resource instances of aws_alb.

Classification: aws.concept.load-balancer.

Conditions, identity and resolution

Identity

  • attributes: ["arn"]
  • scope: "global"

Endpoint

  • attributes: ["arn", "id"]
aws.rule.api-gateway-integration Source

Matches resource instances of aws_api_gateway_integration.

Classification: aws.concept.api-component.

Contributions

Conditions, identity and resolution

Contribution through source.rest_api_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.api-gateway-model Source

Matches resource instances of aws_api_gateway_model.

Classification: aws.concept.api-component.

Contributions

Conditions, identity and resolution

Contribution through source.rest_api_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.api-gateway-resource Source

Matches resource instances of aws_api_gateway_resource.

Classification: aws.concept.api-component.

Contributions

Conditions, identity and resolution

Contribution through source.rest_api_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.api-gateway-rest-api Source

Matches resource instances of aws_api_gateway_rest_api.

Classification: aws.concept.api-gateway.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]
aws.rule.api-gateway-stage Source

Matches resource instances of aws_api_gateway_stage.

Classification: aws.concept.api-component.

Contributions

Conditions, identity and resolution

Contribution through source.rest_api_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.apigatewayv2-api Source

Matches resource instances of aws_apigatewayv2_api.

Classification: aws.concept.api-gateway.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]
aws.rule.apigatewayv2-model Source

Matches resource instances of aws_apigatewayv2_model.

Classification: aws.concept.api-component.

Contributions

Conditions, identity and resolution

Contribution through source.api_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.appsync-datasource Source

Matches resource instances of aws_appsync_datasource.

Classification: aws.concept.appsync-component.

Contributions

Conditions, identity and resolution

Contribution through source.api_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.appsync-function Source

Matches resource instances of aws_appsync_function.

Classification: aws.concept.appsync-component.

Contributions

Conditions, identity and resolution

Contribution through source.api_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.appsync-graphql-api Source

Matches resource instances of aws_appsync_graphql_api.

Classification: aws.concept.appsync-api.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]
aws.rule.appsync-resolver Source

Matches resource instances of aws_appsync_resolver.

Classification: aws.concept.appsync-component.

Contributions

Conditions, identity and resolution

Contribution through source.api_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.bedrockagent-agent-action-group Source

Matches resource instances of aws_bedrockagent_agent_action_group.

Classification: aws.concept.bedrock-agent-component.

Contributions

Conditions, identity and resolution

Contribution through source.agent_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.bedrockagent-agent Source

Matches resource instances of aws_bedrockagent_agent.

Classification: aws.concept.bedrockagent-agent.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]
aws.rule.cloudwatch-event-bus Source

Matches resource instances of aws_cloudwatch_event_bus.

Classification: aws.concept.event-bus.

Conditions, identity and resolution

Identity

  • attributes: ["name"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "name"]
aws.rule.cloudwatch-event-rule Source

Matches resource instances of aws_cloudwatch_event_rule.

Classification: aws.concept.event-component.

Contributions

Conditions, identity and resolution

Contribution through source.event_bus_name

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.cloudwatch-event-target Source

Matches resource instances of aws_cloudwatch_event_target.

Classification: aws.concept.event-component.

aws.rule.cognito-user-group Source

Matches resource instances of aws_cognito_user_group.

Classification: aws.concept.cognito-component.

Contributions

Conditions, identity and resolution

Contribution through source.user_pool_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.cognito-user-pool-domain Source

Matches resource instances of aws_cognito_user_pool_domain.

Classification: aws.concept.cognito-component.

Contributions

Conditions, identity and resolution

Contribution through source.user_pool_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.cognito-user-pool Source

Matches resource instances of aws_cognito_user_pool.

Classification: aws.concept.cognito-user-pool.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]
aws.rule.connect-contact-flow Source

Matches resource instances of aws_connect_contact_flow.

Classification: aws.concept.connect-component.

Contributions

Conditions, identity and resolution

Contribution through source.instance_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.connect-instance Source

Matches resource instances of aws_connect_instance.

Classification: aws.concept.connect-instance.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]
aws.rule.connect-queue Source

Matches resource instances of aws_connect_queue.

Classification: aws.concept.connect-component.

Contributions

Conditions, identity and resolution

Contribution through source.instance_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.connect-routing-profile Source

Matches resource instances of aws_connect_routing_profile.

