nexarch 0.12.19 → 0.12.23

package/dist/index.js

@@ -28,6 +28,7 @@ import { proposalsStart } from "./commands/proposals-start.js";
 import { registerRuntime } from "./commands/register-runtime.js";
 import { ingestInfra } from "./commands/ingest-infra.js";
 import { verifyTrust } from "./commands/verify-trust.js";
+import { cliBuild, formatBuild } from "./lib/version.js";
 const [, , command, ...args] = process.argv;
 const commands = {
     login,
@@ -75,6 +76,17 @@ async function main() {
             return;
         }
     }
+    // Answered before dispatch, and before any credential is required: "which
+    // copy am I running" has to work when nothing else does.
+    if (command === "--version" || command === "-v" || command === "version") {
+        const build = cliBuild();
+        if (args.includes("--json"))
+            process.stdout.write(`${JSON.stringify(build, null, 2)}
+`);
+        else
+            console.log(formatBuild(build));
+        return;
+    }
     const handler = commands[command ?? ""];
     if (!handler) {
         console.log(`
@@ -83,6 +95,7 @@ nexarch — Your architecture workspace for AI delivery.
 Usage:
   nexarch login         Authenticate in browser and store company-scoped credentials
                         Option: --company <id>
+  nexarch --version     Print the version and the path this copy runs from
   nexarch logout        Remove stored credentials
   nexarch status        Check connection and show architecture summary
   nexarch verify-trust  Verify this repo's Nexarch trust attestation. Reads the token

package/dist/lib/iac-catalogue-seed.js

@@ -12,9 +12,18 @@
  * ahead of it: editing it by hand recreates the two-sources-of-truth problem
  * moving the catalogue out of the CLI was meant to end.
  *
- * 30 entries, exported 2026-08-21.
+ * 86 entries, exported 2026-08-22.
  */
 export const IAC_CATALOGUE_SEED = [
+    {
+        resourceType: "aws_ecs_cluster",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_environment",
+        attributes: ["name"],
+        canonicalEntityRef: "global:platform_component:aws_ecs",
+        cloudResourceType: "AWS::ECS::Cluster",
+    },
     {
         resourceType: "azurerm_container_app_environment",
         entityTypeCode: "platform_component",
@@ -34,6 +43,71 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_app_service",
         cloudResourceType: "Microsoft.Web/serverfarms",
     },
+    {
+        resourceType: "aws_ecs_service",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        bindable: true,
+        attributes: ["name", "cluster", "task_definition", "desired_count", "launch_type"],
+        references: { "cluster": "aws_ecs_cluster" },
+        nameReferences: { "task_definition": "aws_ecs_task_definition" },
+        canonicalEntityRef: "global:platform_component:aws_ecs",
+        cloudResourceType: "AWS::ECS::Service",
+    },
+    {
+        resourceType: "aws_ecs_task_definition",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        attributes: ["family", "network_mode", "requires_compatibilities", "cpu", "memory"],
+        canonicalEntityRef: "global:platform_component:aws_ecs",
+        cloudResourceType: "AWS::ECS::TaskDefinition",
+        nameAttribute: "family",
+    },
+    {
+        resourceType: "aws_instance",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        bindable: true,
+        attributes: ["ami", "instance_type", "availability_zone", "subnet_id", "vpc_security_group_ids", "private_ip", "associate_public_ip_address", "iam_instance_profile"],
+        references: { "subnet_id": "aws_subnet" },
+        canonicalEntityRef: "global:platform_component:aws_ec2",
+        cloudResourceType: "AWS::EC2::Instance",
+    },
+    {
+        resourceType: "aws_lambda_function",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        bindable: true,
+        attributes: ["function_name", "runtime", "handler", "memory_size", "timeout", "role", "architectures", "package_type"],
+        references: { "role": "aws_iam_role" },
+        canonicalEntityRef: "global:platform_component:aws_lambda",
+        cloudResourceType: "AWS::Lambda::Function",
+        nameAttribute: "function_name",
+    },
+    {
+        resourceType: "azurerm_ai_foundry",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "compute_host",
+        attributes: ["name", "location", "resource_group_name", "storage_account_id", "key_vault_id", "public_network_access"],
+        references: { "key_vault_id": "azurerm_key_vault", "storage_account_id": "azurerm_storage_account" },
+        canonicalEntityRef: "global:platform_component:azure_ai_foundry",
+        cloudResourceType: "Microsoft.MachineLearningServices/workspaces",
+    },
+    {
+        resourceType: "azurerm_ai_foundry_project",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "compute_host",
+        attributes: ["name", "location", "ai_services_hub_id", "description"],
+        references: { "ai_services_hub_id": "azurerm_ai_foundry" },
+        canonicalEntityRef: "global:platform_component:azure_ai_foundry",
