## GCP Schema ### GCPOrganization Representation of a GCP [Organization](https://cloud.google.com/resource-manager/reference/rest/v1/organizations) object. > **Ontology Mapping**: This node has the extra label `Tenant` to enable cross-platform queries for organizational tenants across different systems (e.g., OktaOrganization, AWSAccount, AzureTenant). | Field | Description | | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | The name of the GCP Organization, e.g. "organizations/1234" | | displayname | The "friendly name", e.g. "My Company" | | lifecyclestate | The organization's current lifecycle state. Assigned by the server. See the [official docs](https://cloud.google.com/resource-manager/reference/rest/v1/organizations#LifecycleState). | #### Relationships - GCPOrganizations contain GCPFolders. ``` (GCPOrganization)-[RESOURCE]->(GCPFolder) ``` - GCPOrganizations can contain GCPProjects. ``` (GCPOrganization)-[RESOURCE]->(GCPProject) ``` ### GCPFolder Representation of a GCP [Folder](https://cloud.google.com/resource-manager/reference/rest/v2/folders). An additional helpful reference is the [Google Compute Platform resource hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy). | Field | Description | | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | The name of the folder, e.g. "folders/1234" | | foldername | The name of the folder, e.g. "folders/1234" | | displayname | A friendly name of the folder, e.g. "My Folder". | | lifecyclestate | The folder's current lifecycle state. Assigned by the server. See the [official docs](https://cloud.google.com/resource-manager/reference/rest/v2/folders#LifecycleState). | | parent_org | If the folder's parent is an organization, this field contains the organization ID, e.g. "organizations/1234" | | parent_folder | If the folder's parent is another folder, this field contains the folder ID, e.g. "folders/5678" | #### Relationships - GCPFolders are sub-resources of GCPOrganizations. ``` (GCPOrganization)-[RESOURCE]->(GCPFolder) ``` - GCPFolders can have parent GCPOrganizations. ``` (GCPFolder)-[PARENT]->(GCPOrganization) ``` - GCPFolders can have parent GCPFolders. ``` (GCPFolder)-[PARENT]->(GCPFolder) ``` - GCPFolders can contain GCPProjects ``` (GCPProject)-[PARENT]->(GCPFolder) ``` - GCPFolders can contain other GCPFolders. ``` (GCPFolder)-[PARENT]->(GCPFolder) ``` ### GCPProject Representation of a GCP [Project](https://cloud.google.com/resource-manager/reference/rest/v1/projects). An additional helpful reference is the [Google Compute Platform resource hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy). > **Ontology Mapping**: This node has the extra label `Tenant` to enable cross-platform queries for organizational tenants across different systems (e.g., OktaOrganization, AWSAccount, AzureTenant). | Field | Description | | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | The ID of the project, e.g. "sys-12345" | | projectid | The ID of the project, e.g. "sys-12345" | | projectnumber | The number uniquely identifying the project, e.g. '987654' | | displayname | A friendly name of the project, e.g. "MyProject". | | lifecyclestate | The project's current lifecycle state. Assigned by the server. See the [official docs](https://cloud.google.com/resource-manager/reference/rest/v1/projects#LifecycleState). | | parent_org | If the project's parent is an organization, this field contains the organization ID, e.g. "organizations/1234" | | parent_folder | If the project's parent is a folder, this field contains the folder ID, e.g. "folders/5678" | | compute_project_enable_oslogin | Project-level Compute metadata value for `enable-oslogin` when configured in common instance metadata. | ### Relationships - GCPProjects are sub-resources of GCPOrganizations. ``` (GCPOrganization)-[RESOURCE]->(GCPProject) ``` - GCPProjects can have a parent GCPOrganization. ``` (GCPProject)-[PARENT]->(GCPOrganization) ``` - GCPProjects can have a parent GCPFolder. ``` (GCPProject)-[PARENT]->(GCPFolder) ``` - GCPVpcs are part of GCPProjects ``` (GCPProject)-[RESOURCE]->(GCPVpc) ``` ### GCPBucket Representation of a GCP [Storage Bucket](https://cloud.google.com/storage/docs/json_api/v1/buckets). > **Ontology Mapping**: This node has the extra label `ObjectStorage` to enable cross-platform queries for object storage across different systems (e.g., AWSS3Bucket, AzureStorageBlobContainer). | Field | Description | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | The ID of the storage bucket, e.g. "bucket-12345" | | projectnumber | The number uniquely identifying the project associated with the storage bucket, e.g. '987654' | | self_link | The URI of the storage bucket | | kind | The kind of item this is. For storage buckets, this is always storage#bucket | | location | The location of the bucket. Object data for objects in the bucket resides in physical storage within this region. Defaults to US. See [Cloud Storage bucket locations](https://cloud.google.com/storage/docs/locations) for the authoritative list. | | location_type | The type of location that the bucket resides in, as determined by the `location` property | | meta_generation | The metadata generation of this bucket | | storage_class | The bucket's default storage class, used whenever no `storageClass` is specified for a newly-created object. For more information, see [storage classes](https://cloud.google.com/storage/docs/storage-classes) | | time_created | The creation time of the bucket in RFC 3339 format | | retention_period | The period of time, in seconds, that objects in the bucket must be retained and cannot be deleted, overwritten, or archived | | iam_config_bucket_policy_only | The bucket's [Bucket Policy Only](https://cloud.google.com/storage/docs/bucket-policy-only) configuration | | iam_config_public_access_prevention | The bucket's [Public Access Prevention](https://cloud.google.com/storage/docs/public-access-prevention) setting (`enforced` blocks all public access regardless of bindings; `inherited` defers to the project / org default) | | owner_entity | The entity, in the form `project-owner-projectId` | | owner_entity_id | The ID for the entity | | versioning_enabled | The bucket's versioning configuration (if set to `True`, versioning is fully enabled for this bucket) | | log_bucket | The destination bucket where the current bucket's logs should be placed | | requester_pays | The bucket's billing configuration (if set to true, Requester Pays is enabled for this bucket) | | default_kms_key_name | A Cloud KMS key that will be used to encrypt objects inserted into this bucket, if no encryption method is specified | | acl_public | `true` if the bucket's legacy ACL or default object ACL grants access to `allUsers` or `allAuthenticatedUsers`. Consumed by the `_ont_public` projection job. | #### Relationships - GCPBuckets are part of GCPProjects. ``` (GCPProject)-[RESOURCE]->(GCPBucket) ``` - GCPBuckets can be labeled with GCPBucketLabels. ``` (GCPBucket)-[LABELED]->(GCPBucketLabel) ``` - GCPPrincipals with appropriate permissions can read from GCP buckets. Created from [gcp_permission_relationships.yaml](https://github.com/cartography-cncf/cartography/blob/master/cartography/data/gcp_permission_relationships.yaml). ``` (GCPPrincipal)-[CAN_READ]->(GCPBucket) ``` - GCPPrincipals with appropriate permissions can write to GCP buckets. Created from [gcp_permission_relationships.yaml](https://github.com/cartography-cncf/cartography/blob/master/cartography/data/gcp_permission_relationships.yaml). ``` (GCPPrincipal)-[CAN_WRITE]->(GCPBucket) ``` - GCPPrincipals with appropriate permissions can delete from GCP buckets. Created from [gcp_permission_relationships.yaml](https://github.com/cartography-cncf/cartography/blob/master/cartography/data/gcp_permission_relationships.yaml). ``` (GCPPrincipal)-[CAN_DELETE]->(GCPBucket) ``` ### GCPDNSZone Representation of a GCP [DNS Zone](https://cloud.google.com/dns/docs/reference/v1/). > **Ontology Mapping**: This node has the extra label `DNSZone` to enable cross-platform queries for DNS zones across different systems (e.g., AWSDNSZone, GCPDNSZone, CloudflareZone). | Field | Description | | ---------- | ------------------------------------------------------- | | created_at | The date and time the zone was created | | description | An optional description of the zone| | dns_name | The DNS name of this managed zone, for instance "example.com.". | | dnssec_state | DNSSEC state for the managed zone, e.g. `on` or `off`. | | dnssec_key_signing_algorithm | Algorithm configured for the DNSSEC key-signing key, when present. | | dnssec_zone_signing_algorithm | Algorithm configured for the DNSSEC zone-signing key, when present. | | firstseen | Timestamp of when a sync job first discovered this node | | **id** |Unique identifier| | name | The name of the zone | | nameservers |Virtual name servers the zone is delegated to | | visibility | The zone's visibility: `public` zones are exposed to the Internet, while `private` zones are visible only to Virtual Private Cloud resources.| #### Relationships - GKEClusters are resources of GCPProjects. ``` (GCPProject)-[RESOURCE]->(GCPDNSZone) ``` ### GCPBucketLabel:Label Representation of a GCP [Storage Bucket Label](https://cloud.google.com/storage/docs/key-terms#bucket-labels). This node contains a key-value pair. | Field | Description | | ----------- | ------------------------------------------------------------------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | The ID of the bucket label. Takes the form "GCPBucketLabel\_{key}." | | key | The key of the bucket label. | | value | The value of the bucket label. | - GCPBuckets can be labeled with GCPBucketLabels. ``` (GCPBucket)-[LABELED]->(GCPBucketLabel) ``` ### Tag::Label::GCPLabel Representation of a GCP [Label](https://cloud.google.com/resource-manager/docs/labels-overview). GCP Labels can be applied to many resource types. This is a unified label node type similar to how `AWSTag` works for AWS resources. > **Ontology Mapping**: This node has the extra labels `Tag` and `Label` to preserve cross-platform semantics for generic key/value labels. `(:Tag {key, value})` matches GCP labels alongside AWS, Azure, and Tenable tags. Each resource type has its own declarative schema (e.g., `GCPBucketGCPLabelSchema` and `GCPInstanceGCPLabelSchema`). Bucket-sourced labels also carry the `GCPBucketLabel` extra label for backward compatibility with the legacy per-resource label schema. | Field | Description | |---------------|-------------------------------------------------------------------------------------------------------------| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | The ID of the label. Takes the form `{resource_id}:{key}:{value}`. | | key | The key of the label. | | value | The value of the label. | | resource_type | The Cartography node label of the resource this label is attached to (e.g. `GCPBucket`, `GCPInstance`). | #### Relationships - GCP resources are linked to their GCPLabels via `:TAGGED` (canonical, matches the cross-provider tag pattern). The legacy `:LABELED` edge is still written in parallel and will be removed in v1.0.0. ``` (GCPBucket)-[TAGGED]->(GCPLabel:GCPBucketLabel) (GCPInstance)-[TAGGED]->(GCPLabel) ``` - GCPLabel nodes are associated with a GCPProject via the RESOURCE relationship. ``` (GCPProject)-[RESOURCE]->(GCPLabel) ``` ### GCPInstance Representation of a GCP [Instance](https://cloud.google.com/compute/docs/reference/rest/v1/instances). Additional references can be found in the [official documentation]( https://cloud.google.com/compute/docs/concepts). > **Ontology Mapping**: This node has the extra label `ComputeInstance` to enable cross-platform queries for compute instances across different systems (e.g., AWSEC2Instance, AzureVirtualMachine, DODroplet). | Field | Description | | ---------------- | ----------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | The partial resource URI representing this instance. Has the form `projects/{project_name}/zones/{zone_name}/instances/{instance_name}`. | | partial_uri | Same as `id` above. | | self_link | The full resource URI representing this instance. Has the form `https://www.googleapis.com/compute/v1/{partial_uri}` | | instancename | The name of the instance, e.g. "my-instance" | | zone_name | The zone that the instance is installed on | | hostname | If present, the hostname of the instance | | machine_type | The instance machine type short name, e.g. `n2d-standard-4`. | | creation_timestamp | RFC 3339 timestamp of when the instance was created. | | private_ip | Primary internal IP address (first NIC's `networkIP`). | | public_ip | Primary external IP address (first access config's `natIP`), if any. | | service_account_email | Primary attached service account email when the instance has one. | | service_account_scopes | OAuth scopes configured on the primary attached service account. | | can_ip_forward | Whether the instance is configured with IP forwarding enabled. | | enable_vtpm | Shielded VM vTPM state from `shieldedInstanceConfig.enableVtpm`. | | enable_integrity_monitoring | Shielded VM Integrity Monitoring state from `shieldedInstanceConfig.enableIntegrityMonitoring`. | | enable_confidential_compute | Confidential Computing state from `confidentialInstanceConfig.enableConfidentialCompute`. | | enable_oslogin_metadata | Instance metadata value for `enable-oslogin` when explicitly set. | | block_project_ssh_keys | Instance metadata value for `block-project-ssh-keys` when explicitly set. | | serial_port_enable | Instance metadata value for `serial-port-enable` when explicitly set. | | exposed_internet | Set to `true` if the instance is internet-exposed via either path: (1) `'direct'` — the instance has a public IP and an ingress firewall rule allowing traffic from 0.0.0.0/0 with no higher-priority deny rule blocking it, or (2) `'gcp_lb'` — the instance is behind an external-facing GCPBackendService via the InstanceGroup chain. Set by the `gcp_compute_exposure` scoped analysis job. | | exposed_internet_type | A string indicating the type of internet exposure: `'direct'` (exposed via