fix/pin poetry python 3.11 9.5

.github/actions/hermit/action.yml

@@ -94,7 +94,10 @@ runs:
     - if: ${{ inputs.init-tools == 'true' }}
       name: Install security-policies poetry dependencies
       shell: bash
-      run: cd ./security-policies && poetry install --no-root
+      run: |
+        cd ./security-policies
+        poetry env use python3.11
+        poetry install --no-root
     - if: ${{ inputs.init-tools == 'true' }}
       name: Install pre-commit repos
       shell: bash

.github/actions/kibana-ftr/action.yml

@@ -40,7 +40,7 @@ runs:
         echo "KIBANA_DIR=kibana" >> "${GITHUB_OUTPUT}"
 
     - name: Checkout Kibana Repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         repository: elastic/kibana
         ref: ${{ inputs.kibana_ref }}

deploy/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian@sha256:35b8ff74ead4880f22090b617372daff0ccae742eb5674455d542bef71ef1999
+FROM debian@sha256:34cd9e9fd437c0a095ec39cb2e73422c9f30821b0d0848ed74fd0d43bae4d958
 RUN set -x && \
     apt-get update && \
     apt-get install -y --no-install-recommends \

deploy/Dockerfile.debug

@@ -1,4 +1,4 @@
-FROM golang@sha256:efaccb5b497e90df3ebe5216cc25cd9f98e73874e2d638b56e38d4a3f098c41c
+FROM golang@sha256:7caba5286b4c3613a337b709c573047d8ae62ee76106647313b61e72b99f20af
 RUN go install github.com/go-delve/delve/cmd/dlv@latest
 RUN set -x && \
     apt-get update && \

internal/inventory/asset.go

@@ -182,11 +182,11 @@ type URL struct {
 
 // Entity contains the identifiers of the asset
 type Entity struct {
-	Id         string         `json:"id"`
-	Name       string         `json:"name"`
-	Source     *string        `json:"source"`
-	Raw        *any           `json:"raw"`
-	Attributes map[string]any `json:"attributes,omitempty"`
+	Id      string         `json:"id"`
+	Name    string         `json:"name"`
+	Source  *string        `json:"source"`
+	Raw     *any           `json:"raw"`
+	Details map[string]any `json:"Details,omitempty"`
 	AssetClassification
 
 	// non exported fields
@@ -451,28 +451,28 @@ func WithContainer(container Container) AssetEnricher {
 	}
 }
 
-// WithEntityAttributes sets non-ECS resource-specific attributes on the entity.
+// WithEntityDetails sets non-ECS resource-specific attributes on the entity (entity.Details).
 // Keys should use UpperCamelCase per the non-ECS field naming convention.
 // A nil or empty map is a no-op.
-func WithEntityAttributes(attrs map[string]any) AssetEnricher {
+func WithEntityDetails(details map[string]any) AssetEnricher {
 	return func(a *AssetEvent) {
-		if len(attrs) == 0 {
+		if len(details) == 0 {
 			return
 		}
-		a.Entity.Attributes = attrs
+		a.Entity.Details = details
 	}
 }
 
-// WithCreatedAt sets the resource creation timestamp in entity.attributes["CreatedAt"].
+// WithCreatedAt sets the resource creation timestamp in entity.Details["CreatedAt"].
 // A nil time is a no-op.
 func WithCreatedAt(t *time.Time) AssetEnricher {
 	return func(a *AssetEvent) {
 		if t == nil {
 			return
 		}
-		if a.Entity.Attributes == nil {
-			a.Entity.Attributes = make(map[string]any)
+		if a.Entity.Details == nil {
+			a.Entity.Details = make(map[string]any)
 		}
-		a.Entity.Attributes["CreatedAt"] = t
+		a.Entity.Details["CreatedAt"] = t
 	}
 }

internal/inventory/awsfetcher/fetcher_ec2_instance.go

@@ -128,7 +128,7 @@ func (e *ec2InstanceFetcher) Fetch(ctx context.Context, assetChannel chan<- inve
 				IP:           buildIPs(i.PublicIpAddress, i.PrivateIpAddress),
 				MacAddress:   i.GetResourceMacAddresses(),
 			}),
-			inventory.WithEntityAttributes(e.buildAttributes(i, tags, roleArnCache)),
+			inventory.WithEntityDetails(e.buildDetails(i, tags, roleArnCache)),
 			inventory.WithCreatedAt(i.LaunchTime),
 			iamFetcher,
 		)
@@ -177,43 +177,46 @@ func profileNameFromArn(arn string) string {
 	return arn[idx+len(marker):]
 }
 