Classification: aws.concept.connect-component.

Contributions

Conditions, identity and resolution

Contribution through source.instance_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.connect-security-profile Source

Matches resource instances of aws_connect_security_profile.

Classification: aws.concept.connect-component.

Contributions

Conditions, identity and resolution

Contribution through source.instance_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.connect-user-hierarchy-group Source

Matches resource instances of aws_connect_user_hierarchy_group.

Classification: aws.concept.connect-component.

Contributions

Conditions, identity and resolution

Contribution through source.instance_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.dax-cluster Source

Matches resource instances of aws_dax_cluster.

Classification: aws.concept.managed-cache.

aws.rule.db-instance Source

Matches resource instances of aws_db_instance.

Classification: rf.concept.managed-database.

Conditions, identity and resolution

Identity

  • attributes: ["arn", "identifier"]
  • scope: "provider"

Endpoint

  • attributes: ["arn", "id", "identifier"]
aws.rule.db-proxy-default-target-group Source

Matches resource instances of aws_db_proxy_default_target_group.

Classification: aws.concept.db-proxy-component.

Contributions

Conditions, identity and resolution

Contribution through source.db_proxy_name

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.db-proxy-endpoint Source

Matches resource instances of aws_db_proxy_endpoint.

Classification: aws.concept.db-proxy-component.

Contributions

Conditions, identity and resolution

Contribution through source.db_proxy_name

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.db-proxy Source

Matches resource instances of aws_db_proxy.

Classification: aws.concept.db-proxy.

Conditions, identity and resolution

Identity

  • attributes: ["name"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "name"]
aws.rule.docdb-cluster-instance Source

Matches resource instances of aws_docdb_cluster_instance.

Classification: aws.concept.managed-database-component.

Contributions

Conditions, identity and resolution

Contribution through source.cluster_identifier

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.cluster_identifier
  • match.strategy: "exact"
aws.rule.docdb-cluster Source

Matches resource instances of aws_docdb_cluster.

Classification: rf.concept.managed-database.

Conditions, identity and resolution

Identity

  • attributes: ["arn", "cluster_identifier"]
  • scope: "provider"

Endpoint

  • attributes: ["arn", "id", "cluster_identifier"]
aws.rule.dsql-cluster Source

Matches resource instances of aws_dsql_cluster.

Classification: rf.concept.managed-database.

Conditions, identity and resolution

Identity

  • attributes: ["arn", "identifier"]
  • scope: "provider"

Endpoint

  • attributes: ["arn", "identifier"]
aws.rule.dynamodb-global-secondary-index Source

Matches resource instances of aws_dynamodb_global_secondary_index.

Classification: aws.concept.dynamodb-component.

Contributions

Conditions, identity and resolution

Contribution through source.table_name

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.dynamodb-table Source

Matches resource instances of aws_dynamodb_table.

Classification: aws.concept.dynamodb-table.

Conditions, identity and resolution

Identity

  • attributes: ["name"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "name"]
aws.rule.ec2-transit-gateway-vpc-attachment Source

Matches resource instances of aws_ec2_transit_gateway_vpc_attachment.

Classification: aws.concept.transit-gateway-attachment.

Contexts

Contributions

Conditions, identity and resolution

Contribution through source.transit_gateway_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"

Context through source.vpc_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.ec2-transit-gateway Source

Matches resource instances of aws_ec2_transit_gateway.

Classification: aws.concept.transit-gateway.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]
aws.rule.ecr-lifecycle-policy Source

Matches resource instances of aws_ecr_lifecycle_policy.

Classification: aws.concept.repository-configuration.

Contributions

Conditions, identity and resolution

Contribution through source.repository

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.ecr-repository Source

Matches resource instances of aws_ecr_repository.

Classification: aws.concept.container-repository.

Conditions, identity and resolution

Identity

  • attributes: ["name"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "name"]
aws.rule.ecs-cluster Source

Matches resource instances of aws_ecs_cluster.

Classification: aws.concept.ecs-cluster.

Conditions, identity and resolution

Identity

  • attributes: ["name"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "name"]
aws.rule.ecs-service Source

Matches resource instances of aws_ecs_service.

Classification: aws.concept.ecs-service.

Contexts

Conditions, identity and resolution

Context through source.cluster

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.efs-file-system Source

Matches resource instances of aws_efs_file_system.