firewall rules + public IP) or `'gcp_lb'` (exposed via an external load balancer). | | status | The [GCP Instance Lifecycle](https://cloud.google.com/compute/docs/instances/instance-life-cycle) state of the instance | #### Relationships - GCPInstances are resources of GCPProjects. ``` (GCPProject)-[RESOURCE]->(GCPInstance) ``` - GCPNetworkInterfaces are attached to GCPInstances ``` (GCPInstance)-[NETWORK_INTERFACE]->(GCPNetworkInterface) ``` - GCP Instances may be members of one or more GCP VPCs. ``` (GCPInstance)-[:MEMBER_OF_GCP_VPC]->(GCPVpc) ``` This relationship is created by the `GCP_COMPUTE_INSTANCE_VPC_ANALYSIS` [analysis job](../../dev/writing-analysis-jobs.html) defined in `cartography/analysis/gcp/analysis.py`. Also note that this relationship is a shortcut for: ``` (GCPInstance)-[:NETWORK_INTERFACE]->(:GCPNetworkInterface)-[:PART_OF_SUBNET]->(GCPSubnet)<-[:RESOURCE]-(GCPVpc) ``` - GCP Instances may have GCP Tags defined on them for use in [network firewall routing](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-your-google-cloud-platform-resources). ``` (GCPInstance)-[:TAGGED]->(GCPNetworkTag) ``` - GCP Firewalls allow ingress to GCP instances. ``` (GCPFirewall)-[:FIREWALL_INGRESS]->(GCPInstance) ``` Note that this relationship is a shortcut for: ``` (vpc:GCPVpc)<-[MEMBER_OF_GCP_VPC]-(GCPInstance)-[TAGGED]->(GCPNetworkTag)-[TARGET_TAG]-(GCPFirewall{direction: 'INGRESS'})<-[RESOURCE]-(vpc) ``` as well as ``` MATCH (fw:GCPFirewall{direction: 'INGRESS', has_target_service_accounts: False}}) WHERE NOT (fw)-[TARGET_TAG]->(GCPNetworkTag) MATCH (GCPInstance)-[MEMBER_OF_GCP_VPC]->(GCPVpc)-[RESOURCE]->(fw) ``` - GCPBackendServices expose GCPInstances. Created by the `gcp_lb_exposure` scoped analysis job when the backend service is external-facing. ``` (GCPBackendService)-[:EXPOSE]->(GCPInstance) ``` - GCP Instances run as the GCP Service Account attached to them, matched on the service account email. ``` (GCPInstance)-[:RUNS_AS]->(GCPServiceAccount) ``` ### GCPNetworkTag Representation of a Tag defined on a GCP Instance or GCP Firewall. Tags are defined on GCP instances for use in [network firewall routing](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-your-google-cloud-platform-resources). | Field | Description | | ----------- | ---------------------------------------------------------------------------------------------------------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | GCP doesn't define a resource URI for Tags so we define this as `{instance resource URI}/tags/{tag value}` | | tag_id | same as `id` | | value | The actual value of the tag | #### Relationships - GCP Instances can be labeled with tags. ``` (GCPInstance)-[:TAGGED]->(GCPNetworkTag) ``` - GCP Firewalls can be labeled with tags to direct traffic to or deny traffic to labeled GCPInstances ``` (GCPFirewall)-[:TARGET_TAG]->(GCPNetworkTag) ``` - GCPNetworkTags are defined on a VPC and only have effect on assets in that VPC ``` (GCPNetworkTag)-[DEFINED_IN]->(GCPVpc) ``` ### GCPVpc Representation of a GCP [VPC](https://cloud.google.com/compute/docs/reference/rest/v1/networks/). In GCP documentation this is also known simply as a "Network" object. > **Ontology Mapping**: This node has the extra label `VirtualNetwork` and normalized `_ont_*` properties to enable cross-platform queries for virtual networks across different systems (e.g., AWSVpc, AzureVirtualNetwork). | Field | Description | | -------------------------- | ----------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | The partial resource URI representing this VPC. Has the form `projects/{project_name}/global/networks/{vpc name}`. | | partial_uri | Same as `id` | | self_link | The full resource URI representing this VPC. Has the form `https://www.googleapis.com/compute/v1/{partial_uri}` | | name | The name of the VPC | | project_id | The project ID that this VPC belongs to | | auto_create_subnetworks | When set to true, the VPC network is created in "auto" mode. When set to false, the VPC network is created in "custom" mode. An auto mode VPC network starts with one subnet per region. Each subnet has a predetermined range as described in [Auto mode VPC network IP ranges](https://cloud.google.com/vpc/docs/vpc#ip-ranges). | | routing_confg_routing_mode | The network-wide routing mode to use. If set to REGIONAL, this network's Cloud Routers will only advertise routes with subnets of this network in the same region as the router. If set to GLOBAL, this network's Cloud Routers will advertise routes with all subnets of this network, across regions. | | description | A description for the VPC | #### Relationships - GCPVpcs are part of projects ``` (:GCPProject)-[:RESOURCE]->(:GCPVpc) ``` - GCPVpcs contain GCPSubnets ``` (:GCPVpc)-[:HAS]->(:GCPSubnet) ``` - GCPSubnets are part of GCP VPCs ``` (:GCPVpc)-[:RESOURCE]->(:GCPSubnet) ``` - GCPNetworkTags are defined on a VPC and only have effect on assets in that VPC ``` (:GCPNetworkTag)-[:DEFINED_IN]->(:GCPVpc) ``` - GCP Instances may be members of one or more GCP VPCs. ``` (:GCPInstance)-[:MEMBER_OF_GCP_VPC]->(:GCPVpc) ``` Also note that this relationship is a shortcut for: ``` (:GCPInstance)-[:NETWORK_INTERFACE]->(:GCPNetworkInterface)-[:PART_OF_SUBNET]->(:GCPSubnet)<-[:RESOURCE]-(:GCPVpc) ``` ### GCPNetworkInterface Representation of a GCP Instance's [network interface](https://cloud.google.com/compute/docs/reference/rest/v1/instances/list) (scroll down to the fields on "networkInterface"). | Field | Description | | ----------- | ----------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | A partial resource URI representing this network interface. Note: GCP does not define a partial resource URI for network interfaces, so we create one so we can uniquely identify GCP network interfaces. Has the form `projects/{project_name}/zones/{zone_name}/instances/{instance_name}/networkinterfaces/{network interface name}`. | | nic_id | Same as `id` | | name | The name of the network interface | | private_ip | The private IP address of this network interface. This IP is valid on the network interface's VPC. | #### Relationships - GCPNetworkInterfaces are attached to GCPInstances ``` (GCPInstance)-[NETWORK_INTERFACE]->(GCPNetworkInterface) ``` - GCPNetworkInterfaces are connected to GCPSubnets ``` (GCPNetworkInterface)-[PART_OF_SUBNET]->(GCPSubnet) ``` - GCPNetworkInterfaces have GCPNicAccessConfig objects defined on them ``` (GCPNetworkInterface)-[RESOURCE]->(GCPNicAccessConfig) ``` ### GCPNicAccessConfig Representation of the AccessConfig object on a GCP Instance's [network interface](https://cloud.google.com/compute/docs/reference/rest/v1/instances/list) (scroll down to the fields on "networkInterface"). | Field | Description | | ---------------------- | ----------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | A partial resource URI representing this AccessConfig. Note: GCP does not define a partial resource URI for AccessConfigs, so we create one so we can uniquely identify GCP network interface access configs. Has the form `projects/{project_name}/zones/{zone_name}/instances/{instance_name}/networkinterfaces/{network interface name}/accessconfigs/{access config type}`. | | partial_uri | Same as `id` | | type | The type of configuration. GCP docs say: "The default and only option is ONE_TO_ONE_NAT." | | name | The name of this access configuration. The default and recommended name is External NAT, but you can use any arbitrary string, such as My external IP or Network Access. | | public_ip | The external IP associated with this instance | | set_public_ptr | Specifies whether a public DNS 'PTR' record should be created to map the external IP address of the instance to a DNS domain name. | | public_ptr_domain_name | The DNS domain name for the public PTR record. You can set this field only if the setPublicPtr field is enabled. | | network_tier | This signifies the networking tier used for configuring this access configuration and can only take the following values: PREMIUM, STANDARD. | #### Relationships - GCPNetworkInterfaces have GCPNicAccessConfig objects defined on them ``` (GCPNetworkInterface)-[RESOURCE]->(GCPNicAccessConfig) ``` ### GCPRecordSet Representation of a GCP [Resource Record Set](https://cloud.google.com/dns/docs/reference/v1/). | Field | Description | | ---------- | ------------------------------------------------------- | | data | Data contained in the record | firstseen | Timestamp of when a sync job first discovered this node | | **id** |Composite key `name|type|zone_id` to ensure uniqueness across record types and zones| | name | The name of the Resource Record Set | | type | The identifier of a supported record type. See the list of [Supported DNS record types](https://cloud.google.om/dns/docs/overview#supported_dns_record_types). | ttl | Number of seconds that this ResourceRecordSet can be cached by resolvers. #### Relationships - GCPRecordSets are records of GCPDNSZones. ``` (GCPDNSZone)-[HAS_RECORD]->(GCPRecordSet) ``` ### GCPSubnet Representation of a GCP [Subnetwork](https://cloud.google.com/compute/docs/reference/rest/v1/subnetworks). > **Ontology Mapping**: This node has the extra label `Subnet` and normalized `_ont_*` properties to enable cross-platform queries for network subnets across different systems (e.g., AWSEC2Subnet, AzureSubnet). | Field | Description | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | A partial resource URI representing this Subnet. Has the form `projects/{project}/regions/{region}/subnetworks/{subnet name}`. | | partial_uri | Same as `id` | | self_link | The full resource URI representing this subnet. Has the form `https://www.googleapis.com/compute/v1/{partial_uri}` | | project_id | The project ID that this Subnet belongs to | | name | The name of this Subnet | | region | The region of this Subnet | | gateway_address | Gateway IP address of this Subnet | | ip_cidr_range | The CIDR range covered by this Subnet | | vpc_partial_uri | The partial URI of the VPC that this Subnet is a part of | | private_ip_google_access | Whether the VMs in this subnet can access Google services without assigned external IP addresses. This field can be both set at resource creation time and updated using setPrivateIpGoogleAccess. | | purpose | Purpose of the subnet, e.g. `PRIVATE` or service-specific values such as internal load-balancer reservations. | | flow_logs_enabled | Whether VPC Flow Logs are enabled for the subnet. | | flow_logs_aggregation_interval | Flow Logs aggregation interval, e.g. `INTERVAL_5_SEC`. | | flow_logs_sampling | Flow Logs sampling rate, e.g. `1.0` for 100%. | | flow_logs_metadata | Flow Logs metadata mode, e.g. `INCLUDE_ALL_METADATA`. | | flow_logs_filter_expr | Optional Flow Logs filter expression when subnet logging is filtered. | #### Relationships - GCPSubnets are resources of GCPProjects (primary organizational relationship) ``` (:GCPProject)-[:RESOURCE]->(:GCPSubnet) ``` - GCPSubnets are part of GCP VPCs ``` (:GCPVpc)-[:HAS]->(:GCPSubnet) ``` - GCPNetworkInterfaces are connected to GCPSubnets ``` (:GCPNetworkInterface)-[:PART_OF_SUBNET]->(:GCPSubnet) ``` ### GCPFirewall Representation of a GCP [Firewall](https://cloud.google.com/compute/docs/reference/rest/v1/firewalls/list). > **Ontology Mapping**: This node has the extra label `NetworkAccessControl` to enable cross-platform queries for security groups and firewall rules across different systems (e.g., AWSEC2SecurityGroup, GCPFirewall, AzureNetworkSecurityGroup). | Field | Description | | --------------------------- | ----------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | A partial resource URI representing this Firewall. | | partial_uri | Same as `id` | | direction | Either 'INGRESS' for inbound or 'EGRESS' for outbound | | disabled | Whether this firewall object is disabled | | priority | The priority of this firewall rule from 1 (apply this first)-65535 (apply this last) | | self_link | The full resource URI to this firewall | | has_target_service_accounts | Set to True if this Firewall has target service accounts defined. This field is currently a placeholder for future functionality to add GCP IAM objects to Cartography. If True, this firewall rule will only apply to GCP instances that use the specified target service account. | #### Relationships - Firewalls belong to VPCs ``` (GCPVpc)-[RESOURCE]->(GCPFirewall) ``` - Firewalls define rules that allow traffic ``` (GCPIpRule)-[ALLOWED_BY]->(GCPFirewall) ``` - Firewalls define rules that deny traffic ``` (GCPIpRule)-[DENIED_BY]->(GCPFirewall) ``` - GCP Firewalls can be labeled with tags to direct traffic to or deny traffic to labeled GCPInstances ``` (GCPFirewall)-[:TARGET_TAG]->(GCPNetworkTag) ``` - GCP Firewalls allow ingress to GCP instances. ``` (GCPFirewall)-[:FIREWALL_INGRESS]->(GCPInstance) ``` Note that this relationship is a shortcut for: ``` (vpc:GCPVpc)<-[MEMBER_OF_GCP_VPC]-(GCPInstance)-[TAGGED]->(GCPNetworkTag)-[TARGET_TAG]-(GCPFirewall{direction: 'INGRESS'})<-[RESOURCE]-(vpc) ``` as well as ``` MATCH (fw:GCPFirewall{direction: 'INGRESS', has_target_service_accounts: False}}) WHERE NOT (fw)-[TARGET_TAG]->(GCPNetworkTag) MATCH (GCPInstance)-[MEMBER_OF_GCP_VPC]->(GCPVpc)-[RESOURCE]->(fw) ``` ### GCPForwardingRule Representation of GCP [Forwarding Rules](https://cloud.google.com/compute/docs/reference/rest/v1/forwardingRules/list) and [Global Forwarding Rules](https://cloud.google.com/compute/docs/reference/rest/v1/globalForwardingRules/list). > **Ontology Mapping**: This node has the extra label `LoadBalancer` to enable cross-platform queries for load balancers across different systems (e.g., AWSLoadBalancerV2, LoadBalancer, AzureLoadBalancer). | Field | Description | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | A partial resource URI representing this Forwarding Rule | | partial_uri | Same as `id` | | ip_address | IP address that this Forwarding Rule serves | | ip_protocol | IP protocol to which this rule applies | | load_balancing_scheme | Specifies the Forwarding Rule type | | lb_type | Normalised load-balancer family derived from the target proxy collection (`http`, `https`, `tcp`, `ssl`, `grpc`, `network`, `vpn`). | | name | Name of the Forwarding Rule | | network | A partial resource URI of the network this Forwarding Rule belongs to | | port_range | Port range used in conjunction with a target resource. Only packets addressed to ports in the specified range will be forwarded to target configured | | ports | Ports to forward to a backend service. Only packets addressed to these ports are forwarded to the backend services configured | | project_id | The project ID that this Forwarding Rule belongs to | | region | The region of this Forwarding Rule | | self_link | Server-defined URL for the resource | | subnetwork | A partial resource URI of the subnetwork this Forwarding Rule belongs to | | target | A partial resource URI of the target resource to receive the traffic | | exposed_internet | Set to `true` if `load_balancing_scheme` is `EXTERNAL` or `EXTERNAL_MANAGED`. Set by the `gcp_compute_exposure` scoped analysis job. | | exposed_internet_type | Set to `'direct'` when the forwarding rule is external-facing. | #### Relationships - GCPForwardingRules can be a resource of a GCPVpc. ``` (GCPVpc)-[RESOURCE]->(GCPForwardingRule) ``` - GCPForwardingRules can be a resource of a GCPSubnet. ``` (GCPSubnet)-[RESOURCE]->(GCPForwardingRule) ``` ### GKECluster Representation of a GCP [GKE Cluster](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/). > **Ontology Mapping**: This node has the extra label `ComputeCluster` to enable cross-platform queries for compute clusters across different systems (e.g., AWSEKSCluster, AWSECSCluster, AzureKubernetesCluster, KubernetesCluster). | Field | Description | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | basic_auth | Set to `True` if both `masterauth_username` and `masterauth_password` are set | | created_at | The date and time the cluster was created | | cluster_ipv4cidr | The IP address range of the container pods in the cluster | | current_master_version | The current software version of the master endpoint | | database_encryption | Configuration of etcd encryption | | description | An optional description of the cluster | | endpoint | The IP address of the cluster's master endpoint. The endpoint can be accessed from the internet at https://username:password@endpoint/ | | exposed_internet | Set to `True` if at least among `private_nodes`, `private_endpoint_enabled`, or `master_authorized_networks` are disabled | | firstseen | Timestamp of when a sync job first discovered this node | | **id** | Same as `self_link` | | initial_version | The initial Kubernetes version for the cluster | | location | The name of the Google Compute Engine zone or region in which the cluster resides | | logging_service | The logging service used to write logs. Available options: `logging.googleapis.com/kubernetes`, `logging.googleapis.com`, `none` | | master_authorized_networks | If enabled, it disallows all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs | | masterauth_username | The username to use for HTTP basic authentication to the master endpoint. For clusters v1.6.0 and later, basic authentication can be disabled by leaving username unspecified (or setting it to the empty string) | | masterauth_password | The password to use for HTTP basic authentication to the master endpoint. If a password is provided for cluster creation, username must be non-empty | | monitoring_service | The monitoring service used to write metrics. Available options: `monitoring.googleapis.com/kubernetes`, `monitoring.googleapis.com`, `none` | | name | The name of the cluster | | network | The name of the Google Compute Engine network to which the cluster is connected | | network_policy | Set to `True` if a network policy provider has been enabled | | private_endpoint_enabled | Whether the master's internal IP address is used as the cluster endpoint | | private_endpoint | The internal IP address of the cluster's master endpoint | | private_nodes | If enabled, all nodes are given only private addresses and communicate with the master via private networking | | public_endpoint | The external IP address of the cluster's master endpoint | | **self_link** | Server-defined URL for the resource | | services_ipv4cidr | The IP address range of the Kubernetes services in the cluster | | shielded_nodes | Whether Shielded Nodes are enabled | | status | The current status of the cluster | | subnetwork | The name of the Google Compute Engine subnetwork to which the cluster is connected | | zone | The name of the Google Compute Engine zone in which the cluster resides | #### Relationships - GKEClusters are resources of GCPProjects. ``` (GCPProject)-[RESOURCE]->(GKECluster) ``` ### GCPIpRule::IpPermissionInbound::IpRule A GCPIpRule node represents an inbound GCP firewall IP rule. It carries semantic labels for compatibility with generic inbound rule queries. > **Ontology Mapping**: This node has the extra labels `IpPermissionInbound` and `IpRule` to preserve semantic compatibility. | Field | Description | | ----------- | ----------------------------------------------------------- | | **ruleid** | `{firewall_partial_uri}/{rule_type}/{port_range}{protocol}` | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | protocol | The protocol this rule applies to | | fromport | Lowest port in the range defined by this rule | | toport | Highest port in the range defined by this rule | #### Relationships - GCP firewall rules are defined on GCPIpRange objects. ``` (GCPIpRange)-[MEMBER_OF_IP_RULE]->(GCPIpRule) ``` - Firewalls define rules that allow traffic ``` (GCPIpRule)-[ALLOWED_BY]->(GCPFirewall) ``` - Firewalls define rules that deny traffic ``` (GCPIpRule)-[DENIED_BY]->(GCPFirewall) ``` ### GCPIpRange::IpRange Representation of an IP range or subnet. > **Ontology Mapping**: This node has the extra label `IpRange` to preserve cross-platform semantics for generic IP ranges. | Field | Description | | ----------- | ------------------------------------------------------------------------ | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | id | CIDR notation for the IP range. E.g. "0.0.0.0/0" for the whole internet. | #### Relationships - GCPIpRanges are members of GCPIpRules. ``` (GCPIpRange)-[MEMBER_OF_IP_RULE]->(GCPIpRule) ``` ### GCPServiceAccount Representation of a GCP [Service Account](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts). > **Ontology Mapping**: This node has the extra label `ServiceAccount` to enable cross-platform queries for service accounts across different systems (e.g., KubernetesServiceAccount, OpenAIServiceAccount, ScalewayApplication). | Field | Description | | -------------- | ----------------------------------------------------------------------------------------------- | | id | The unique identifier for the service account. | | email | The email address associated with the service account. | | displayName | The display name of the service account. | | oauth2ClientId | The OAuth2 client ID associated with the service account. | | uniqueId | The unique ID of the service account. | | disabled | A boolean indicating if the service account is disabled. | | lastupdated | The timestamp of the last update. | | projectId | The ID of the GCP project to which the service account belongs. | #### Relationships - GCPServiceAccounts are resources of GCPProjects. ``` (GCPProject)-[RESOURCE]->(GCPServiceAccount) ``` - GCPPrincipals with appropriate impersonation permissions can act as a GCPServiceAccount. Created from [gcp_permission_relationships.yaml](https://github.com/cartography-cncf/cartography/blob/master/cartography/data/gcp_permission_relationships.yaml). Driven by `iam.serviceAccounts.actAs` and related permissions packaged in `roles/iam.serviceAccountTokenCreator` and `roles/iam.serviceAccountUser`. ``` (GCPPrincipal)-[CAN_IMPERSONATE]->(GCPServiceAccount) ``` - GCPServiceAccounts have user-managed authentication keys (system-managed keys are intentionally not synced). ``` (GCPServiceAccountKey)-[OWNED_BY]->(GCPServiceAccount) ``` ### GCPServiceAccountKey Representation of a user-managed GCP [Service Account Key](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts.keys). System-managed keys (rotated automatically by Google) are not ingested. > **Ontology Mapping**: This node has the extra label `APIKey` to enable cross-platform queries for long-lived API credentials across different systems (e.g., AWSAccountAccessKey, ScalewayApiKey). | Field | Description | | -------------------- | ------------------------------------------------------------------------------------------------------ | | id | The full resource name of the key, e.g. `projects/{p}/serviceAccounts/{email}/keys/{key_id}`. | | name | Same as id. | | key_type | The provenance of the key. Always `USER_MANAGED` for ingested keys. | | key_origin | Whether the key was generated by Google (`GOOGLE_PROVIDED`) or imported (`USER_PROVIDED`). | | key_algorithm | The cryptographic algorithm of the key (e.g. `KEY_ALG_RSA_2048`). | | valid_after_time | RFC 3339 timestamp from which the key is valid (effectively the key creation time). | | valid_before_time | RFC 3339 timestamp until which the key is valid. | | disabled | Whether the key is disabled. | | service_account_email | Email of the parent GCPServiceAccount. | | lastupdated | The timestamp of the last update. | #### Relationships - GCPServiceAccountKeys are resources of GCPProjects. ``` (GCPProject)-[RESOURCE]->(GCPServiceAccountKey) ``` - GCPServiceAccountKeys are owned by their parent GCPServiceAccount. ``` (GCPServiceAccountKey)-[OWNED_BY]->(GCPServiceAccount) ``` ### GCPApiKey Representation of a GCP [API Key](https://cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys) (`apikeys.googleapis.com`). These are the encrypted-string keys used to authenticate to public Google APIs, distinct from `GCPServiceAccountKey`. The secret key material (`keyString`) is never ingested. > **Ontology Mapping**: This node has the extra label `APIKey` to enable cross-platform queries for long-lived API credentials across different systems (e.g., AWSAccountAccessKey, ScalewayApiKey). | Field | Description | | ------------ | --------------------------------------------------------------------------------------------- | | **id** | The full resource name, e.g. `projects/{p}/locations/global/keys/{uid}`. | | name | Same as id. | | uid | The unique identifier of the key. | | display_name | Human-readable display name of the key. | | create_time | RFC 3339 timestamp when the key was created. | | update_time | RFC 3339 timestamp when the key was last updated. | | delete_time | RFC 3339 timestamp when the key was deleted, if applicable. | | restricted | Whether the key has any API or application restrictions. Unrestricted keys are higher risk. | | restrictions | JSON-encoded restriction configuration (API targets, allowed referrers/IPs/apps), if any. | | etag | The etag of the key. | | lastupdated | The timestamp of the last update. | #### Relationships - GCPApiKeys are resources of GCPProjects. ``` (GCPProject)-[RESOURCE]->(GCPApiKey) ``` ### GCPRole Representation of a GCP [Role](https://cloud.google.com/iam/docs/reference/rest/v1/organizations.roles). > **Ontology Mapping**: This node has the extra label `PermissionRole` to enable cross-platform queries for IAM roles and permission roles across different systems (e.g., AWSRole, AzureRoleDefinition, GCPRole, KubernetesRole). Roles exist at different levels in the GCP hierarchy and are synced separately: - **Predefined/Basic roles** (`roles/*`) - Global roles defined by Google, synced at the organization level - **Custom organization roles** (`organizations/*/roles/*`) - Custom roles defined at the organization level - **Custom project roles** (`projects/*/roles/*`) - Custom roles defined at the project level **Important**: Organization-level roles (predefined + custom org) and project-level roles (custom project) have different sub-resource relationships: - Organization-level roles are sub-resources of `GCPOrganization` - Project-level roles are sub-resources of `GCPProject` | Field | Description | | ------------------- | ----------------------------------------------------------------------------------------------------- | | id | The unique identifier for the role (same as name). | | name | The name of the role (e.g., `roles/editor`, `organizations/123/roles/custom`, `projects/abc/roles/custom`). | | title | The human-readable title of the role. | | description | A description of the role. | | deleted | A boolean indicating if the role is deleted. | | etag | The ETag of the role for optimistic concurrency control. | | permissions | A list of permissions included in the role. | | role\_type | The type of the role: `BASIC`, `PREDEFINED`, or `CUSTOM`. | | scope | The scope of the role: `GLOBAL` (predefined/basic), `ORGANIZATION` (custom org), or `PROJECT` (custom project). | | lastupdated | The timestamp of the last update. | | project\_id | The ID of the GCP project for project-level custom roles only. | | organization\_id | The ID of the GCP organization for organization-level roles (predefined and custom org) only. | #### Relationships - Organization-level GCPRoles (predefined/basic and custom org roles) are sub-resources of GCPOrganizations. ``` (GCPOrganization)-[RESOURCE]->(GCPRole) ``` - Project-level GCPRoles (custom project roles) are sub-resources of GCPProjects. ``` (GCPProject)-[RESOURCE]->(GCPRole) ``` - GCPPolicyBindings grant GCPRoles. ``` (GCPPolicyBinding)-[GRANTS_ROLE]->(GCPRole) ``` ### GCPKeyRing Representation of a GCP [Key Ring](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings). | Field | Description | |---|---| | id | The full resource name of the Key Ring. | | name | The short name of the Key Ring. | | location | The GCP location of the Key Ring. | | lastupdated | The timestamp of the last update. | | project\_id | The full project ID (projects/...) this Key Ring belongs to. | #### Relationships - GCPKeyRings are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPKeyRing) ``` ### GCPCryptoKey Representation of a GCP [Crypto Key](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys). > **Ontology Mapping**: This node has the extra label `EncryptionKey` to enable cross-platform queries for encryption keys across different systems (e.g., AWSKMSKey, GCPCryptoKey, AzureKeyVaultKey). | Field | Description | |---|---| | id | The full resource name of the Crypto Key. | | name | The short name of the Crypto Key. | | rotation\_period | The rotation period of the key (e.g., `7776000s`). | | purpose | The key purpose (e.g., `ENCRYPT_DECRYPT`). | | state | The state of the primary key version (e.g., `ENABLED`). | | lastupdated | The timestamp of the last update. | | project\_id | The full project ID (projects/...) this key belongs to. | | key\_ring\_id | The full ID of the parent Key Ring. | #### Relationships - GCPCryptoKeys are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCryptoKey) ``` - GCPKeyRings contain GCPCryptoKeys. ``` (GCPKeyRing)-[CONTAINS]->(GCPCryptoKey) ``` - GCPPrincipals with appropriate permissions can decrypt with a key. Created from [gcp_permission_relationships.yaml](https://github.com/cartography-cncf/cartography/blob/master/cartography/data/gcp_permission_relationships.yaml). Driven by `cloudkms.cryptoKeyVersions.useToDecrypt`. ``` (GCPPrincipal)-[CAN_DECRYPT]->(GCPCryptoKey) ``` - GCPPrincipals with appropriate permissions can encrypt with a key. Driven by `cloudkms.cryptoKeyVersions.useToEncrypt`. ``` (GCPPrincipal)-[CAN_ENCRYPT]->(GCPCryptoKey) ``` ### GCPPolicyBinding Representation of a GCP [IAM Policy Binding](https://cloud.google.com/iam/docs/reference/rest/v1/Policy#Binding). Policy bindings connect principals (users, service accounts, groups) to roles on specific resources. | Field | Description | | -------------------- | -------------------------------------------------------------------------------- | | id | The unique identifier for the policy binding in the format "{resource}_{role}". | | role | The name of the GCP role being granted. | | resource | The full resource name where the policy binding is attached. | | resource_type | The type of resource. | | members | A list of principal email addresses that are granted the role. The synthetic GCP principals `allUsers` and `allAuthenticatedUsers` are NOT included here; presence of either is reflected in `is_public` instead. | | wif_pools | A list of Workload Identity Federation pool resource names (`projects/{N}/locations/global/workloadIdentityPools/{POOL}`) referenced by `principal://` or `principalSet://` members of this binding. | | domains | A list of domains (`domain:{domain}`) granted the role. These do not resolve to a single `GCPPrincipal` node, but are retained for visibility (e.g. broad-access audits). | | is_public | True if the binding includes the `allUsers` or `allAuthenticatedUsers` principal. Combine with `has_condition = false` to reason about unconditional public exposure. | | has_condition | A boolean indicating if the policy binding has a condition attached. | | condition_title | The title of the condition. | | condition_expression | The expression of the condition. | | firstseen | Timestamp of when a sync job first discovered this node. | | lastupdated | Timestamp of the last time the node was updated. | #### Relationships - GCPPolicyBindings are resources of the scope where the binding is attached. Project and child-resource bindings are owned by GCPProjects. Inherited organization and folder bindings are owned by GCPOrganizations and GCPFolders, respectively. Queries that need inherited bindings should traverse the binding's owner scope or its `APPLIES_TO` edge. ``` (GCPProject)-[:RESOURCE]->(GCPPolicyBinding) (GCPOrganization)-[:RESOURCE]->(GCPPolicyBinding) (GCPFolder)-[:RESOURCE]->(GCPPolicyBinding) ``` - GCPPrincipals have allow policies that grant them access. ``` (GCPPrincipal)-[:HAS_ALLOW_POLICY]->(GCPPolicyBinding) ``` - Workload Identity Federation pools have allow policies that grant federated principals access. The edge is created when a binding member is a `principal://` or `principalSet://` URI referencing the pool. ``` (GCPWorkloadIdentityPool)-[:HAS_ALLOW_POLICY]->(GCPPolicyBinding) ``` - GCPPolicyBindings grant roles to principals. ``` (GCPPolicyBinding)-[:GRANTS_ROLE]->(GCPRole) ``` - GCPPolicyBindings apply to the concrete resource they govern. The edge is created only when the bound resource is already present in the graph, and supports `GCPProject`, `GCPFolder`, `GCPOrganization`, `GCPBucket`, `GCPKeyRing`, `GCPCryptoKey`, `GCPSecretManagerSecret`, `GCPSecretManagerSecretVersion`, `GCPArtifactRegistryRepository`, `GCPCloudRunService`, `GCPInstance`, `GCPVpc`, `GCPSubnet`, and `GCPFirewall` targets. ``` (GCPPolicyBinding)-[:APPLIES_TO]->(:GCPProject|GCPBucket|GCPCryptoKey|...) ``` ### GCPWorkloadIdentityPool Representation of a GCP [Workload Identity Pool](https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools). A pool groups external identities that can impersonate GCP service accounts via federation. | Field | Description | | ---------------- | ---------------------------------------------------------------------------------------------------- | | id | The full resource name, e.g. `projects/{number}/locations/global/workloadIdentityPools/{pool_id}`. | | name | Same as `id`. | | display_name | The friendly name of the pool. | | description | A description of the pool. | | state | Pool state (`ACTIVE`, `DELETED`). | | disabled | Whether the pool is disabled. | | mode | Pool mode. `SYSTEM_TRUST_DOMAIN` indicates a GKE-managed pool (`*.svc.id.goog`) whose providers are managed by Google and not enumerated by Cartography. Otherwise the field is unset or carries a user-managed mode. | | session_duration | Default session duration for federated tokens issued via this pool. | | firstseen | Timestamp of when a sync job first discovered this node. | | lastupdated | Timestamp of the last time the node was updated. | #### Relationships - GCPWorkloadIdentityPools are sub-resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPWorkloadIdentityPool) ``` - GCPWorkloadIdentityPools have allow policies granting their federated identities access. ``` (GCPWorkloadIdentityPool)-[:HAS_ALLOW_POLICY]->(GCPPolicyBinding) ``` ### GCPWorkloadIdentityProvider Representation of a GCP [Workload Identity Pool Provider](https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers). A provider connects a pool to an external identity source (OIDC, AWS, SAML, or X509). > **Ontology Mapping**: This node has the extra label `IdentityProvider` to enable cross-platform queries for federated identity providers across different systems (e.g., AWSSAMLProvider, KeycloakIdentityProvider, KubernetesOIDCProvider). | Field | Description | | ---------------------- | ------------------------------------------------------------------------------------------ | | id | The full provider resource name. | | name | Same as `id`. | | display_name | The friendly name of the provider. | | description | A description of the provider. | | state | Provider state (`ACTIVE`, `DELETED`). | | disabled | Whether the provider is explicitly disabled. | | enabled | Effective enabled flag: true only when both the provider and its parent pool are `state == ACTIVE` and not disabled. Used for the `IdentityProvider` ontology mapping. | | protocol | One of `OIDC`, `AWS`, `SAML`, `X509`, depending on which sub-object is populated. | | attribute_condition | CEL expression that gates token claims before federation. | | oidc_issuer_uri | OIDC issuer URI (only set when `protocol = OIDC`). | | oidc_allowed_audiences | OIDC allowed audiences (only set when `protocol = OIDC`). | | aws_account_id | AWS account ID this provider trusts (only set when `protocol = AWS`). | | saml_idp_metadata_xml | SAML IdP metadata XML (only set when `protocol = SAML`). | | pool_name | The resource name of the parent GCPWorkloadIdentityPool. | | firstseen | Timestamp of when a sync job first discovered this node. | | lastupdated | Timestamp of the last time the node was updated. | #### Relationships - GCPWorkloadIdentityProviders are sub-resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPWorkloadIdentityProvider) ``` - GCPWorkloadIdentityProviders belong to a GCPWorkloadIdentityPool. ``` (GCPWorkloadIdentityProvider)-[:MEMBER_OF]->(GCPWorkloadIdentityPool) ``` ### GCPBigtableInstance Representation of a GCP [Bigtable Instance](https://cloud.google.com/bigtable/docs/reference/admin/rest/v2/projects.instances). > **Ontology Mapping**: This node has the extra label `Database` to enable cross-platform queries for database instances across different systems (e.g., AWSRDSInstance, AWSDynamoDBTable, AzureSQLDatabase). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | The full resource name of the Bigtable Instance. | | name | The full resource name of the Bigtable Instance. | | display\_name | The human-readable display name for the instance. | | state | The current state of the instance (e.g., `READY`). | | type | The type of instance (e.g., `PRODUCTION`). | #### Relationships - GCPBigtableInstances are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBigtableInstance) ``` ### GCPBigtableCluster Representation of a GCP [Bigtable Cluster](https://cloud.google.com/bigtable/docs/reference/admin/rest/v2/projects.instances.clusters). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | The full resource name of the Bigtable Cluster. | | name | The full resource name of the Bigtable Cluster. | | location | The GCP location where this cluster resides (e.g., `projects/.../locations/us-central1-b`). | | state | The current state of the cluster (e.g., `READY`). | | default\_storage\_type | The storage media type for the cluster (e.g., `SSD`). | #### Relationships - GCPBigtableClusters are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBigtableCluster) ``` - GCPBigtableInstances have one or more Clusters. ``` (GCPBigtableInstance)-[:HAS_CLUSTER]->(GCPBigtableCluster) ``` ### GCPBigtableTable Representation of a GCP [Bigtable Table](https://cloud.google.com/bigtable/docs/reference/admin/rest/v2/projects.instances.tables). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | The full resource name of the Bigtable Table. | | name | The full resource name of the Bigtable Table. | | granularity | The granularity at which timestamps are stored (e.g., `MILLIS`). | #### Relationships - GCPBigtableTables are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBigtableTable) ``` - GCPBigtableInstances have one or more Tables. ``` (GCPBigtableInstance)-[:HAS_TABLE]->(GCPBigtableTable) ``` ### GCPBigtableAppProfile Representation of a GCP [Bigtable App Profile](https://cloud.google.com/bigtable/docs/reference/admin/rest/v2/projects.instances.appProfiles). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | The full resource name of the App Profile. | | name | The full resource name of the App Profile. | | description | The user-provided description of the app profile. | | multi\_cluster\_routing\_use\_any | Whether this profile routes to any available cluster. | | single\_cluster\_routing\_cluster\_id | The full resource ID of the cluster this profile routes to, if configured. | #### Relationships - GCPBigtableAppProfiles are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBigtableAppProfile) ``` - GCPBigtableInstances have one or more App Profiles. ``` (GCPBigtableInstance)-[:HAS_APP_PROFILE]->(GCPBigtableAppProfile) ``` - GCPBigtableAppProfiles (with single cluster routing) route to a specific Cluster. ``` (GCPBigtableAppProfile)-[:ROUTES_TO]->(GCPBigtableCluster) ``` ### GCPBigtableBackup Representation of a GCP [Bigtable Backup](https://cloud.google.com/bigtable/docs/reference/admin/rest/v2/projects.instances.clusters.backups). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | The full resource name of the Backup. | | name | The full resource name of the Backup. | | source\_table | The full resource name of the table this backup was created from. | | expire\_time | The timestamp when the backup will expire. | | start\_time | The timestamp when the backup creation started. | | end\_time | The timestamp when the backup creation finished. | | size\_bytes | The size of the backup in bytes. | | state | The current state of the backup (e.g., `READY`). | #### Relationships - GCPBigtableBackups are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBigtableBackup) ``` - GCPBigtableClusters store Backups. ``` (GCPBigtableCluster)-[:STORES_BACKUP]->(GCPBigtableBackup) ``` - GCPBigtableTables are backed up as Backups. ``` (GCPBigtableTable)-[:BACKED_UP_AS]->(GCPBigtableBackup) ``` ### GCPVertexAIModel Representation of a GCP [Vertex AI Model](https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.models). > **Ontology Mapping**: This node has the extra label `AIModel` to enable cross-platform queries for AI/ML models across different systems (e.g., AWSBedrockFoundationModel, AWSBedrockCustomModel, AWSSageMakerModel). | Field | Description | |-------|-------------| | **id** | Full resource name of the model (e.g., `projects/{project}/locations/{location}/models/{model_id}`) | | name | Same as `id` | | display_name | User-provided display name of the model | | description | Description of the model | | version_id | The version ID of the model | | version_create_time | Timestamp when this model version was created | | version_update_time | Timestamp when this model version was last updated | | create_time | Timestamp when the model was originally created | | update_time | Timestamp when the model was last updated | | artifact_uri | The path to the directory containing the Model artifact and supporting files (GCS URI) | | etag | Used to perform consistent read-modify-write updates | | labels | JSON string of user-defined labels | | training_pipeline | Resource name of the Training Pipeline that created this model | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPVertexAIModels are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPVertexAIModel) ``` - GCPVertexAIModels are stored in GCPBuckets. ``` (GCPVertexAIModel)-[:STORED_IN]->(GCPBucket) ``` - GCPVertexAITrainingPipelines produce GCPVertexAIModels. ``` (GCPVertexAITrainingPipeline)-[:PRODUCES]->(GCPVertexAIModel) ``` - GCPVertexAIDeployedModels