Turn discovered AWS and Azure resources into navigable cloud architectures. The Cloud Hierarchy process job connects resources by using cloud identifiers so that you can trace infrastructure dependencies in Configuration Management Database (CMDB).
Required Editions
| Available in: Lightning Experience |
| Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled. |
How Cloud Resources Are Mapped
The Cloud Hierarchy process job connects AWS and Azure resources that are already in CMDB. In a single run, the job uses identifiers such as VPC, subnet, security group, subscription, and resource group to create relationships among the corresponding cloud resources.
When to Run the Job
Run the job after AWS or Azure discovery and after you add accounts or subscriptions. Rerun it regularly if your cloud environment changes frequently. To start the job, see Run a Process Job.
AWS Relationships
| Source and Target | Relationship | What It Means | How It’s Matched |
|---|---|---|---|
| Security Group to EC2 Instance | Secured By | A security group protects an instance. | The instance security group ID matches the security group. |
| VPC to EC2 Instance | Belongs To | An instance belongs to a VPC. | The instance VPC ID matches the VPC. |
| EC2 Instance to EBS Volume | Attached To | A storage volume is attached to an instance. | The instance volume ID matches the EBS volume. |
| EC2 Instance to AMI | Instantiates | An instance was launched from an image. | The instance image ID matches the AMI. |
| Host to EC2 Instance | Instantiates | A discovered host is the operating system running on an instance. | The instance public IP address, private IP address, or host name matches a discovered host. |
| EC2 Instance to Network Adapter | Attached To | A network interface is attached to an instance. | The network adapter is a component of the instance. |
| Network Adapter to Subnet | Contains | A network adapter is placed in a subnet. | The instance subnet ID matches the subnet. |
| Subnet to EC2 Instance | Parts Of | An instance is grouped under its subnet. | The subnet and instance have the same subnet ID. |
| Route Table to Subnet | Contains | A route table controls traffic for a subnet. | The subnet route table ID matches the route table. |
| Network ACL to Subnet | Secured By | A network access control list applies to a subnet. | The subnet access control list ID matches the network access control list. |
| Internet Gateway to Route | Used By | A route sends traffic through an internet gateway. | The route gateway ID matches the internet gateway. |
| VPC to Internet Gateway | Belongs To | An internet gateway is attached to a VPC. | The gateway VPC ID matches the VPC. |
| Subnet to Internet Gateway | Serves | A subnet is reachable through an internet gateway. | The subnet belongs to the VPC associated with the internet gateway. |
| Subnet to NAT Gateway | Serves | A NAT gateway serves a subnet. | The NAT gateway subnet ID matches the subnet. |
| NAT Gateway to VPC | Contains | A NAT gateway is placed in a VPC. | The NAT gateway VPC ID matches the VPC. |
| VPC to Subnet | Contains | A VPC contains a subnet. | The subnet is a component of the VPC. |
| Load Balancer to Target Group | Contains | A target group is associated with a load balancer. | The load balancer ARN matches the target group. |
| Security Group to Load Balancer | Secured By | A security group protects a load balancer. | The load balancer security group ID matches the security group. |
| Load Balancer to VPC | Contains | A load balancer is placed in a VPC. | The load balancer VPC ID matches the VPC. |
| Target Group to EC2 Instance | Contains | An instance is registered as a target. | The target EC2 instance ID matches the instance. |
| Auto Scaling Group to Target Group | Served By | An Auto Scaling group provides capacity for a target group. | The target group ARN matches the Auto Scaling group. |
| AWS Database Cluster, RDS, DocumentDB, or Neptune to Security Group | Secured By | A security group protects a managed database. | The database security group ID matches the security group. |
Azure Relationships
| Source and Target | Relationship | What It Means | How It’s Matched |
|---|---|---|---|
| Host to Azure Virtual Machine | Instantiates | A discovered host is the guest operating system on an Azure virtual machine. | The virtual machine IP address matches a discovered host. |
| Network Security Group to Azure Virtual Machine | Secures | A network security group protects a virtual machine. | The network security group name on the virtual machine network interface matches a group in the same subscription and resource group. |
| Azure Virtual Machine to Subnet | Belongs To | A virtual machine belongs to a subnet. | The subnet name on the virtual machine network interface matches the subnet. |
| Azure Virtual Machine Scale Set to Subnet | Belongs To | A scale set belongs to a subnet. | The scale set and subnet are in the same subscription and resource group. |
| Azure Virtual Machine Scale Set to Network Security Group | Secured By | A network security group applies to a scale set. | The network security group name on the scale set network interface matches the group. |
| Azure Virtual Machine Scale Set to Scale Set Instance | Contains | A scale set contains an instance. | The instance is a component of the scale set. |
| Host to Scale Set Instance | Instantiates | A discovered host is the guest operating system on a scale set instance. | The instance IP address matches a discovered host. |
| Network Security Group to Scale Set Instance | Secures | A network security group protects a scale set instance. | The network security group name on the instance network interface matches the group. |
| Network Security Group to Subnet | Secures | A network security group applies to a subnet. | The network security group name matches the subnet in the same subscription and resource group. |
| Azure Application Gateway to Subnet | Belongs To | An application gateway belongs to a subnet. | The gateway and subnet are in the same subscription and resource group. |
| Azure Application Gateway to Virtual Machine, Scale Set, App Service, or IP Target | Contains | An application gateway routes to a backend target. | The job reads the gateway backend pools and matches each target by identifier or IP address. |
| Azure SQL Server to Database | Contains | A logical SQL server contains a database. | The database is a component of the SQL server. |
| Azure SQL Managed Instance to Virtual Network | Belongs To | A managed instance belongs to a virtual network. | The managed instance virtual network name matches the virtual network. |
| Azure Virtual Network to Subnet | Contains | A virtual network contains a subnet. | The subnet is a component of the virtual network. |
| Azure Resource Group to Supported Azure Resource | Contains | A resource group contains virtual machines, scale sets, network security groups, application gateways, App Services, SQL servers, virtual networks, and SQL managed instances. | The resource group name and subscription ID match those of the resource. |