System data mapping

This page describes how data retrieved from the source service is mapped into records generated by the connector.

For each record type, the following information is reported:

• the property name exposed by the connector;
• the path from which the value is obtained in the source service;
• any additional note regarding transformations, enrichments or special behaviours.

Each record mapping section is titled {Source Object Name} ({_type}), combining the object name used by the source service with the internal record type produced by the connector. Sections are grouped by AWS service; source paths refer to the objects of the AWS SDK for Java v2.

Common properties

Property name	Source path	Notes
role		ARN of the role used to read the record. Empty when no roles are configured.
region		Region from which the record was read. Empty for the IAM records; for S3 buckets it is the region of the bucket.
service		Name of the service that produced the record, as listed in the Services instance configuration (e.g. EC2).
tags	tags	Tags of the resource as a JSON map {key: value}. Depending on the resource, they are read from the object itself or with a dedicated call.

Notes

• Date-time values are formatted as ISO date-time strings.
• Properties whose notes report Record Id contain the identifier of the related record produced by the connector, not the AWS identifier.
• tags is not present in: docdbengineversion, instancetype, internetgatewayvpcrelation, networkaclsubnetrelation, cacheengineversion, cachenode, gluedatabase, group, instanceinformation.

ApiGateway

RestApi (restapi)

REST API published through Amazon API Gateway.

Property name	Source path	Notes
id	id
name	name
creation_time	createdDate
version	version

AutoScaling

AutoScalingGroup (autoscalinggroup)

Group of EC2 instances managed by EC2 Auto Scaling.

Property name	Source path	Notes
arn	autoScalingGroupARN
name	autoScalingGroupName
instances	instances[].instanceId	Instance IDs of the group, separated by space.
creation_time	createdTime
desired_capacity	desiredCapacity
desired_capacity_type	desiredCapacityType
min_size	minSize
max_size	maxSize
state	status

DocumentDB

DBCluster (docdbcluster)

Amazon DocumentDB cluster.

Property name	Source path	Notes
arn	dbClusterArn
id	dbClusterIdentifier
parameter_group	dbClusterParameterGroup
resource_id	dbClusterResourceId
subnet_group	dbSubnetGroup
port	port
storage_type	storageType
state	status
endpoint	endpoint
creation_time	clusterCreateTime
engine	engine
engine_version_name	engineVersion
engine_version	engine + engineVersion	Record Id of the related docdbengineversion.

Tags are read with ListTagsForResource.

DBEngineVersion (docdbengineversion)

Engine version available for Amazon DocumentDB.

Property name	Source path	Notes
description	dbEngineDescription
engine	engine
engine_version	engineVersion

DBInstance (docdbinstance)

Instance belonging to an Amazon DocumentDB cluster.

Property name	Source path	Notes
arn	dbInstanceArn
id	dbInstanceIdentifier
class	dbInstanceClass
endpoint	endpoint.address
state	dbInstanceStatus
engine	engine
engine_version_name	engineVersion
cluster_writer_permission		isClusterWriter of the member of the related cluster (dbClusterMembers) with the same identifier.
cluster	dbClusterIdentifier	Record Id of the related docdbcluster.
engine_version	engine + engineVersion	Record Id of the related docdbengineversion.

Tags are read with ListTagsForResource.

DynamoDB

TableDescription (table)

Amazon DynamoDB table.

Property name	Source path	Notes
arn	tableArn
id	tableId
name	tableName
size	tableSizeBytes	Converted to GB. Small values can be returned in exponential notation.
address	DescribeEndpoints endpoints[0].address	Endpoint of the region, the same for all tables. Empty if no endpoint is returned.
state	tableStatus

Tags are read with ListTagsOfResource.

EC2

Instance (instance)

Amazon EC2 instance. The properties name and those taken from the related instancetype are added by the preprocessing of the bus descriptor, which looks up the instancetype record whose Record Id is stored in type.