Classification: aws.concept.managed-file-storage.

aws.rule.eks-cluster Source

Matches resource instances of aws_eks_cluster.

Classification: rf.concept.kubernetes-cluster.

Conditions, identity and resolution

Identity

  • attributes: ["name"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "name", "endpoint"]
aws.rule.eks-fargate-profile Source

Matches resource instances of aws_eks_fargate_profile.

Classification: aws.concept.eks-compute-profile.

Contributions

Conditions, identity and resolution

Contribution through source.cluster_name

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.eks-node-group Source

Matches resource instances of aws_eks_node_group.

Classification: aws.concept.kubernetes-node-pool.

Contributions

Conditions, identity and resolution

Contribution through source.cluster_name

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.elasticache-cluster Source

Matches resource instances of aws_elasticache_cluster.

Classification: aws.concept.managed-cache.

aws.rule.elasticache-replication-group Source

Matches resource instances of aws_elasticache_replication_group.

Classification: aws.concept.managed-cache.

aws.rule.elb Source

Matches resource instances of aws_elb.

Classification: aws.concept.load-balancer.

Conditions, identity and resolution

Identity

  • attributes: ["arn"]
  • scope: "global"

Endpoint

  • attributes: ["arn", "id"]
aws.rule.emr-cluster Source

Matches resource instances of aws_emr_cluster.

Classification: aws.concept.emr-cluster.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]
aws.rule.emr-instance-fleet Source

Matches resource instances of aws_emr_instance_fleet.

Classification: aws.concept.emr-cluster-component.

Contributions

Conditions, identity and resolution

Contribution through source.cluster_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.emr-instance-group Source

Matches resource instances of aws_emr_instance_group.

Classification: aws.concept.emr-cluster-component.

Contributions

Conditions, identity and resolution

Contribution through source.cluster_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.fsx-lustre-file-system Source

Matches resource instances of aws_fsx_lustre_file_system.

Classification: aws.concept.managed-file-storage.

aws.rule.fsx-ontap-file-system Source

Matches resource instances of aws_fsx_ontap_file_system.

Classification: aws.concept.managed-file-storage.

aws.rule.fsx-openzfs-file-system Source

Matches resource instances of aws_fsx_openzfs_file_system.

Classification: aws.concept.managed-file-storage.

aws.rule.fsx-windows-file-system Source

Matches resource instances of aws_fsx_windows_file_system.

Classification: aws.concept.managed-file-storage.

aws.rule.globalaccelerator-accelerator Source

Matches resource instances of aws_globalaccelerator_accelerator.

Classification: aws.concept.global-accelerator.

Conditions, identity and resolution

Identity

  • attributes: ["arn"]
  • scope: "global"

Endpoint

  • attributes: ["arn", "id"]
aws.rule.globalaccelerator-custom-routing-accelerator Source

Matches resource instances of aws_globalaccelerator_custom_routing_accelerator.

Classification: aws.concept.global-accelerator.

Conditions, identity and resolution

Identity

  • attributes: ["arn"]
  • scope: "global"

Endpoint

  • attributes: ["arn", "id"]
aws.rule.globalaccelerator-custom-routing-endpoint-group Source

Matches resource instances of aws_globalaccelerator_custom_routing_endpoint_group.

Classification: aws.concept.global-accelerator-component.

aws.rule.globalaccelerator-custom-routing-listener Source

Matches resource instances of aws_globalaccelerator_custom_routing_listener.

Classification: aws.concept.global-accelerator-component.

Contributions

Conditions, identity and resolution

Contribution through source.accelerator_arn

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.arn
  • match.strategy: "exact"
aws.rule.globalaccelerator-endpoint-group Source

Matches resource instances of aws_globalaccelerator_endpoint_group.

Classification: aws.concept.global-accelerator-component.

aws.rule.globalaccelerator-listener Source

Matches resource instances of aws_globalaccelerator_listener.

Classification: aws.concept.global-accelerator-component.

Contributions

Conditions, identity and resolution

Contribution through source.accelerator_arn

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.arn
  • match.strategy: "exact"
aws.rule.iam-group Source

Matches resource instances of aws_iam_group.

Classification: aws.concept.identity-group.

aws.rule.iam-instance-profile Source

Matches resource instances of aws_iam_instance_profile.

Classification: aws.concept.instance-profile.