+        cloudResourceType: "Microsoft.MachineLearningServices/workspaces/projects",
+    },
     {
         resourceType: "azurerm_cognitive_account",
         entityTypeCode: "platform_component",
@@ -86,6 +160,45 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_static_web_apps",
         cloudResourceType: "Microsoft.Web/staticSites",
     },
+    {
+        resourceType: "aws_db_instance",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_relational",
+        role: "data_store",
+        attributes: ["identifier", "engine", "engine_version", "instance_class", "allocated_storage", "publicly_accessible", "multi_az", "db_subnet_group_name"],
+        canonicalEntityRef: "global:platform_component:aws_rds",
+        cloudResourceType: "AWS::RDS::DBInstance",
+        nameAttribute: "identifier",
+    },
+    {
+        resourceType: "aws_dynamodb_table",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_document",
+        role: "data_store",
+        attributes: ["name", "billing_mode", "hash_key", "range_key", "stream_enabled"],
+        canonicalEntityRef: "global:platform_component:aws_dynamodb",
+        cloudResourceType: "AWS::DynamoDB::Table",
+    },
+    {
+        resourceType: "aws_elasticache_cluster",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_cache",
+        role: "data_store",
+        attributes: ["cluster_id", "engine", "engine_version", "node_type", "num_cache_nodes"],
+        canonicalEntityRef: "global:platform_component:aws_elasticache",
+        cloudResourceType: "AWS::ElastiCache::CacheCluster",
+        nameAttribute: "cluster_id",
+    },
+    {
+        resourceType: "aws_s3_bucket",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_object",
+        role: "data_store",
+        attributes: ["bucket", "bucket_prefix", "force_destroy"],
+        canonicalEntityRef: "global:platform_component:aws_s3",
+        cloudResourceType: "AWS::S3::Bucket",
+        nameAttribute: "bucket",
+    },
     {
         resourceType: "azurerm_cosmosdb_account",
         entityTypeCode: "data_store",
@@ -131,6 +244,65 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_storage",
         cloudResourceType: "Microsoft.Storage/storageAccounts/blobServices/containers",
     },
+    {
+        resourceType: "aws_cloudfront_distribution",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["enabled", "comment", "default_root_object", "domain_name"],
+        canonicalEntityRef: "global:platform_component:aws_cloudfront",
+        cloudResourceType: "AWS::CloudFront::Distribution",
+        nameAttribute: "domain_name",
+    },
+    {
+        resourceType: "aws_lb",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "internal", "load_balancer_type", "security_groups", "subnets", "dns_name"],
+        canonicalEntityRef: "global:platform_component:aws_elastic_load_balancing",
+        cloudResourceType: "AWS::ElasticLoadBalancingV2::LoadBalancer",
+    },
+    {
+        resourceType: "aws_lb_listener",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["port", "protocol", "load_balancer_arn"],
+        references: { "load_balancer_arn": "aws_lb" },
+        canonicalEntityRef: "global:platform_component:aws_elastic_load_balancing",
+        cloudResourceType: "AWS::ElasticLoadBalancingV2::Listener",
+    },
+    {
+        resourceType: "aws_lb_target_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "port", "protocol", "target_type", "vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_elastic_load_balancing",
+        cloudResourceType: "AWS::ElasticLoadBalancingV2::TargetGroup",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_custom_domain",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "host_name", "cdn_frontdoor_profile_id", "dns_zone_id"],
+        references: { "dns_zone_id": "azurerm_dns_zone", "cdn_frontdoor_profile_id": "azurerm_cdn_frontdoor_profile" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/customDomains",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_custom_domain_association",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["cdn_frontdoor_custom_domain_id"],
+        references: { "cdn_frontdoor_custom_domain_id": "azurerm_cdn_frontdoor_custom_domain" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/customDomains/associations",
+    },
     {
         resourceType: "azurerm_cdn_frontdoor_endpoint",
         entityTypeCode: "platform_component",
@@ -149,6 +321,26 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_web_application_firewall",
         cloudResourceType: "Microsoft.Network/frontDoorWebApplicationFirewallPolicies",
     },
+    {
+        resourceType: "azurerm_cdn_frontdoor_origin",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "host_name", "enabled", "certificate_name_check_enabled", "cdn_frontdoor_origin_group_id"],
+        references: { "cdn_frontdoor_origin_group_id": "azurerm_cdn_frontdoor_origin_group" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/originGroups/origins",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_origin_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "session_affinity_enabled", "cdn_frontdoor_profile_id"],