Property name	Source path	Notes
id	instanceId
name	tags.Name	Value of the Name tag.
type_name	instanceType
image_id	imageId
state	state.name
monitoring	monitoring.state
public_address	publicIpAddress
private_address	privateIpAddress
public_dns	publicDnsName
private_dns	privateDnsName
architecture	architecture
platform	platform
platform_details	platformDetails
launch_time	launchTime
owner	ownerId	Owner of the reservation that contains the instance.
memory_gb	instancetype.memory_mib	Taken from the related instancetype and converted to GB.
current_generation	instancetype.current_generation	Taken from the related instancetype.
processor_vendor	instancetype.processor_vendor	Taken from the related instancetype.
processor_speed_ghz	instancetype.processor_speed_ghz	Taken from the related instancetype.
cores	instancetype.cores	Taken from the related instancetype.
thread_per_core	instancetype.thread_per_core	Taken from the related instancetype.
vcpu	instancetype.vcpu	Taken from the related instancetype.
bare_metal	instancetype.bare_metal	Taken from the related instancetype.
type	instanceType	Record Id of the related instancetype.
network	subnetId	Record Id of the related subnet.
autoscaling_group		Record Id of the autoscalinggroup whose instances contain this instance.

Host (host)

Amazon EC2 Dedicated Host.

Property name	Source path	Notes
id	hostId
type	hostProperties.instanceType
cores	hostProperties.cores
vcpus	hostProperties.totalVCpus
state	state
availability_zone	availabilityZone
availability_zone_id	availabilityZoneId

Volume (volume)

Amazon EBS volume.

Property name	Source path	Notes
id	volumeId
type	volumeType
size	size	Size in GiB, as returned by AWS.
state	state
instance	attachments[0].instanceId	Record Id of the instance the volume is attached to. Only the first attachment is considered.

NetworkInterface (networkinterface)

Elastic network interface.

Property name	Source path	Notes
id	networkInterfaceId
type	interfaceType
description	description
mac_address	macAddress
private_ip_address	privateIpAddress
public_ip_address	association.publicIp	Empty if no public IP is associated.
private_dns	privateDnsName
public_dns	publicDnsName
availability_zone	availabilityZone
state	status
instance	attachment.instanceId	Record Id of the related instance.
vpc	vpcId	Record Id of the related vpc.
network	subnetId	Record Id of the related subnet.

Tags are read from tagSet.

Subnet (subnet)

Subnet of a VPC.

Property name	Source path	Notes
arn	subnetArn
id	subnetId
owner	ownerId
availability_zone	availabilityZone
available_ips	availableIpAddressCount
cidr_block	cidrBlock
is_default	defaultForAz
state	state
vpc	vpcId	Record Id of the related vpc.
network_acl		Record Id of the networkacl associated with the subnet (from NetworkAcl.associations).

Vpc (vpc)

Virtual Private Cloud.

Property name	Source path	Notes
id	vpcId
ipv4_cidr_block	cidrBlock
ipv6_cidr_block	ipv6CidrBlockAssociationSet[0].ipv6CidrBlock	Only the first IPv6 block is considered.
instance_tenacity	instanceTenancy
default	isDefault
state	state
owner	ownerId
dhcp_options	dhcpOptionsId	Record Id of the related dhcp.

DhcpOptions (dhcp)

Set of DHCP options of a VPC.

Property name	Source path	Notes
id	dhcpOptionsId
options	dhcpConfigurations	Map of the options: each key contains its values separated by , .
owner	ownerId

InternetGateway (internetgateway)

Internet gateway.

Property name	Source path	Notes
id	internetGatewayId
owner	ownerId

InternetGatewayAttachment (internetgatewayvpcrelation)

Calculated record that represents the attachment of an internet gateway to a VPC. A record is created for each element of InternetGateway.attachments.

Property name	Source path	Notes
state	attachments[].state
internetgateway	internetGatewayId	Record Id of the related internetgateway.
vpc	attachments[].vpcId	Record Id of the related vpc.

NetworkAcl (networkacl)

Network access control list.

Property name	Source path	Notes
id	networkAclId
firewall_rules	entries	JSON list of the rules; each rule has rule_number, type (icmpTypeCode), protocol, port_range, cidr_block, rule_action.
default	isDefault
owner	ownerId
vpc	vpcId	Record Id of the related vpc.

NetworkAclAssociation (networkaclsubnetrelation)

Calculated record that represents the association between a network ACL and a subnet. A record is created for each element of NetworkAcl.associations.

Property name	Source path	Notes
association_id	associations[].networkAclAssociationId
network_acl	associations[].networkAclId	Record Id of the related networkacl.
subnet	associations[].subnetId	Record Id of the related subnet.

InstanceTypeInfo (instancetype)

Technical characteristics of an EC2 instance type.