Contributions

Conditions, identity and resolution

Contribution through source.role

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.iam-role-policy-attachment Source

Matches resource instances of aws_iam_role_policy_attachment.

Classification: aws.concept.service-identity-binding.

Contributions

Conditions, identity and resolution

Contribution through source.role

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.name
  • match.strategy: "exact"
aws.rule.iam-role Source

Matches resource instances of aws_iam_role.

Classification: aws.concept.iam-role.

Conditions, identity and resolution

Identity

  • attributes: ["name"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "name"]
aws.rule.identitystore-group Source

Matches resource instances of aws_identitystore_group.

Classification: aws.concept.identity-group.

aws.rule.instance Source

Matches resource instances of aws_instance.

Classification: aws.concept.compute-instance.

Contexts

Conditions, identity and resolution

Context through source.subnet_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.internet-gateway Source

Matches resource instances of aws_internet_gateway.

Classification: aws.concept.internet-gateway.

Contexts

Conditions, identity and resolution

Context through source.vpc_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.kms-alias Source

Matches resource instances of aws_kms_alias.

Classification: aws.concept.key-alias.

Contributions

Conditions, identity and resolution

Contribution through source.target_key_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.kms-key Source

Matches resource instances of aws_kms_key.

Classification: aws.concept.encryption-key.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]
aws.rule.lb-listener Source

Matches resource instances of aws_lb_listener.

Classification: aws.concept.load-balancer-component.

Contributions

Conditions, identity and resolution

Contribution through source.load_balancer_arn

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.arn
  • match.strategy: "exact"
aws.rule.lb-target-group Source

Matches resource instances of aws_lb_target_group.

Classification: aws.concept.load-balancer-component.

aws.rule.lb Source

Matches resource instances of aws_lb.

Classification: aws.concept.load-balancer.

Conditions, identity and resolution

Identity

  • attributes: ["arn"]
  • scope: "global"

Endpoint

  • attributes: ["arn", "id"]
aws.rule.memorydb-cluster Source

Matches resource instances of aws_memorydb_cluster.

Classification: aws.concept.managed-cache.

aws.rule.nat-gateway Source

Matches resource instances of aws_nat_gateway.

Classification: aws.concept.managed-nat.

Contexts

Conditions, identity and resolution

Context through source.subnet_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.neptune-cluster-instance Source

Matches resource instances of aws_neptune_cluster_instance.

Classification: aws.concept.managed-database-component.

Contributions

Conditions, identity and resolution

Contribution through source.cluster_identifier

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.cluster_identifier
  • match.strategy: "exact"
aws.rule.neptune-cluster Source

Matches resource instances of aws_neptune_cluster.

Classification: rf.concept.managed-database.

Conditions, identity and resolution

Identity

  • attributes: ["arn", "cluster_identifier"]
  • scope: "provider"

Endpoint

  • attributes: ["arn", "id", "cluster_identifier"]
aws.rule.network-acl Source

Matches resource instances of aws_network_acl.

Classification: aws.concept.network-acl.

Contexts

Conditions, identity and resolution

Context through source.vpc_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-adm-channel Source

Matches resource instances of aws_pinpoint_adm_channel.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-apns-channel Source

Matches resource instances of aws_pinpoint_apns_channel.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-apns-sandbox-channel Source

Matches resource instances of aws_pinpoint_apns_sandbox_channel.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-apns-voip-channel Source

Matches resource instances of aws_pinpoint_apns_voip_channel.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-apns-voip-sandbox-channel Source

Matches resource instances of aws_pinpoint_apns_voip_sandbox_channel.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-app Source

Matches resource instances of aws_pinpoint_app.

Classification: aws.concept.pinpoint-app.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "application_id"]
aws.rule.pinpoint-baidu-channel Source

Matches resource instances of aws_pinpoint_baidu_channel.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-email-channel Source

Matches resource instances of aws_pinpoint_email_channel.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-event-stream Source

Matches resource instances of aws_pinpoint_event_stream.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-gcm-channel Source

Matches resource instances of aws_pinpoint_gcm_channel.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.pinpoint-sms-channel Source

Matches resource instances of aws_pinpoint_sms_channel.

Classification: aws.concept.pinpoint-component.

Contributions

Conditions, identity and resolution

Contribution through source.application_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.rds-cluster-activity-stream Source

Matches resource instances of aws_rds_cluster_activity_stream.