+        references: { "cdn_frontdoor_profile_id": "azurerm_cdn_frontdoor_profile" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/originGroups",
+    },
     {
         resourceType: "azurerm_cdn_frontdoor_profile",
         entityTypeCode: "platform_component",
@@ -158,6 +350,25 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_front_door",
         cloudResourceType: "Microsoft.Cdn/profiles",
     },
+    {
+        resourceType: "azurerm_cdn_frontdoor_route",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "enabled", "patterns_to_match", "supported_protocols", "forwarding_protocol", "https_redirect_enabled", "cdn_frontdoor_endpoint_id", "cdn_frontdoor_origin_group_id"],
+        references: { "cdn_frontdoor_endpoint_id": "azurerm_cdn_frontdoor_endpoint", "cdn_frontdoor_origin_group_id": "azurerm_cdn_frontdoor_origin_group" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/afdEndpoints/routes",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_security_policy",
+        entityTypeCode: "policy_control",
+        role: "edge",
+        attributes: ["name", "cdn_frontdoor_profile_id"],
+        references: { "cdn_frontdoor_profile_id": "azurerm_cdn_frontdoor_profile" },
+        canonicalEntityRef: "global:platform_component:azure_web_application_firewall",
+        cloudResourceType: "Microsoft.Cdn/profiles/securityPolicies",
+    },
     {
         resourceType: "azurerm_static_web_app_custom_domain",
         entityTypeCode: "platform_component",
@@ -187,6 +398,100 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_traffic_manager",
         cloudResourceType: "Microsoft.Network/trafficManagerProfiles",
     },
+    {
+        resourceType: "aws_iam_policy",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "path", "description"],
+        canonicalEntityRef: "global:platform_component:aws_iam",
+        cloudResourceType: "AWS::IAM::ManagedPolicy",
+    },
+    {
+        resourceType: "aws_iam_role_policy_attachment",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["role", "policy_arn"],
+        canonicalEntityRef: "global:platform_component:aws_iam",
+        cloudResourceType: "AWS::IAM::RolePolicyAttachment",
+    },
+    {
+        resourceType: "azurerm_policy_definition_built_in",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "display_name", "policy_type", "mode"],
+        canonicalEntityRef: "global:platform_component:azure_policy",
+        cloudResourceType: "Microsoft.Authorization/policyDefinitions",
+    },
+    {
+        resourceType: "azurerm_policy_set_definition",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "display_name", "policy_type", "management_group_id"],
+        canonicalEntityRef: "global:platform_component:azure_policy",
+        cloudResourceType: "Microsoft.Authorization/policySetDefinitions",
+    },
+    {
+        resourceType: "azurerm_security_center_contact",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "alert_notifications", "alerts_to_admins"],
+        canonicalEntityRef: "global:platform_component:azure_defender_for_cloud",
+        cloudResourceType: "Microsoft.Security/securityContacts",
+    },
+    {
+        resourceType: "azurerm_security_center_subscription_pricing",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["tier", "resource_type"],
+        canonicalEntityRef: "global:platform_component:azure_defender_for_cloud",
+        cloudResourceType: "Microsoft.Security/pricings",
+    },
+    {
+        resourceType: "azurerm_security_center_workspace",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["scope", "workspace_id"],
+        references: { "workspace_id": "azurerm_log_analytics_workspace" },
+        canonicalEntityRef: "global:platform_component:azure_defender_for_cloud",
+        cloudResourceType: "Microsoft.Security/workspaceSettings",
+    },
+    {
+        resourceType: "azurerm_storage_container_immutability_policy",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["storage_container_resource_manager_id", "immutability_period_in_days", "protected_append_writes_all_enabled"],
+        references: { "storage_container_resource_manager_id": "azurerm_storage_container" },
+        canonicalEntityRef: "global:platform_component:azure_storage",
+        cloudResourceType: "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
+    },
+    {
+        resourceType: "azurerm_subscription_policy_assignment",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "display_name", "policy_definition_id", "subscription_id", "enforce"],
+        references: { "policy_definition_id": "azurerm_policy_set_definition" },
+        canonicalEntityRef: "global:platform_component:azure_policy",
+        cloudResourceType: "Microsoft.Authorization/policyAssignments",
+    },
+    {
+        resourceType: "aws_iam_role",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_control_plane",
+        role: "identity",
+        attributes: ["name", "path", "description", "max_session_duration"],
+        canonicalEntityRef: "global:platform_component:aws_iam",