are instances of GCPVertexAIModels. ``` (GCPVertexAIDeployedModel)-[:INSTANCE_OF]->(GCPVertexAIModel) ``` ### GCPVertexAIEndpoint Representation of a GCP [Vertex AI Endpoint](https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.endpoints). | Field | Description | |-------|-------------| | **id** | Full resource name of the endpoint (e.g., `projects/{project}/locations/{location}/endpoints/{endpoint_id}`) | | name | Same as `id` | | display_name | User-provided display name of the endpoint | | description | Description of the endpoint | | create_time | Timestamp when the endpoint was created | | update_time | Timestamp when the endpoint was last updated | | etag | Used to perform consistent read-modify-write updates | | network | The full name of the Google Compute Engine network to which the endpoint should be peered | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPVertexAIEndpoints are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPVertexAIEndpoint) ``` - GCPVertexAIEndpoints serve GCPVertexAIDeployedModels. ``` (GCPVertexAIEndpoint)-[:SERVES]->(GCPVertexAIDeployedModel) ``` ### GCPVertexAIDeployedModel Representation of a deployed model on a Vertex AI Endpoint. This is derived from the [deployedModels field](https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.endpoints#DeployedModel) on an Endpoint. | Field | Description | |-------|-------------| | **id** | Synthetic ID combining endpoint and deployed model ID (e.g., `{endpoint_id}/deployedModels/{deployed_model_id}`) | | deployed_model_id | The ID of the DeployedModel (unique within the endpoint) | | model | Full resource name of the Model that this DeployedModel is serving | | display_name | User-provided display name of the deployed model | | create_time | Timestamp when the deployed model was created | | dedicated_resources | JSON string of the dedicated resources for this deployed model | | automatic_resources | JSON string of the automatic resources for this deployed model | | enable_access_logging | Whether access logging is enabled for this deployed model | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPVertexAIEndpoints serve GCPVertexAIDeployedModels. ``` (GCPVertexAIEndpoint)-[:SERVES]->(GCPVertexAIDeployedModel) ``` - GCPVertexAIDeployedModels are instances of GCPVertexAIModels. ``` (GCPVertexAIDeployedModel)-[:INSTANCE_OF]->(GCPVertexAIModel) ``` ### GCPVertexAIWorkbenchInstance Representation of a GCP [Vertex AI Workbench Instance](https://cloud.google.com/vertex-ai/docs/workbench/reference/rest/v2/projects.locations.instances) (v2 API). | Field | Description | |-------|-------------| | **id** | Full resource name of the instance (e.g., `projects/{project}/locations/{location}/instances/{instance_id}`) | | name | Same as `id` | | creator | Email address of the user who created the instance | | create_time | Timestamp when the instance was created | | update_time | Timestamp when the instance was last updated | | state | The state of the instance (e.g., `ACTIVE`, `STOPPED`) | | health_state | The health state of the instance (e.g., `HEALTHY`) | | health_info | JSON string with detailed health information | | gce_setup | JSON string with GCE setup configuration | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPVertexAIWorkbenchInstances are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPVertexAIWorkbenchInstance) ``` - GCPVertexAIWorkbenchInstances use GCPServiceAccounts. ``` (GCPVertexAIWorkbenchInstance)-[:USES_SERVICE_ACCOUNT]->(GCPServiceAccount) ``` ### GCPVertexAITrainingPipeline Representation of a GCP [Vertex AI Training Pipeline](https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.trainingPipelines). | Field | Description | |-------|-------------| | **id** | Full resource name of the training pipeline (e.g., `projects/{project}/locations/{location}/trainingPipelines/{pipeline_id}`) | | name | Same as `id` | | display_name | User-provided display name of the training pipeline | | create_time | Timestamp when the pipeline was created | | update_time | Timestamp when the pipeline was last updated | | start_time | Timestamp when the pipeline started running | | end_time | Timestamp when the pipeline finished | | state | The state of the pipeline (e.g., `PIPELINE_STATE_SUCCEEDED`) | | error | JSON string with error information if the pipeline failed | | model_to_upload | JSON string describing the model that was uploaded | | training_task_definition | The training task definition schema URI | | dataset_id | Full resource name of the Dataset used for training (used for relationships) | | model_id | Full resource name of the Model produced by training (used for relationships) | | gcs_bucket_id | List of GCS bucket names read during training (used for relationships) | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPVertexAITrainingPipelines are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPVertexAITrainingPipeline) ``` - GCPVertexAITrainingPipelines produce GCPVertexAIModels. ``` (GCPVertexAITrainingPipeline)-[:PRODUCES]->(GCPVertexAIModel) ``` - GCPVertexAITrainingPipelines read from GCPVertexAIDatasets. ``` (GCPVertexAITrainingPipeline)-[:READS_FROM]->(GCPVertexAIDataset) ``` - GCPVertexAITrainingPipelines read from GCPBuckets. ``` (GCPVertexAITrainingPipeline)-[:READS_FROM]->(GCPBucket) ``` ### GCPVertexAIFeatureGroup Representation of a GCP [Vertex AI Feature Group](https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featureGroups). Feature Groups are the new architecture for Vertex AI Feature Store. | Field | Description | |-------|-------------| | **id** | Full resource name of the feature group (e.g., `projects/{project}/locations/{location}/featureGroups/{feature_group_id}`) | | name | Same as `id` | | create_time | Timestamp when the feature group was created | | update_time | Timestamp when the feature group was last updated | | etag | Used to perform consistent read-modify-write updates | | bigquery_source_uri | The BigQuery source URI for the feature group | | entity_id_columns | JSON array of entity ID column names | | timestamp_column | The timestamp column name (for time series features) | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPVertexAIFeatureGroups are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPVertexAIFeatureGroup) ``` ### GCPVertexAIDataset Representation of a GCP [Vertex AI Dataset](https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.datasets). | Field | Description | |-------|-------------| | **id** | Full resource name of the dataset (e.g., `projects/{project}/locations/{location}/datasets/{dataset_id}`) | | name | Same as `id` | | display_name | User-provided display name of the dataset | | create_time | Timestamp when the dataset was created | | update_time | Timestamp when the dataset was last updated | | etag | Used to perform consistent read-modify-write updates | | data_item_count | The number of data items in the dataset | | metadata_schema_uri | The metadata schema URI for the dataset | | metadata | JSON string with dataset metadata | | encryption_spec | JSON string with encryption configuration | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPVertexAIDatasets are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPVertexAIDataset) ``` - GCPVertexAITrainingPipelines read from GCPVertexAIDatasets. ``` (GCPVertexAITrainingPipeline)-[:READS_FROM]->(GCPVertexAIDataset) ``` ### GCPCloudSQLInstance Representation of a GCP [Cloud SQL Instance](https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/instances). > **Ontology Mapping**: This node has the extra label `Database` to enable cross-platform queries for database instances across different systems (e.g., AWSRDSInstance, AzureSQLDatabase, GCPBigtableInstance). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | The instance's `selfLink`, which is its unique URI. | | name | The user-assigned name of the instance. | | database\_version | The database engine type and version (e.g., `POSTGRES_15`). | | database\_engine | Normalised engine name derived from `database_version`, e.g. `postgres`, `mysql`, `sqlserver`. | | region | The GCP region the instance lives in. | | gce\_zone | The specific Compute Engine zone the instance is serving from. | | state | The current state of the instance (e.g., `RUNNABLE`). | | backend\_type | The type of instance (e.g., `SECOND_GEN`). | | service\_account\_email | The email of the service account used by this instance. | | connection\_name | The connection string for accessing the instance (e.g., `project:region:instance`). | | tier | The machine type tier (e.g., `db-custom-1-3840`). | | disk\_size\_gb | Storage capacity in gigabytes. | | disk\_type | Storage disk type (e.g., `PD_SSD`, `PD_HDD`, `HYPERDISK_BALANCED`). | | availability\_type | Availability configuration (`ZONAL` or `REGIONAL` for high availability). | | backup\_enabled | Boolean indicating if automated backups are enabled. | | require\_ssl | Boolean indicating if SSL/TLS encryption is required for connections. | | ssl\_mode | Cloud SQL SSL mode, such as `ENCRYPTED_ONLY`. | | ip\_addresses | JSON string containing array of IP addresses with their types (PRIMARY, PRIVATE, OUTGOING). | | authorized\_networks | JSON string containing authorized public network CIDRs configured on the instance. | | backup\_configuration | JSON string containing full backup configuration including retention and point-in-time recovery settings. | | database\_flags | JSON string containing configured Cloud SQL database flags for the instance. | #### Relationships - GCPCloudSQLInstances are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudSQLInstance) ``` - GCPCloudSQLInstances are associated with GCPVpcs. ``` (GCPCloudSQLInstance)-[:ASSOCIATED_WITH]->(GCPVpc) ``` - GCPCloudSQLInstances use GCPServiceAccounts. ``` (GCPCloudSQLInstance)-[:USES_SERVICE_ACCOUNT]->(GCPServiceAccount) ``` - GCPCloudSQLInstances accept inbound connections from each declared authorized network. ``` (GCPCloudSQLInstance)-[:AUTHORIZED_NETWORK]->(GCPCloudSQLAuthorizedNetwork) ``` ### GCPCloudSQLAuthorizedNetwork Representation of an entry in a Cloud SQL instance's [authorized networks list](https://cloud.google.com/sql/docs/mysql/configure-ip). One node per declared CIDR; queries can spot internet-exposed instances by matching `value = '0.0.0.0/0'`. | Field | Description | | --------------- | ---------------------------------------------------------------------------------------- | | id | `{instance_self_link}/authorizedNetworks/{value}`. | | name | Human-readable label assigned to the authorized network entry. | | value | The CIDR allowed inbound, e.g. `203.0.113.0/24` or `0.0.0.0/0`. | | expiration_time | RFC 3339 timestamp at which the entry expires, if set. | | instance_id | The selfLink of the parent GCPCloudSQLInstance. | | lastupdated | The timestamp of the last update. | #### Relationships - GCPCloudSQLAuthorizedNetworks are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudSQLAuthorizedNetwork) ``` - GCPCloudSQLAuthorizedNetworks belong to a GCPCloudSQLInstance. ``` (GCPCloudSQLInstance)-[:AUTHORIZED_NETWORK]->(GCPCloudSQLAuthorizedNetwork) ``` ### GCPCloudSQLDatabase Representation of a GCP [Cloud SQL Database](https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/databases). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | A unique ID constructed from the parent instance ID and database name. | | name | The name of the database. | | charset | The character set for the database. | | collation | The collation for the database. | #### Relationships - GCPCloudSQLDatabases are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudSQLDatabase) ``` - GCPCloudSQLInstances contain GCPCloudSQLDatabases. ``` (GCPCloudSQLInstance)-[:CONTAINS]->(GCPCloudSQLDatabase) ``` ### GCPCloudSQLUser Representation of a GCP [Cloud SQL User](https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | A unique ID constructed from the parent instance ID and the user's name and host. | | name | The name of the user. | | host | The host from which the user is allowed to connect. | #### Relationships - GCPCloudSQLUsers are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudSQLUser) ``` - GCPCloudSQLInstances have GCPCloudSQLUsers. ``` (GCPCloudSQLInstance)-[:HAS_USER]->(GCPCloudSQLUser) ``` ### GCPCloudSQLBackupConfiguration Representation of a GCP [Cloud SQL Backup Configuration](https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/instances#backupconfiguration). This node captures the backup settings for a Cloud SQL instance. | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | A unique ID constructed from the parent instance ID with `/backupConfig` suffix. | | enabled | Boolean indicating whether automated backups are enabled. | | start\_time | The start time for the daily backup window in UTC (HH:MM format). | | location | The location where backups are stored. | | point\_in\_time\_recovery\_enabled | Boolean indicating whether point-in-time recovery is enabled. | | transaction\_log\_retention\_days | Number of days of transaction logs retained for point-in-time recovery. | | backup\_retention\_settings | String representation of backup retention configuration (e.g., retained backup count). | | binary\_log\_enabled | Boolean indicating whether binary logging is enabled. | | instance\_id | The ID of the parent Cloud SQL instance. | #### Relationships - GCPCloudSQLBackupConfigurations are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudSQLBackupConfiguration) ``` - GCPCloudSQLInstances have GCPCloudSQLBackupConfigurations. ``` (GCPCloudSQLInstance)-[:HAS_BACKUP_CONFIG]->(GCPCloudSQLBackupConfiguration) ``` ### GCPCloudFunction Representation of a Google [Cloud Function](https://cloud.google.com/functions/docs/reference/rest/v1/projects.locations.functions) (v1 API). > **Ontology Mapping**: This node has the extra label `Function` and normalized `_ont_*` properties for cross-platform serverless function queries. See [Function](../../ontology/schema.md#function). | Field | Description | | --------------------- | --------------------------------------------------------------------------- | | id | The full, unique resource name of the function. | | name | The full, unique resource name of the function (same as id). | | description | User-provided description of the function. | | runtime | The language runtime environment for the function (e.g., python310). | | available_memory_mb | Memory allocated to the function, in MB (from `availableMemoryMb`). | | timeout | Maximum execution time, in seconds (parsed from the API's Duration string; whole-second values are stored as int, fractional values as float). | | entry_point | The name of the function within the source code to be executed. | | status | The current state of the function (e.g., ACTIVE, OFFLINE, DEPLOY_IN_PROGRESS). | | update_time | The timestamp when the function was last modified. | | service_account_email | The email of the service account the function runs as. | | https_trigger_url | The public URL if the function is triggered by an HTTP request. | | event_trigger_type | The type of event that triggers the function (e.g., a Pub/Sub message). | | event_trigger_resource| The specific resource the event trigger monitors. | | project_id | The ID of the GCP project to which the function belongs. | | region | The GCP region where the function is deployed. | | lastupdated | Timestamp of when the data was last updated in the graph. | #### Relationships - GCPCloudFunctions are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudFunction) ``` - GCPCloudFunctions run as GCPServiceAccounts. ``` (GCPCloudFunction)-[:RUNS_AS]->(GCPServiceAccount) ``` - GCPCloudFunctions can be labeled with GCPLabels. ``` (GCPCloudFunction)-[:LABELED]->(GCPLabel) ``` ### GCPSecretManagerSecret Representation of a GCP [Secret Manager Secret](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets). A Secret is a logical container for secret data that can have multiple versions. > **Ontology Mapping**: This node has the extra label `Secret` and normalized `_ont_*` properties for cross-platform secret queries. See [Secret](../../ontology/schema.md#secret). | Field | Description | |-------|-------------| | **id** | Full resource name of the secret (e.g., `projects/{project}/secrets/{secret_id}`) | | name | The short name of the secret | | project_id | The GCP project ID that owns this secret | | rotation_enabled | Boolean indicating if automatic rotation is configured | | rotation_period | The rotation period in seconds (if rotation is enabled) | | rotation_next_time | Epoch timestamp of the next scheduled rotation | | created_date | Epoch timestamp when the secret was created | | expire_time | Epoch timestamp when the secret will automatically expire and be deleted | | replication_type | The replication policy type: `automatic` or `user_managed` | | etag | Used to perform consistent read-modify-write updates | | labels | JSON string of user-defined labels | | topics | JSON string of Pub/Sub topics for rotation notifications | | version_aliases | JSON string mapping alias names to version numbers | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPSecretManagerSecrets are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPSecretManagerSecret) ``` - GCPPrincipals with appropriate permissions can read GCP Secret Manager secrets. Created from [gcp_permission_relationships.yaml](https://github.com/cartography-cncf/cartography/blob/master/cartography/data/gcp_permission_relationships.yaml). ``` (GCPPrincipal)-[:CAN_READ]->(GCPSecretManagerSecret) ``` ### GCPSecretManagerSecretVersion Representation of a GCP [Secret Manager Secret Version](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets.versions). A SecretVersion stores a specific version of secret data within a Secret. | Field | Description | |-------|-------------| | **id** | Full resource name of the version (e.g., `projects/{project}/secrets/{secret_id}/versions/{version}`) | | secret_id | Full resource name of the parent secret | | version | The version number (e.g., "1", "2") | | state | The current state of the version: `ENABLED`, `DISABLED`, or `DESTROYED` | | created_date | Epoch timestamp when the version was created | | destroy_time | Epoch timestamp when the version was destroyed (only present if state is `DESTROYED`) | | etag | Used to perform consistent read-modify-write updates | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPSecretManagerSecretVersions are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPSecretManagerSecretVersion) ``` - GCPSecretManagerSecretVersions are versions of GCPSecretManagerSecrets. ``` (GCPSecretManagerSecretVersion)-[:VERSION_OF]->(GCPSecretManagerSecret) ``` ### Artifact Registry Resources #### Overview Google Cloud Artifact Registry is a universal package manager for managing container images and language packages. Cartography ingests the following Artifact Registry resources with dedicated node types for each artifact category: ```mermaid graph LR Project[GCPProject] Repository[GCPArtifactRegistryRepository] RepositoryImage[GCPArtifactRegistryRepositoryImage] Image[GCPArtifactRegistryImage] HelmChart[GCPArtifactRegistryHelmChart] LanguagePackage[GCPArtifactRegistryLanguagePackage] GenericArtifact[GCPArtifactRegistryGenericArtifact] ImageLayer[GCPArtifactRegistryImageLayer] TrivyFinding[TrivyImageFinding] Package[Package] Project -->|RESOURCE| Repository Project -->|RESOURCE| RepositoryImage Project -->|RESOURCE| HelmChart Project -->|RESOURCE| LanguagePackage Project -->|RESOURCE| GenericArtifact Project -->|RESOURCE| ImageLayer Repository -->|CONTAINS| RepositoryImage Repository -->|REPO_IMAGE| RepositoryImage Repository -->|CONTAINS| HelmChart Repository -->|CONTAINS| LanguagePackage Repository -->|CONTAINS| GenericArtifact RepositoryImage -->|IMAGE| Image Image -->|CONTAINS_IMAGE| Image TrivyFinding -->|AFFECTS| Image Package -->|DEPLOYED| Image ``` #### GCPArtifactRegistryRepository Representation of a GCP [Artifact Registry Repository](https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories). > **Ontology Mapping**: This node has the extra label `ContainerRegistry` to enable cross-platform queries for container registries across different systems (e.g., AWSECRRepository, GCPArtifactRegistryRepository, GitLabContainerRepository). | Field | Description | |-------|-------------| | **id** | Full resource name of the repository (e.g., `projects/{project}/locations/{location}/repositories/{repo}`) | | name | The short name of the repository | | format | The format of packages stored in the repository (e.g., `DOCKER`, `MAVEN`, `NPM`, `PYTHON`, `GO`, `APT`, `YUM`) | | mode | The mode of the repository (e.g., `STANDARD_REPOSITORY`, `VIRTUAL_REPOSITORY`, `REMOTE_REPOSITORY`) | | description | User-provided description of the repository | | location | The GCP region where the repository is located | | registry_uri | The Docker registry URI for Docker format repositories (e.g., `us-east1-docker.pkg.dev/{project}/{repo}`) | | size_bytes | The size of the repository in bytes | | kms_key_name | The Cloud KMS key name used to encrypt the repository | | create_time | Timestamp when the repository was created | | update_time | Timestamp when the repository was last updated | | cleanup_policy_dry_run | Whether cleanup policies are in dry run mode | | vulnerability_scanning_enabled | Whether vulnerability scanning is enabled | | project_id | The GCP project ID | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPArtifactRegistryRepositories are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPArtifactRegistryRepository) ``` - GCPArtifactRegistryRepositories contain artifacts (RepositoryImage, HelmChart, LanguagePackage, GenericArtifact). ``` (GCPArtifactRegistryRepository)-[:CONTAINS]->(GCPArtifactRegistryRepositoryImage) (GCPArtifactRegistryRepository)-[:CONTAINS]->(GCPArtifactRegistryHelmChart) (GCPArtifactRegistryRepository)-[:CONTAINS]->(GCPArtifactRegistryLanguagePackage) (GCPArtifactRegistryRepository)-[:CONTAINS]->(GCPArtifactRegistryGenericArtifact) ``` - GCPArtifactRegistryRepositories point to repository images through the generic container-registry ontology shape. ``` (GCPArtifactRegistryRepository:ContainerRegistry)-[:REPO_IMAGE]->(GCPArtifactRegistryRepositoryImage:ImageTag) ``` - GCPPrincipals with appropriate permissions can pull artifacts from a repository. Created from [gcp_permission_relationships.yaml](https://github.com/cartography-cncf/cartography/blob/master/cartography/data/gcp_permission_relationships.yaml). Driven by `artifactregistry.repositories.downloadArtifacts`. ``` (GCPPrincipal)-[:CAN_READ]->(GCPArtifactRegistryRepository) ``` - GCPPrincipals with appropriate permissions can push artifacts to a repository. Driven by `artifactregistry.repositories.uploadArtifacts`. ``` (GCPPrincipal)-[:CAN_WRITE]->(GCPArtifactRegistryRepository) ``` #### GCPArtifactRegistryRepositoryImage Representation of a repository-scoped pullable Docker image reference in a GCP Artifact Registry repository. Tagged GAR DockerImage API records are expanded into one `GCPArtifactRegistryRepositoryImage` per tag, matching the `ImageTag` shape used by other registries. This node also stores GAR API metadata such as the DockerImage resource name, digest URI, repository/project location, timestamps, and the digest it references. > **Ontology Mapping**: This node has the extra label `ImageTag` to represent a scoped registry reference. | Field | Description | |-------|-------------| | **id** | Pullable image URI for this repository image reference | | name | The short name of the image | | **uri** | Pullable image URI for this repository image reference | | _ont_uri | The full URI to the repository image, populated from `uri` for generic `ImageTag` queries | | digest | The digest referenced by this scoped image record (e.g., `sha256:...`) | | tag | The tag for this pullable image reference, when tagged | | _ont_tag | The tag for this pullable image reference, populated from `tag` for generic `ImageTag` queries | | tags | All tags returned on the underlying GAR DockerImage API record | | resource_name | Full GAR DockerImage API resource name | | digest_uri | Digest-form URI returned by the GAR DockerImage API | | image_size_bytes | Size of the image in bytes | | media_type | The media type of the image manifest | | upload_time | Timestamp when the image was uploaded | | build_time | Timestamp when the image was built | | update_time | Timestamp when the image was last updated | | artifact_type | The artifact type, for OCI artifacts that expose it | | repository_id | Full resource name of the parent repository | | project_id | The GCP project ID | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPArtifactRegistryRepositoryImages are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPArtifactRegistryRepositoryImage) ``` - GCPArtifactRegistryRepositories contain GCPArtifactRegistryRepositoryImages. ``` (GCPArtifactRegistryRepository)-[:CONTAINS]->(GCPArtifactRegistryRepositoryImage) ``` - GCPArtifactRegistryRepositories also point to GCPArtifactRegistryRepositoryImages through the generic container-registry ontology relationship. ``` (GCPArtifactRegistryRepository:ContainerRegistry)-[:REPO_IMAGE]->(GCPArtifactRegistryRepositoryImage:ImageTag) ``` - GCPArtifactRegistryRepositoryImages point at the digest-scoped canonical image content node. ``` (GCPArtifactRegistryRepositoryImage)-[:IMAGE]->(GCPArtifactRegistryImage) ``` - Pullable Artifact Registry URIs are stored on the repository image node. Resolve them from canonical images by traversing back through `IMAGE`. ``` (GCPArtifactRegistryImage)<-[:IMAGE]-(GCPArtifactRegistryRepositoryImage) ``` #### GCPArtifactRegistryImage Representation of digest-scoped GCP Artifact Registry image content. Multiple `GCPArtifactRegistryRepositoryImage` nodes can point at the same `GCPArtifactRegistryImage` when the same digest appears through multiple tags, repositories, or projects. > **Ontology Mapping**: This node has conditional extra labels based on `type`: `Image` for single-platform image manifests, `ImageManifestList` for multi-architecture manifest lists / OCI indexes, and `ImageAttestation` for future attestation records. | Field | Description | |-------|-------------| | **id** | Image digest (e.g., `sha256:...`) | | **digest** | Image digest (e.g., `sha256:...`) | | _ont_digest | Image digest, populated from `digest` for generic `Image` / `ImageManifestList` queries | | type | Image type (`image`, `manifest_list`, or future `attestation`) | | media_type | The media type of the manifest | | architecture | CPU architecture for single-image manifests, extracted from the OCI image config (e.g., `amd64`, `arm64`) | | _ont_architecture | CPU architecture, populated from `architecture` for generic `Image` queries | | os | Operating system for single-image manifests, extracted from the OCI image config (e.g., `linux`, `windows`) | | _ont_os | Operating system, populated from `os` for generic `Image` queries | | os_version | OS version if specified | | os_features | OS features if specified | | variant | Platform variant for single-image manifests, extracted from the OCI image config (e.g., `v8`) | | _ont_variant | Platform variant, populated from `variant` for generic `Image` queries | | source_uri | Source repository URL extracted from OCI image config provenance (e.g., `https://github.com/org/repo`) | | source_revision | Git commit hash from build provenance | | source_file | Dockerfile path from build provenance | | parent_image_uri | Parent/base image URI extracted from digest-verified SPDX SBOM image relationships | | parent_image_digest | Parent/base image digest extracted from digest-verified SPDX SBOM image relationships | | layer_diff_ids | Ordered list of layer diff IDs from the OCI image config | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - Manifest-list/index GCPArtifactRegistryImages contain platform-specific child images. ``` (GCPArtifactRegistryImage:ImageManifestList)-[:CONTAINS_IMAGE]->(GCPArtifactRegistryImage:Image) ``` - GCPArtifactRegistryImages can point to a parent/base image when SPDX SBOM relationships identify another loaded GAR image digest. ``` (GCPArtifactRegistryImage)-[:BUILT_FROM]->(GCPArtifactRegistryImage) ``` - TrivyImageFindings affect GCPArtifactRegistryImages. ``` (TrivyImageFinding)-[:AFFECTS]->(GCPArtifactRegistryImage) ``` - Packages are deployed in GCPArtifactRegistryImages. ``` (Package)-[:DEPLOYED]->(GCPArtifactRegistryImage) ``` #### GCPArtifactRegistryImageLayer Representation of a container image filesystem layer extracted from the OCI image config. Layer nodes enable Dockerfile analysis matching for code-to-cloud tracing. > **Ontology Mapping**: This node has the extra label `ImageLayer` to enable cross-platform queries for image layers across different systems (e.g., AWSECRImageLayer, GCPArtifactRegistryImageLayer). | Field | Description | |-------|-------------| | **id** | The layer diff ID (content-addressable hash, e.g., `sha256:...