Classification: aws.concept.managed-database-component.

Contributions

Conditions, identity and resolution

Contribution through source.resource_arn

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.arn
  • match.strategy: "exact"
aws.rule.rds-cluster-endpoint Source

Matches resource instances of aws_rds_cluster_endpoint.

Classification: aws.concept.managed-database-component.

Contributions

Conditions, identity and resolution

Contribution through source.cluster_identifier

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.cluster_identifier
  • match.strategy: "exact"
aws.rule.rds-cluster-instance Source

Matches resource instances of aws_rds_cluster_instance.

Classification: aws.concept.managed-database-component.

Contributions

Conditions, identity and resolution

Contribution through source.cluster_identifier

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.cluster_identifier
  • match.strategy: "exact"
aws.rule.rds-cluster Source

Matches resource instances of aws_rds_cluster.

Classification: rf.concept.managed-database.

Conditions, identity and resolution

Identity

  • attributes: ["arn", "cluster_identifier"]
  • scope: "provider"

Endpoint

  • attributes: ["arn", "id", "cluster_identifier"]
aws.rule.route-table Source

Matches resource instances of aws_route_table.

Classification: aws.concept.route-table.

Contexts

Conditions, identity and resolution

Context through source.vpc_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.s3-bucket-server-side-encryption-configuration Source

Matches resource instances of aws_s3_bucket_server_side_encryption_configuration.

Classification: aws.concept.storage-configuration.

Contributions

Conditions, identity and resolution

Contribution through source.bucket

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.bucket
  • match.strategy: "exact"
aws.rule.s3-bucket-versioning Source

Matches resource instances of aws_s3_bucket_versioning.

Classification: aws.concept.storage-configuration.

Contributions

Conditions, identity and resolution

Contribution through source.bucket

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.bucket
  • match.strategy: "exact"
aws.rule.s3-bucket Source

Matches resource instances of aws_s3_bucket.

Classification: rf.concept.object-storage-container.

Conditions, identity and resolution

Identity

  • attributes: ["bucket"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "bucket", "arn"]
aws.rule.s3-directory-bucket Source

Matches resource instances of aws_s3_directory_bucket.

Classification: rf.concept.object-storage-container.

Conditions, identity and resolution

Identity

  • attributes: ["bucket"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "bucket", "arn"]
aws.rule.security-group Source

Matches resource instances of aws_security_group.

Classification: aws.concept.security-group.

Contexts

Conditions, identity and resolution

Context through source.vpc_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.sns-topic-subscription Source

Matches resource instances of aws_sns_topic_subscription.

Classification: aws.concept.message-subscription.

Relations

Conditions, identity and resolution

Relation through source.topic_arn

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.arn
  • match.strategy: "exact"
aws.rule.sns-topic Source

Matches resource instances of aws_sns_topic.

Classification: aws.concept.message-topic.

Conditions, identity and resolution

Identity

  • attributes: ["arn"]
  • scope: "global"

Endpoint

  • attributes: ["arn", "id"]
aws.rule.subnet Source

Matches resource instances of aws_subnet.

Classification: rf.concept.subnet.

Contexts

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]

Context through source.vpc_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.vpc-endpoint Source

Matches resource instances of aws_vpc_endpoint.

Classification: aws.concept.private-endpoint.

Contexts

Conditions, identity and resolution

Context through source.vpc_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.vpc Source

Matches resource instances of aws_vpc.

Classification: rf.concept.virtual-network.

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id", "cidr_block"]
aws.rule.vpn-connection Source

Matches resource instances of aws_vpn_connection.

Classification: aws.concept.vpn-connection.

Contexts

Conditions, identity and resolution

Context through source.vpn_gateway_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"

Context through source.transit_gateway_id

  • on_null: "absent"
  • on_empty: "absent"
  • match.by: target.id
  • match.strategy: "exact"
aws.rule.vpn-gateway Source

Matches resource instances of aws_vpn_gateway.

Classification: aws.concept.vpn-gateway.

Contexts

Conditions, identity and resolution

Identity

  • attributes: ["id"]
  • scope: "provider"

Endpoint

  • attributes: ["id"]

Context through source.vpc_id

  • on_null: "absent"
  • on_empty: "absent"
  • external: "allow"
  • match.by: target.id
  • match.strategy: "exact"