Property name	Source path	Notes
name	instanceType
bare_metal	bareMetal
current_generation	currentGeneration
memory_mib	memoryInfo.sizeInMiB
processor_vendor	processorInfo.manufacturer
processor_speed_ghz	processorInfo.sustainedClockSpeedInGhz
cores	vCpuInfo.defaultCores
thread_per_core	vCpuInfo.defaultThreadsPerCore
vcpu	vCpuInfo.defaultVCpus

EFS

FileSystemDescription (filesystem)

Amazon EFS file system.

Property name	Source path	Notes
arn	fileSystemArn
id	fileSystemId
name	name
owner	ownerId
size	sizeInBytes.value	Converted to GB. Small values can be returned in exponential notation.
state	lifeCycleState

EKS

Cluster (ekscluster)

Amazon EKS cluster.

Property name	Source path	Notes
arn	arn
id	id
name	name
state	status
endpoint	endpoint
version	version

ElastiCache

CacheCluster (cachecluster)

Amazon ElastiCache cluster.

Property name	Source path	Notes
arn	arn
id	cacheClusterId
replication_group_id	replicationGroupId
creation_time	cacheClusterCreateTime
subnet_group	cacheSubnetGroupName
network_type	networkType
cache_nodes	numCacheNodes
snapshot_window	snapshotWindow
state	cacheClusterStatus
engine	engine
engine_version_name	engineVersion
engine_version	engine + engineVersion	Record Id of the related cacheengineversion.

Tags are read with ListTagsForResource.

CacheEngineVersion (cacheengineversion)

Engine version available for Amazon ElastiCache.

Property name	Source path	Notes
description	cacheEngineDescription
engine	engine
engine_version	engineVersion

CacheNode (cachenode)

Node of an ElastiCache cluster, read from CacheCluster.cacheNodes.

Property name	Source path	Notes
id	cacheNodeId
cluster_replication_group_id	CacheCluster.replicationGroupId	Taken from the cluster the node belongs to.
creation_time	cacheNodeCreateTime
endpoint	endpoint.address
status	cacheNodeStatus
cluster	CacheCluster.cacheClusterId	Record Id of the related cachecluster.

ElasticLoadBalancing

LoadBalancer (loadbalancer)

Elastic Load Balancing (v2) load balancer.

Property name	Source path	Notes
arn	loadBalancerArn
name	loadBalancerName
dns_name	dnsName
type	type
scheme	scheme
ip_address_type	ipAddressType
ips	availabilityZones	JSON map with the zone name as key and the lists ipv4, ipv6, private_ipv4 of the zone addresses as value.
listener_ports	DescribeListeners listeners[].port	Ports of the listeners, sorted and separated by space.
state	state.code
vpc	vpcId	Record Id of the related vpc.

Tags are read with DescribeTags.

ElasticSearch

ElasticsearchDomainStatus (domain)

Amazon OpenSearch Service (Elasticsearch) domain.

Property name	Source path	Notes
arn	arn
id	domainId
name	domainName
created	created
deleted	deleted
endpoint	endpoint
version	elasticsearchVersion

Tags are read with ListTags.

Glue

Database (gluedatabase)

AWS Glue Data Catalog database.

Property name	Source path	Notes
name	name
creation_time	createTime
description	description

HSM

Cluster (cluster)

AWS CloudHSM cluster.

Property name	Source path	Notes
id	clusterId
state	state
vpc	vpcId	Record Id of the related vpc.

Tags are read from tagList.

Hsm (hsm)

Hardware security module of a CloudHSM cluster.

Property name	Source path	Notes
id	hsmId
state	state
cluster	clusterId	Record Id of the related cluster.

The tags property contains the tags of the cluster the HSM belongs to.

IAM

IAM records are global: they are read once for each role (or once for the account when no roles are configured) and have no region.

User (user)

IAM user.

Property name	Source path	Notes
arn	arn
id	userId
name	userName
creation_time	createDate
password_last_used	passwordLastUsed
path	path

Role (role)

IAM role.

Property name	Source path	Notes
arn	arn
id	roleId
name	roleName
creation_time	createDate
last_used_date	roleLastUsed.lastUsedDate
last_used_region	roleLastUsed.region
path	path

Group (group)

IAM group.