`) | | diff_id | Same as id; the layer diff ID | | history | The Dockerfile command that created this layer (e.g., `RUN apt-get install ...`) | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPArtifactRegistryImageLayers are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPArtifactRegistryImageLayer) ``` #### GCPArtifactRegistryHelmChart Representation of a Helm chart stored as an OCI artifact in a GCP Artifact Registry repository. Helm charts are stored in Docker-format repositories and identified by their media type. | Field | Description | |-------|-------------| | **id** | Full resource name of the Helm chart | | name | The short name of the chart | | uri | The URI of the chart | | version | The version of the chart (extracted from tags) | | create_time | Timestamp when the chart was created | | update_time | Timestamp when the chart was last updated | | repository_id | Full resource name of the parent repository | | project_id | The GCP project ID | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPArtifactRegistryHelmCharts are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPArtifactRegistryHelmChart) ``` - GCPArtifactRegistryRepositories contain GCPArtifactRegistryHelmCharts. ``` (GCPArtifactRegistryRepository)-[:CONTAINS]->(GCPArtifactRegistryHelmChart) ``` #### GCPArtifactRegistryLanguagePackage Representation of a language package in a GCP Artifact Registry repository. This node type covers [Maven Artifacts](https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories.mavenArtifacts), [npm Packages](https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories.npmPackages), [Python Packages](https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories.pythonPackages), and [Go Modules](https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories.goModules). | Field | Description | |-------|-------------| | **id** | Full resource name of the package | | name | The short name of the package | | format | The format of the package (`MAVEN`, `NPM`, `PYTHON`, `GO`) | | uri | The URI of the package | | version | The version of the package | | package_name | Human-readable package name | | create_time | Timestamp when the package was created | | update_time | Timestamp when the package was last updated | | repository_id | Full resource name of the parent repository | | project_id | The GCP project ID | | group_id | (Maven only) The Maven group ID | | artifact_id | (Maven only) The Maven artifact ID | | tags | (npm only) Tags associated with the package | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPArtifactRegistryLanguagePackages are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPArtifactRegistryLanguagePackage) ``` - GCPArtifactRegistryRepositories contain GCPArtifactRegistryLanguagePackages. ``` (GCPArtifactRegistryRepository)-[:CONTAINS]->(GCPArtifactRegistryLanguagePackage) ``` #### GCPArtifactRegistryGenericArtifact Representation of a generic artifact in a GCP Artifact Registry repository. This node type covers [APT Artifacts](https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories.aptArtifacts) and [YUM Artifacts](https://cloud.google.com/artifact-registry/docs/reference/rest/v1/projects.locations.repositories.yumArtifacts). | Field | Description | |-------|-------------| | **id** | Full resource name of the artifact | | name | The short name of the artifact | | format | The format of the artifact (`APT`, `YUM`) | | package_name | The package name | | repository_id | Full resource name of the parent repository | | project_id | The GCP project ID | | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | #### Relationships - GCPArtifactRegistryGenericArtifacts are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPArtifactRegistryGenericArtifact) ``` - GCPArtifactRegistryRepositories contain GCPArtifactRegistryGenericArtifacts. ``` (GCPArtifactRegistryRepository)-[:CONTAINS]->(GCPArtifactRegistryGenericArtifact) ``` #### Trivy Integration Queries Find all vulnerabilities affecting GCP Artifact Registry container images: ```cypher MATCH (vuln:TrivyImageFinding)-[:AFFECTS]->(img:GCPArtifactRegistryImage)<-[:IMAGE]-(repo_img:GCPArtifactRegistryRepositoryImage) RETURN vuln.name, vuln.severity, repo_img.uri, img.digest ORDER BY vuln.severity DESC ``` Find packages deployed in GCP container images with their vulnerabilities: ```cypher MATCH (pkg:Package)-[:DEPLOYED]->(img:GCPArtifactRegistryImage)<-[:IMAGE]-(repo_img:GCPArtifactRegistryRepositoryImage) OPTIONAL MATCH (vuln:TrivyImageFinding)-[:AFFECTS]->(pkg) RETURN repo_img.uri, pkg.name, pkg.installed_version, collect(vuln.name) AS vulnerabilities ``` Find critical vulnerabilities in GCP images with available fixes: ```cypher MATCH (vuln:TrivyImageFinding {severity: 'CRITICAL'})-[:AFFECTS]->(img:GCPArtifactRegistryImage)<-[:IMAGE]-(repo_img:GCPArtifactRegistryRepositoryImage) MATCH (vuln)-[:AFFECTS]->(pkg:Package) OPTIONAL MATCH (pkg)-[:SHOULD_UPDATE_TO]->(fix:TrivyFix) RETURN vuln.name, repo_img.uri, pkg.name, pkg.installed_version, fix.version AS fixed_version ``` ### Cloud Run Resources #### Overview Google Cloud Run is a serverless compute platform for running containers. Cartography ingests the following Cloud Run resources: ```mermaid graph LR Project[GCPProject] Service[GCPCloudRunService] Revision[GCPCloudRunRevision] Job[GCPCloudRunJob] Execution[GCPCloudRunExecution] ServiceAccount[GCPServiceAccount] Project -->|RESOURCE| Service Project -->|RESOURCE| Revision Project -->|RESOURCE| Job Project -->|RESOURCE| Execution Service -->|HAS_REVISION| Revision Job -->|HAS_EXECUTION| Execution Service -->|RUNS_AS| ServiceAccount Revision -->|USES_SERVICE_ACCOUNT| ServiceAccount Job -->|RUNS_AS| ServiceAccount ``` ### GCPCloudRunService Representation of a GCP [Cloud Run Service](https://cloud.google.com/run/docs/reference/rest/v2/projects.locations.services). > **Ontology Mapping**: This node has the extra label `ComputeService` to enable cross-platform queries for compute orchestrators across different systems (e.g., `AWSECSService`, `GCPCloudRunJob`). Its child `GCPCloudRunServiceContainer` nodes carry `:Container` and `HAS_IMAGE`. | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | Full resource name of the service (e.g., `projects/{project}/locations/{location}/services/{service}`) | | name | Short name of the service | | location | The GCP location where the service is deployed | | description | User-provided description of the service | | uri | Default URL serving the service | | latest_ready_revision | Full resource name of the latest ready revision for this service | | service_account_email | The email of the service account configured on the service template (used by new revisions created from this service) | | ingress | The ingress setting for the service. Values: `INGRESS_TRAFFIC_ALL`, `INGRESS_TRAFFIC_INTERNAL_ONLY`, `INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER`, `INGRESS_TRAFFIC_NONE`. | | exposed_internet | Set to `true` if `ingress` is `INGRESS_TRAFFIC_ALL`. Set to `false` if `ingress` is `INGRESS_TRAFFIC_INTERNAL_ONLY` or `INGRESS_TRAFFIC_NONE`. Other values are currently left unset because they may still be internet-reachable via load balancers. | | exposed_internet_type | Set to `'direct'` when the service allows all ingress traffic. | Cloud Run Service is treated as an orchestrator (analogous to `AWSECSService`) and carries the `:ComputeService` semantic label. The container specs from the `latestReadyRevision` (returned inline in `service.template.containers`) are materialized as child `GCPCloudRunServiceContainer` nodes that carry `:Container` and `HAS_IMAGE`. Older revisions are tracked as pure metadata via `GCPCloudRunRevision`, with no image data attached. #### Relationships - GCPCloudRunServices are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudRunService) ``` - GCPCloudRunServices have GCPCloudRunRevisions. ``` (GCPCloudRunService)-[:HAS_REVISION]->(GCPCloudRunRevision) ``` - GCPCloudRunServices run as GCPServiceAccounts. ``` (GCPCloudRunService)-[:RUNS_AS]->(GCPServiceAccount) ``` ### GCPCloudRunRevision Representation of a GCP [Cloud Run Revision](https://cloud.google.com/run/docs/reference/rest/v2/projects.locations.services.revisions). A pure versioning marker for the parent Service — no image data is attached. Per-container image data lives on the Service's child `GCPCloudRunServiceContainer` nodes (sourced from `latestReadyRevision`). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | Full resource name of the revision (e.g., `projects/{project}/locations/{location}/services/{service}/revisions/{revision}`) | | name | Short name of the revision | | service | Full resource name of the parent service | | service_account_email | The email of the service account used by this revision | | log_uri | URI to Cloud Logging for this revision | | project_id | The GCP project ID this revision belongs to | #### Relationships - GCPCloudRunRevisions are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudRunRevision) ``` - GCPCloudRunServices have GCPCloudRunRevisions. ``` (GCPCloudRunService)-[:HAS_REVISION]->(GCPCloudRunRevision) ``` - GCPCloudRunRevisions use GCPServiceAccounts. ``` (GCPCloudRunRevision)-[:USES_SERVICE_ACCOUNT]->(GCPServiceAccount) ``` ### GCPCloudRunJob Representation of a GCP [Cloud Run Job](https://cloud.google.com/run/docs/reference/rest/v2/projects.locations.jobs). The Job is a pure grouping node: image references, digests, architecture and the `:Container` ontology label live on the child [GCPCloudRunJobContainer](#gcpcloudrunjobcontainer) nodes, analogous to `AWSECSTask` / `AWSECSContainer` in AWS. > **Ontology Mapping**: This node has the extra label `ComputeService` to enable cross-platform queries for compute orchestrators across different systems (e.g., `AWSECSService`, `GCPCloudRunService`). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | Full resource name of the job (e.g., `projects/{project}/locations/{location}/jobs/{job}`) | | name | Short name of the job | | location | The GCP location where the job is deployed | | service_account_email | The email of the service account used by this job | | project_id | The GCP project ID this job belongs to | #### Relationships - GCPCloudRunJobs are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudRunJob) ``` - GCPCloudRunJobs have GCPCloudRunExecutions. ``` (GCPCloudRunJob)-[:HAS_EXECUTION]->(GCPCloudRunExecution) ``` - GCPCloudRunJobs run as GCPServiceAccounts. ``` (GCPCloudRunJob)-[:RUNS_AS]->(GCPServiceAccount) ``` ### GCPCloudRunJobContainer Representation of an individual container spec from a [Cloud Run Job](https://cloud.google.com/run/docs/reference/rest/v2/projects.locations.jobs) (sourced from `job.template.template.containers`). One node is created per container spec (including sidecars). > **Ontology Mapping**: This node has the extra label `Container` to enable cross-platform queries across container runtimes (e.g., `AWSECSContainer`, `KubernetesContainer`, `AzureContainerInstance`, `GCPCloudRunServiceContainer`). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | **id** | `{job_id}/containers/{container_name_or_index}` | | name | Name of the container as declared in the task template. Falls back to the container index when the Cloud Run API omits the field (single-container jobs) | | job_id | Full resource name of the parent GCPCloudRunJob | | image | The container image reference as declared in the task template | | image_digest | The digest portion of the image reference (e.g., `sha256:abc...`) when the image is pinned by digest; `None` for tag-based references | | architecture | CPU architecture (always `amd64`; Cloud Run does not support ARM) | | architecture_normalized | Normalized architecture value (always `amd64`) | | architecture_source | How the architecture was determined (always `platform_requirement`) | | project_id | The GCP project ID this container belongs to | #### Relationships - GCPCloudRunJobContainers are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudRunJobContainer) ``` - GCPCloudRunJobContainers point at their parent GCPCloudRunJob via the unified workload chain. ``` (GCPCloudRunJobContainer)-[:WORKLOAD_PARENT]->(GCPCloudRunJob) ``` - GCPCloudRunJobContainers link to the image they run when the image is pinned by digest. ``` (GCPCloudRunJobContainer)-[:HAS_IMAGE]->(AWSECRImage) (GCPCloudRunJobContainer)-[:HAS_IMAGE]->(GitLabContainerImage) (GCPCloudRunJobContainer)-[:HAS_IMAGE]->(GCPArtifactRegistryImage) (GCPCloudRunJobContainer)-[:HAS_IMAGE]->(GitHubContainerImage) ``` - GCPCloudRunJobContainers are connected to the concrete single platform `Image` they actually ran via `RESOLVED_IMAGE`, produced by `RESOLVED_IMAGE_JOBS` in `cartography/analysis/ontology/analysis.py` when the target can be deterministically identified. See [Container](../../ontology/schema.md#container) for the full semantics. ``` (GCPCloudRunJobContainer)-[:RESOLVED_IMAGE]->(Image) ``` ### GCPCloudRunServiceContainer Representation of an individual container spec from a [Cloud Run Service](https://cloud.google.com/run/docs/reference/rest/v2/projects.locations.services) (sourced from `service.template.containers`, i.e. the `latestReadyRevision` exposed inline by the v2 API). One node is created per container spec (including sidecars). Older revisions' container specs are not modeled — only the latest ready spec is materialized. > **Ontology Mapping**: This node has the extra label `Container` to enable cross-platform queries across container runtimes (e.g., `AWSECSContainer`, `KubernetesContainer`, `AzureContainerInstance`, `GCPCloudRunJobContainer`). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | **id** | `{service_id}/containers/{container_name_or_index}` | | name | Name of the container as declared in the spec. Falls back to the container index when the Cloud Run API omits the field (single-container deployments) | | service_id | Full resource name of the parent GCPCloudRunService | | image | The container image reference as declared in the spec | | image_digest | The digest portion of the image reference (e.g., `sha256:abc...`) when the image is pinned by digest; `None` for tag-based references | | architecture | CPU architecture (always `amd64`; Cloud Run does not support ARM) | | architecture_normalized | Normalized architecture value (always `amd64`) | | architecture_source | How the architecture was determined (always `platform_requirement`) | | project_id | The GCP project ID this container belongs to | #### Relationships - GCPCloudRunServiceContainers are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudRunServiceContainer) ``` - GCPCloudRunServiceContainers point at their parent GCPCloudRunService via the unified workload chain. ``` (GCPCloudRunServiceContainer)-[:WORKLOAD_PARENT]->(GCPCloudRunService) ``` - GCPCloudRunServiceContainers link to the image they run when the image is pinned by digest. ``` (GCPCloudRunServiceContainer)-[:HAS_IMAGE]->(AWSECRImage) (GCPCloudRunServiceContainer)-[:HAS_IMAGE]->(GitLabContainerImage) (GCPCloudRunServiceContainer)-[:HAS_IMAGE]->(GCPArtifactRegistryImage) (GCPCloudRunServiceContainer)-[:HAS_IMAGE]->(GitHubContainerImage) ``` - GCPCloudRunServiceContainers are connected to the concrete single platform `Image` they actually ran via `RESOLVED_IMAGE`, produced by `RESOLVED_IMAGE_JOBS` in `cartography/analysis/ontology/analysis.py` when the target can be deterministically identified. See [Container](../../ontology/schema.md#container) for the full semantics. ``` (GCPCloudRunServiceContainer)-[:RESOLVED_IMAGE]->(Image) ``` ### GCPCloudRunExecution Representation of a GCP [Cloud Run Execution](https://cloud.google.com/run/docs/reference/rest/v2/projects.locations.jobs.executions). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated| Timestamp of the last time the node was updated | | **id** | Full resource name of the execution (e.g., `projects/{project}/locations/{location}/jobs/{job}/executions/{execution}`) | | name | Short name of the execution | | job | Full resource name of the parent job | | status | Completion status of the execution (e.g., `SUCCEEDED`, `FAILED`) | | cancelled_count | Number of tasks that were cancelled | | failed_count | Number of tasks that failed | | succeeded_count | Number of tasks that succeeded | #### Relationships - GCPCloudRunExecutions are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudRunExecution) ``` - GCPCloudRunJobs have GCPCloudRunExecutions. ``` (GCPCloudRunJob)-[:HAS_EXECUTION]->(GCPCloudRunExecution) ``` ### GCPBackendService Representation of a GCP [Backend Service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices). Backend services direct traffic to backend instance groups or other backends, and are a core component of the GCP load balancing stack. | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | **id** | The partial resource URI representing this backend service (e.g., `projects/{project}/global/backendServices/{name}`) | | partial_uri | Same as `id` | | name | The name of the backend service | | self_link | Server-defined URL for the resource | | project_id | The project ID that this backend service belongs to | | region | The region of this backend service, or `null` for global backend services | | description | An optional description of this backend service | | load_balancing_scheme | The load balancing scheme (e.g., `EXTERNAL`, `EXTERNAL_MANAGED`, `INTERNAL`, `INTERNAL_MANAGED`) | | protocol | The protocol this backend service uses (e.g., `HTTP`, `HTTPS`, `TCP`, `SSL`) | | port | The port for the backend service | | port_name | A named port on a backend instance group | | timeout_sec | Backend service timeout in seconds | | security_policy | The full URL of the Cloud Armor security policy attached to this backend service | | creation_timestamp | Creation timestamp of the resource | #### Relationships - GCPBackendServices are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBackendService) ``` - GCPBackendServices route traffic to GCPInstanceGroups. ``` (GCPBackendService)-[:ROUTES_TO]->(GCPInstanceGroup) ``` - GCPCloudArmorPolicies protect GCPBackendServices. ``` (GCPCloudArmorPolicy)-[:PROTECTS]->(GCPBackendService) ``` - GCPBackendServices expose GCPInstances. Created by the `gcp_lb_exposure` scoped analysis job. ``` (GCPBackendService)-[:EXPOSE]->(GCPInstance) ``` ### GCPInstanceGroup Representation of a GCP [Instance Group](https://cloud.google.com/compute/docs/reference/rest/v1/instanceGroups). Instance groups are collections of VM instances that can be managed together and serve as backends for load balancing. | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | **id** | The partial resource URI representing this instance group (e.g., `projects/{project}/zones/{zone}/instanceGroups/{name}`) | | partial_uri | Same as `id` | | **name** | The name of the instance group (indexed) | | self_link | Server-defined URL for the resource | | project_id | The project ID that this instance group belongs to | | zone | The zone of this instance group | | region | The region of this instance group (for regional instance groups) | | description | An optional description of this instance group | | network | The partial URI of the VPC network this instance group belongs to | | subnetwork | The partial URI of the subnet this instance group belongs to | | size | The number of instances in this instance group | | creation_timestamp | Creation timestamp of the resource | #### Relationships - GCPInstanceGroups are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPInstanceGroup) ``` - GCPInstanceGroups have member GCPInstances. ``` (GCPInstanceGroup)-[:HAS_MEMBER]->(GCPInstance) ``` - GCPBackendServices route traffic to GCPInstanceGroups. ``` (GCPBackendService)-[:ROUTES_TO]->(GCPInstanceGroup) ``` ### GCPCloudArmorPolicy Representation of a GCP [Cloud Armor Security Policy](https://cloud.google.com/compute/docs/reference/rest/v1/securityPolicies). Cloud Armor policies provide DDoS protection and WAF capabilities for backend services. > **Ontology Mapping**: This node has the extra label `NetworkAccessControl` to enable cross-platform queries for security groups and firewall rules across different systems (e.g., AWSEC2SecurityGroup, GCPFirewall, AzureNetworkSecurityGroup). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | **id** | The partial resource URI representing this policy (e.g., `projects/{project}/global/securityPolicies/{name}`) | | partial_uri | Same as `id` | | name | The name of the security policy | | self_link | Server-defined URL for the resource | | project_id | The project ID that this policy belongs to | | description | An optional description of this security policy | | policy_type | The type of the security policy (e.g., `CLOUD_ARMOR`) | | creation_timestamp | Creation timestamp of the resource | #### Relationships - GCPCloudArmorPolicies are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPCloudArmorPolicy) ``` - GCPCloudArmorPolicies protect GCPBackendServices. ``` (GCPCloudArmorPolicy)-[:PROTECTS]->(GCPBackendService) ``` ### GCPBigQueryDataset Represents a GCP BigQuery Dataset. > **Ontology Mapping**: This node has the extra label `Database` to enable cross-platform queries for database resources across different systems. | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | **id** | The dataset identifier in `project_id:dataset_id` format | | dataset_id | The short dataset ID | | friendly_name | User-friendly name for the dataset | | description | Description of the dataset | | location | Geographic location of the dataset (e.g., US, EU) | | creation_time | Creation time of the dataset | | last_modified_time | Last modification time of the dataset | | default_table_expiration_ms | Default expiration time for tables in milliseconds | | default_partition_expiration_ms | Default expiration time for partitions in milliseconds | | default_kms_key_name | Default customer-managed encryption key configured for new tables in the dataset, when present. | | access_entries | JSON string containing the dataset access entries returned by the BigQuery API. | #### Relationships - GCPBigQueryDatasets are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBigQueryDataset) ``` - GCPPrincipals with appropriate permissions can read data from a dataset. Created from [gcp_permission_relationships.yaml](https://github.com/cartography-cncf/cartography/blob/master/cartography/data/gcp_permission_relationships.yaml). ``` (GCPPrincipal)-[:CAN_READ]->(GCPBigQueryDataset) ``` - GCPPrincipals with appropriate permissions can write data to a dataset. ``` (GCPPrincipal)-[:CAN_WRITE]->(GCPBigQueryDataset) ``` - GCPPrincipals with appropriate permissions can delete a dataset or its tables. ``` (GCPPrincipal)-[:CAN_DELETE]->(GCPBigQueryDataset) ``` ### GCPBigQueryTable Represents a GCP BigQuery Table, View, or Materialized View. | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | **id** | The table identifier in `project_id:dataset_id.table_id` format | | table_id | The short table ID | | dataset_id | The parent dataset identifier in `project_id:dataset_id` format | | type | Table type: TABLE, VIEW, MATERIALIZED_VIEW, or EXTERNAL | | creation_time | Creation time of the table | | expiration_time | Expiration time of the table, if set | | num_bytes | Size of the table in bytes | | num_long_term_bytes | Size of long-term storage in bytes | | num_rows | Number of rows in the table | | description | Description of the table | | friendly_name | User-friendly name for the table | | connection_id | The BigQuery connection resource name used by external tables | | kms_key_name | Customer-managed encryption key configured on the table, when present. | #### Relationships - GCPBigQueryTables are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBigQueryTable) ``` - GCPBigQueryDatasets contain GCPBigQueryTables. ``` (GCPBigQueryDataset)-[:HAS_TABLE]->(GCPBigQueryTable) ``` - GCPBigQueryTables can use a GCPBigQueryConnection for external data. ``` (GCPBigQueryTable)-[:USES_CONNECTION]->(GCPBigQueryConnection) ``` - GCPPrincipals with appropriate permissions can read data from a table. Created from [gcp_permission_relationships.yaml](https://github.com/cartography-cncf/cartography/blob/master/cartography/data/gcp_permission_relationships.yaml). ``` (GCPPrincipal)-[:CAN_READ]->(GCPBigQueryTable) ``` - GCPPrincipals with appropriate permissions can write data to a table. ``` (GCPPrincipal)-[:CAN_WRITE]->(GCPBigQueryTable) ``` - GCPPrincipals with appropriate permissions can delete a table. ``` (GCPPrincipal)-[:CAN_DELETE]->(GCPBigQueryTable) ``` ### GCPBigQueryRoutine Represents a GCP BigQuery Routine (stored procedure, UDF, or table-valued function). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | **id** | The routine identifier in `project_id:dataset_id.routine_id` format | | routine_id | The short routine ID | | dataset_id | The parent dataset identifier in `project_id:dataset_id` format | | routine_type | Type: SCALAR_FUNCTION, PROCEDURE, or TABLE_VALUED_FUNCTION | | language | Language of the routine (e.g., SQL, JAVASCRIPT) | | creation_time | Creation time of the routine | | last_modified_time | Last modification time of the routine | | connection_id | The BigQuery connection resource name used by remote functions | #### Relationships - GCPBigQueryRoutines are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBigQueryRoutine) ``` - GCPBigQueryDatasets contain GCPBigQueryRoutines. ``` (GCPBigQueryDataset)-[:HAS_ROUTINE]->(GCPBigQueryRoutine) ``` - GCPBigQueryRoutines can use a GCPBigQueryConnection for remote functions. ``` (GCPBigQueryRoutine)-[:USES_CONNECTION]->(GCPBigQueryConnection) ``` ### GCPBigQueryConnection Represents a GCP BigQuery Connection (external data source connection). | Field | Description | |---|---| | firstseen | Timestamp of when a sync job first discovered this node | | lastupdated | Timestamp of the last time the node was updated | | **id** | The connection resource name | | name | The full resource name of the connection | | friendly_name | User-friendly name for the connection | | description | Description of the connection | | connection_type | Type of connection (e.g., cloudSql, spark, aws, azure) | | creation_time | Creation time of the connection | | last_modified_time | Last modification time of the connection | | has_credential | Whether the connection has a credential configured | | cloud_sql_instance_id | The Cloud SQL instance ID for cloudSql connections (format: `project:region:instance`) | | aws_role_arn | The IAM role ARN for aws connections | | azure_app_client_id | The federated application client ID for azure connections | | service_account_id | The service account email for cloudResource connections | #### Relationships - GCPBigQueryConnections are resources of GCPProjects. ``` (GCPProject)-[:RESOURCE]->(GCPBigQueryConnection) ``` - GCPBigQueryConnections of type cloudSql connect to GCPCloudSQLInstances. ``` (GCPBigQueryConnection)-[:CONNECTS_TO]->(GCPCloudSQLInstance) ``` - GCPBigQueryConnections of type aws connect with AWSRoles. ``` (GCPBigQueryConnection)-[:CONNECTS_WITH]->(AWSRole) ``` - GCPBigQueryConnections of type azure connect with EntraServicePrincipals. ``` (GCPBigQueryConnection)-[:CONNECTS_WITH]->(EntraServicePrincipal) ``` - GCPBigQueryConnections of type cloudResource connect with GCPServiceAccounts. ``` (GCPBigQueryConnection)-[:CONNECTS_WITH]->(GCPServiceAccount) ```