+        cloudResourceType: "AWS::IAM::Role",
+    },
+    {
+        resourceType: "azurerm_federated_identity_credential",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_control_plane",
+        role: "identity",
+        attributes: ["name", "resource_group_name", "audience", "issuer", "subject", "parent_id"],
+        references: { "parent_id": "azurerm_user_assigned_identity" },
+        canonicalEntityRef: "global:platform_component:azure_managed_identity",
+        cloudResourceType: "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
+    },
     {
         resourceType: "azurerm_role_assignment",
         entityTypeCode: "policy_control",
@@ -204,6 +509,34 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_managed_identity",
         cloudResourceType: "Microsoft.ManagedIdentity/userAssignedIdentities",
     },
+    {
+        resourceType: "aws_sns_topic",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "messaging",
+        attributes: ["name", "display_name", "fifo_topic"],
+        canonicalEntityRef: "global:platform_component:aws_sns",
+        cloudResourceType: "AWS::SNS::Topic",
+    },
+    {
+        resourceType: "aws_sns_topic_subscription",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "messaging",
+        attributes: ["protocol", "topic_arn"],
+        references: { "topic_arn": "aws_sns_topic" },
+        canonicalEntityRef: "global:platform_component:aws_sns",
+        cloudResourceType: "AWS::SNS::Subscription",
+    },
+    {
+        resourceType: "aws_sqs_queue",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "messaging",
+        attributes: ["name", "fifo_queue", "visibility_timeout_seconds", "message_retention_seconds", "delay_seconds"],
+        canonicalEntityRef: "global:platform_component:aws_sqs",
+        cloudResourceType: "AWS::SQS::Queue",
+    },
     {
         resourceType: "azurerm_servicebus_namespace",
         entityTypeCode: "platform_component",
@@ -223,6 +556,133 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_service_bus",
         cloudResourceType: "Microsoft.ServiceBus/namespaces/queues",
     },
+    {
+        resourceType: "aws_db_subnet_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_rds",
+        cloudResourceType: "AWS::RDS::DBSubnetGroup",
+    },
+    {
+        resourceType: "aws_internet_gateway",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::InternetGateway",
+    },
+    {
+        resourceType: "aws_nat_gateway",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["subnet_id", "allocation_id", "connectivity_type"],
+        references: { "subnet_id": "aws_subnet" },
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::NatGateway",
+    },
+    {
+        resourceType: "aws_route53_record",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "type", "ttl", "zone_id"],
+        canonicalEntityRef: "global:platform_component:aws_route53",
+        cloudResourceType: "AWS::Route53::RecordSet",
+    },
+    {
+        resourceType: "aws_route53_zone",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "comment"],
+        canonicalEntityRef: "global:platform_component:aws_route53",
+        cloudResourceType: "AWS::Route53::HostedZone",
+    },
+    {
+        resourceType: "aws_route_table",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::RouteTable",
+    },
+    {
+        resourceType: "aws_security_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "description", "vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_security_group",
+        cloudResourceType: "AWS::EC2::SecurityGroup",
+    },
+    {
+        resourceType: "aws_subnet",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["cidr_block", "availability_zone", "vpc_id", "map_public_ip_on_launch"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::Subnet",
+        nameAttribute: "id",
+    },
+    {
+        resourceType: "aws_vpc",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["cidr_block", "enable_dns_support", "enable_dns_hostnames", "instance_tenancy"],
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::VPC",
+        nameAttribute: "id",
+    },
+    {
+        resourceType: "azurerm_dns_cname_record",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "zone_name", "ttl", "record"],
+        nameReferences: { "zone_name": "azurerm_dns_zone" },
+        canonicalEntityRef: "global:platform_component:azure_dns",
+        cloudResourceType: "Microsoft.Network/dnsZones/CNAME",
+    },
+    {
+        resourceType: "azurerm_dns_txt_record",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "zone_name", "ttl"],
+        nameReferences: { "zone_name": "azurerm_dns_zone" },
+        canonicalEntityRef: "global:platform_component:azure_dns",
+        cloudResourceType: "Microsoft.Network/dnsZones/TXT",
+    },
+    {
+        resourceType: "azurerm_dns_zone",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "number_of_record_sets", "name_servers"],
+        canonicalEntityRef: "global:platform_component:azure_dns",
+        cloudResourceType: "Microsoft.Network/dnsZones",
+    },
+    {