Property name	Source path	Notes
arn	arn
id	groupId
name	groupName
creation_time	createDate
path	path

KinesisFirehose

DeliveryStreamDescription (deliverystream)

Amazon Data Firehose delivery stream.

Property name	Source path	Notes
arn	deliveryStreamARN
name	deliveryStreamName
type	deliveryStreamType
creation_time	createTimestamp
state	deliveryStreamStatus
source	source.kinesisStreamSourceDescription.kinesisStreamARN	Empty if the source is not a Kinesis data stream.
destinations	destinations[].destinationId	Destination IDs, sorted and separated by space.

Tags are read with ListTagsForDeliveryStream.

Lambda

FunctionConfiguration (function)

AWS Lambda function.

Property name	Source path	Notes
arn	functionArn
name	functionName
last_modified	lastModified	Milliseconds are removed.
state	state
memory_size	memorySize
runtime	runtime
package_type	packageType
version	version

Tags are read with ListTags.

MQ

DescribeBrokerResponse (broker)

Amazon MQ broker.

Property name	Source path	Notes
arn	brokerArn
id	brokerId
name	brokerName
host_instance_type	hostInstanceType
creation_time	created
deployment_mode	deploymentMode
storage_type	storageType
state	brokerState
engine	engineType
engine_version	engineVersion

RDS

DBCluster (rdsdbcluster)

Amazon RDS / Aurora database cluster.

Property name	Source path	Notes
arn	dbClusterArn
id	dbClusterIdentifier
database_name	databaseName
allocated_storage	allocatedStorage
capacity	capacity
creation_time	clusterCreateTime
network_type	networkType
port	port
storage_type	storageType
state	status
endpoint	endpoint
engine	engine
engine_version_name	engineVersion
engine_version	engine + engineVersion	Record Id of the related rdsdbengineversion.

DBEngineVersion (rdsdbengineversion)

Engine version available for Amazon RDS.

Property name	Source path	Notes
arn	dbEngineVersionArn
description	dbEngineVersionDescription
db_engine_description	dbEngineDescription
state	status
engine	engine
engine_version	engineVersion

DBInstance (rdsdbinstance)

Amazon RDS database instance.

Property name	Source path	Notes
arn	dbInstanceArn
id	dbInstanceIdentifier
name	dbName
state	dbInstanceStatus
class	dbInstanceClass
license_model	licenseModel
endpoint	endpoint.address
port	endpoint.port
engine	engine
engine_version_name	engineVersion
cluster_writer_permission		isClusterWriter of the member of the related cluster (dbClusterMembers) with the same identifier.
cluster	dbClusterIdentifier	Record Id of the related rdsdbcluster.
engine_version	engine + engineVersion	Record Id of the related rdsdbengineversion.

S3

S3 buckets are read once for each role (or once for the account when no roles are configured), not once per region.

Bucket (bucket)

Amazon S3 bucket.

Property name	Source path	Notes
name	name
region	HeadBucket bucketRegion	Region of the bucket.
public	GetBucketPolicyStatus policyStatus.isPublic	Empty if the policy status cannot be read.
size	ListObjects contents[].size	Sum of the size of the objects, converted to GB with three decimal digits.

Tags are read with GetBucketTagging; empty if they cannot be read.

SNS

Topic (topic)

Amazon SNS topic.

Property name	Source path	Notes
arn	topicArn
display_name	GetTopicAttributes attributes.DisplayName
owner	GetTopicAttributes attributes.Owner

Tags are read with ListTagsForResource.

SQS

Queue (queue)

Amazon SQS queue. AWS does not expose a specific object for queues: they are listed by URL.

Property name	Source path	Notes
arn	GetQueueAttributes QueueArn

Tags are read with ListQueueTags.

SSM

InstanceInformation (instanceinformation)

Node managed by AWS Systems Manager.

Property name	Source path	Notes
name	name
last_ping_date	lastPingDateTime
ping_status	pingStatus
computer_name	computerName
agent_version	agentVersion
ip_address	ipAddress
platform_name	platformName
platform_type	platformType
platform_version	platformVersion
registration_date	registrationDate
resource_type	resourceType
instance	instanceId	Record Id of the related instance.

StepFunctions

DescribeStateMachineResponse (statemachine)

AWS Step Functions state machine.

Property name	Source path	Notes
arn	stateMachineArn
name	name
type	type
creation_time	creationDate
description	description
state	status

Tags are read with ListTagsForResource.