relations.yaml

# List of asset types that have references to other assets as part
# of their properties.
asset_types:
  cloudresourcemanager.googleapis.com/Folder:
    - $.parent
  cloudresourcemanager.googleapis.com/Project:
    - $.parent
  compute.googleapis.com/Network:
    - $.parent
    - $.data.peerings[*].network
  compute.googleapis.com/Subnetwork:
    - $.data.network
  compute.googleapis.com/Address:
    - $.data.subnetwork
    - $.data.users[*]
  compute.googleapis.com/GlobalAddress:
    - $.data.network
  compute.googleapis.com/BackendService:
    - $.data.healthChecks[*]
    - $.data.backends[*].group
    - $.data.securityPolicy
  compute.googleapis.com/RegionBackendService:
    - $.data.healthChecks[*]
    - $.data.backends[*].group
    - $.data.securityPolicy
  compute.googleapis.com/NetworkEndpointGroup:
    - $.data.network
    - $.data.subnetwork
  compute.googleapis.com/Disk:
    - $.data.users[*]
    - $.data.resourcePolicies[*]
  compute.googleapis.com/RegionDisk:
    - $.data.users[*]
    - $.data.resourcePolicies[*]
  compute.googleapis.com/Firewall:
    - $.data.network
    - $.data.sourceServiceAccounts
    - $.data.targetServiceAccounts
  compute.googleapis.com/ForwardingRule:
    - $.data.network
    - $.data.subnetwork
    - $.data.target
  compute.googleapis.com/GlobalForwardingRule:
    - $.data.target
  compute.googleapis.com/Instance:
    - $.data.networkInterfaces[*].network
    - $.data.networkInterfaces[*].subnetwork
    - $.data.disks[*].source
    - $.parent
  compute.googleapis.com/InstanceGroup:
    - $.data.network
    - $.data.subnetwork
  compute.googleapis.com/InstanceGroupManager:
    - $.data.instanceGroup
    - $.data.instanceTemplate
  compute.googleapis.com/InstanceTemplate:
    - $.data.properties.networkInterface[*].network
    - $.data.properties.networkInterface[*].subnetwork
    - $.data.properties.disks[*].sourceImage
  compute.googleapis.com/Route:
    - $.data.network
    - $.data.nextHopNetwork
  compute.googleapis.com/Router:
    - $.data.network
    - $.data.interfaces[*].linkedVpnTunnel
    - $.data.interfaces[*].linkedInterconnectAttachment
  compute.googleapis.com/Interconnect:
    - $.data.interconnectAttachments[*]
  compute.googleapis.com/VpnTunnel:
    - $.data.peerExternalGateway
    - $.data.vpnGateway
    - $.data.router
  compute.googleapis.com/Snapshot:
    - $.data.sourceDisk
  compute.googleapis.com/TargetHttpProxy:
    - $.data.urlMap
  compute.googleapis.com/TargetHttpsProxy:
    - $.data.urlMap
    - $.data.sslCertificates[*]
  compute.googleapis.com/TargetTcpProxy:
    - $.data.service
  compute.googleapis.com/TargetInstance:
    - $.data.service
  compute.googleapis.com/TargetVpnGateway:
    - $.data.forwardingRules[*]
    - $.data.tunnels[*]
    - $.data.network
  #compute.googleapis.com/SslCertificate:
  #  - $.parent   
  compute.googleapis.com/UrlMap:
    - $.data.defaultService
    - $.data.pathMatchers[*].defaultService
    - $.data.pathMatchers[*].pathRules[*].service
  compute.googleapis.com/Autoscaler:
    - $.data.target
  appengine.googleapis.com/Service:
    - $.parent
  appengine.googleapis.com/Version:
    - $.parent
  dns.googleapis.com/ManagedZone:
    - $.parent
    - $.data.privateVisibilityConfig.networks[*].networkUrl
  dns.googleapis.com/Policy:
    - $.data.networks[*].networkUrl
  bigquery.googleapis.com/Dataset:
    - $.parent    
  bigquery.googleapis.com/Table:
    - $.parent
  pubsub.googleapis.com/Topic:
      - $.parent
  pubsub.googleapis.com/Subscription:
    - $.parent
    - $.data.topic
  container.googleapis.com/Cluster:
    - $.parent
    - $.data.instanceGroupUrls[*]
  container.googleapis.com/NodePool:
    - $.data.instanceGroupUrls[*]
    - $.parent
    # - $.data.networkConfig.network
    # - $.data.networkConfig.subnetwork
  iam.googleapis.com/ServiceAccount:
    - $.parent
  iam.googleapis.com/ServiceAccountKey:
    - $.parent
  sqladmin.googleapis.com/Instance:
    - $.parent
    - $.data.ipConfiguration.privateNetwork
  storage.googleapis.com/Bucket:
    - $.parent  
  compute.googleapis.com/HealthCheck:
    - $.parent  
  compute.googleapis.com/SecurityPolicy:
    - $.parent  
  k8s.io/Node:
    - $.parent
  k8s.io/Namespace:
    - $.parent
  k8s.io/Pod: 
    - $.parent
  k8s.io/Service: 
    - $.parent
  networking.k8s.io/Ingress:
    - $.parent
  extensions.k8s.io/Ingress:
    - $.parent
  logging.googleapis.com/LogSink: 
    - $.data.destination
    - $.parent
  logging.googleapis.com/LogMetric: 
    - $.parent

# If a resource is referenced somewhere else with a different syntax
# than what Cloud Asset Inventory does, aliases configuration allows
# gcpviz to create aliases for assets.
aliases:
  iam.googleapis.com/ServiceAccount:
    - $.data.email

# Asset enrichment configuration. Allows the tool to synthesize
# new fields in assets, such as gathering all subnetworks CIDR ranges
# as part of the parent network.
enrich:
  compute.googleapis.com/Network: 
    subnetworkConfig: 
      compute.googleapis.com/Subnetwork: $
  iam.googleapis.com/ServiceAccount: 
    serviceAccountKeys:
      iam.googleapis.com/ServiceAccount: $

# References to all asset types fields with IP addresses in them 
# for the IP matching functionality.
ip_addresses:
  compute.googleapis.com/Firewall:
    - $.data.destinationRanges[*]
    - $.data.sourceRanges[*]
  compute.googleapis.com/VpnGateway:
    - $.data.vpnInterface[*].ipAddress
  compute.googleapis.com/VpnTunnel:
    - $.data.peerIp
  compute.googleapis.com/Address:
    - $.data.address
  compute.googleapis.com/GlobalAddress:
    - $.data.address
  compute.googleapis.com/GlobalForwardingRule:
    - $.data.IPAddress
  compute.googleapis.com/ForwardingRule:
    - $.data.IPAddress
  #compute.googleapis.com/Instance:
  #  - $.data.networkInterfaces[*].networkIP