elastic / cloudbeat / 28807952425

76%

Build Type

push

github

Committed by web-flow

Commit Message

[Cloud Asset Inventory] Add extra resource fields #1 (#6991)

## Summary

Follow-up to InfoSec's review of #6991. Adds the remaining EC2 and ELB
fields InfoSec needs to retire their custom AWS CLI scripts for the
FedRAMP
asset inventory. All new fields land in `entity.attributes.*` (non-ECS,
UpperCamelCase) — no ECS mapping change required.

Tracking: https://github.com/elastic/security-team/issues/17750

## Changes

**EC2** (`entity.attributes`):
- `ImageId`, `Platform`, `VpcId`, `SubnetId`, `State`, `RoleArn`
- `Owner`, `CostCenter` — resolved case-insensitively from instance tags

**ELB v1 + v2** (`entity.attributes`):
- `LoadBalancerType` — v2 reports the real type; v1 reports `classic`
- `AccountID`
- `State` — v2 only (`State.Code`); classic ELB exposes no state field
- `IPAddresses` — NLB static IPs; ALB/classic are DNS-only (empty)
- `OwnerTag` — required adding `DescribeTags` to both ELB `Client`
  interfaces and providers (batched to the 20-item AWS limit)

## Notes
- No `elastic/integrations` change: `entity.attributes` is `flattened`,
so
  new keys need no mapping and there's no migration.
- No new asset classifications, so `ASSETS.md` is unchanged. Route53 and
  EKS (also requested in the review) are separate follow-up PRs.
- Mocks regenerated; unit tests cover EC2 attributes and the ELB
  Type/State/IPAddresses/OwnerTag flow end-to-end.

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Coverage Stats

250 of 299 new or added lines in 20 files covered. (83.61%)

2 existing lines in 1 file now uncovered.

9966 of 13123 relevant lines covered (75.94%)

16.18 hits per line