+        resourceType: "azurerm_network_security_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "location", "resource_group_name"],
+        canonicalEntityRef: "global:platform_component:azure_network_security_group",
+        cloudResourceType: "Microsoft.Network/networkSecurityGroups",
+    },
     {
         resourceType: "azurerm_private_dns_zone",
         entityTypeCode: "platform_component",
@@ -232,6 +692,17 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_private_dns",
         cloudResourceType: "Microsoft.Network/privateDnsZones",
     },
+    {
+        resourceType: "azurerm_private_dns_zone_virtual_network_link",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "private_dns_zone_name", "virtual_network_id", "registration_enabled"],
+        references: { "virtual_network_id": "azurerm_virtual_network" },
+        nameReferences: { "private_dns_zone_name": "azurerm_private_dns_zone" },
+        canonicalEntityRef: "global:platform_component:azure_private_dns",
+        cloudResourceType: "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+    },
     {
         resourceType: "azurerm_private_endpoint",
         entityTypeCode: "platform_component",
@@ -252,6 +723,16 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_virtual_network",
         cloudResourceType: "Microsoft.Network/virtualNetworks/subnets",
     },
+    {
+        resourceType: "azurerm_subnet_network_security_group_association",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["subnet_id", "network_security_group_id"],
+        references: { "subnet_id": "azurerm_subnet", "network_security_group_id": "azurerm_network_security_group" },
+        canonicalEntityRef: "global:platform_component:azure_network_security_group",
+        cloudResourceType: "Microsoft.Network/virtualNetworks/subnets/networkSecurityGroupAssociations",
+    },
     {
         resourceType: "azurerm_virtual_network",
         entityTypeCode: "platform_component",
@@ -261,6 +742,25 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_virtual_network",
         cloudResourceType: "Microsoft.Network/virtualNetworks",
     },
+    {
+        resourceType: "aws_cloudwatch_log_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "observability",
+        attributes: ["name", "retention_in_days"],
+        canonicalEntityRef: "global:platform_component:aws_cloudwatch",
+        cloudResourceType: "AWS::Logs::LogGroup",
+    },
+    {
+        resourceType: "aws_cloudwatch_metric_alarm",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "observability",
+        attributes: ["alarm_name", "comparison_operator", "evaluation_periods", "metric_name", "namespace", "period", "statistic", "threshold"],
+        canonicalEntityRef: "global:platform_component:aws_cloudwatch",
+        cloudResourceType: "AWS::CloudWatch::Alarm",
+        nameAttribute: "alarm_name",
+    },
     {
         resourceType: "azurerm_log_analytics_workspace",
         entityTypeCode: "platform_component",
@@ -270,6 +770,25 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_monitor",
         cloudResourceType: "Microsoft.OperationalInsights/workspaces",
     },
+    {
+        resourceType: "azurerm_monitor_diagnostic_setting",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "observability",
+        attributes: ["name", "target_resource_id", "log_analytics_workspace_id", "storage_account_id"],
+        references: { "storage_account_id": "azurerm_storage_account", "log_analytics_workspace_id": "azurerm_log_analytics_workspace" },
+        canonicalEntityRef: "global:platform_component:azure_monitor",
+        cloudResourceType: "Microsoft.Insights/diagnosticSettings",
+    },
+    {
+        resourceType: "aws_ecr_repository",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "registry",
+        attributes: ["name", "image_tag_mutability", "force_delete"],
+        canonicalEntityRef: "global:platform_component:aws_ecr",
+        cloudResourceType: "AWS::ECR::Repository",
+    },
     {
         resourceType: "azurerm_container_registry",
         entityTypeCode: "platform_component",
@@ -288,6 +807,26 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_resource_group",
         cloudResourceType: "Microsoft.Resources/resourceGroups",
     },
+    {
+        resourceType: "aws_kms_key",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "secret_store",
+        attributes: ["description", "key_usage", "deletion_window_in_days", "enable_key_rotation"],
+        canonicalEntityRef: "global:platform_component:aws_kms",
+        cloudResourceType: "AWS::KMS::Key",
+        nameAttribute: "id",
+    },
+    {
+        resourceType: "aws_secretsmanager_secret",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "secret_store",
+        attributes: ["name", "description", "kms_key_id"],
+        references: { "kms_key_id": "aws_kms_key" },
+        canonicalEntityRef: "global:platform_component:aws_secrets_manager",
+        cloudResourceType: "AWS::SecretsManager::Secret",
+    },
     {
         resourceType: "azurerm_key_vault",
         entityTypeCode: "platform_component",