-// buildAttributes collects non-ECS, resource-specific EC2 fields into entity.attributes,
+// buildDetails collects non-ECS, resource-specific EC2 fields into entity.Details,
 // using UpperCamelCase keys. Empty values are omitted so events stay clean and struct
 // comparison in tests is stable.
-func (e *ec2InstanceFetcher) buildAttributes(i *ec2.Ec2Instance, tags map[string]string, roleArnCache map[string]string) map[string]any {
-	attrs := map[string]any{}
+func (e *ec2InstanceFetcher) buildDetails(i *ec2.Ec2Instance, tags map[string]string, roleArnCache map[string]string) map[string]any {
+	details := map[string]any{}
 	if v := pointers.Deref(i.ImageId); v != "" {
-		attrs["ImageId"] = v
+		details["ImageId"] = v
 	}
 	if v := string(i.Platform); v != "" {
-		attrs["Platform"] = v
+		details["Platform"] = v
 	}
 	if v := pointers.Deref(i.VpcId); v != "" {
-		attrs["VpcId"] = v
+		details["VpcId"] = v
 	}
 	if v := pointers.Deref(i.SubnetId); v != "" {
-		attrs["SubnetId"] = v
+		details["SubnetId"] = v
 	}
 	if i.State != nil {
 		if v := string(i.State.Name); v != "" {
-			attrs["State"] = v
+			details["State"] = v
 		}
 	}
 	if i.IamInstanceProfile != nil {
 		if profileArn := pointers.Deref(i.IamInstanceProfile.Arn); profileArn != "" {
-			attrs["InstanceProfileArn"] = profileArn
+			details["InstanceProfileArn"] = profileArn
 			if roleArn, ok := roleArnCache[profileArn]; ok && roleArn != "" {
-				attrs["RoleArn"] = roleArn
+				details["RoleArn"] = roleArn
 			}
 		}
 	}
 	if v := awslib.LookupTag(tags, "owner"); v != "" {
-		attrs["Owner"] = v
+		details["Owner"] = v
 	}
 	if v := awslib.LookupTag(tags, "costcenter", "cost-center", "cost_center"); v != "" {
-		attrs["CostCenter"] = v
+		details["CostCenter"] = v
 	}
-	return attrs
+	if v := awslib.LookupTag(tags, "role"); v != "" {
+		details["Role"] = v
+	}
+	return details
 }
 
 // buildIPs collects non-empty IP address strings into a slice, returning nil when none exist.

internal/inventory/awsfetcher/fetcher_ec2_instance_test.go

@@ -52,6 +52,7 @@ func makeTestInstance(launchTime *time.Time) *ec2beat.Ec2Instance {
 				{Key: pointers.Ref("key"), Value: pointers.Ref("value")},
 				{Key: pointers.Ref("Owner"), Value: pointers.Ref("team-infra")},
 				{Key: pointers.Ref("CostCenter"), Value: pointers.Ref("cc-1234")},
+				{Key: pointers.Ref("Role"), Value: pointers.Ref("sre")},
 			},
 			InstanceId:       pointers.Ref("234567890"),
 			Architecture:     ec2types.ArchitectureValuesX8664,
@@ -104,7 +105,7 @@ func TestEC2InstanceFetcher_Fetch(t *testing.T) {
 			"private-dns",
 			inventory.WithRelatedAssetIds([]string{"234567890"}),
 			inventory.WithRawAsset(instance1),
-			inventory.WithLabels(map[string]string{"Name": "test-server", "key": "value", "Owner": "team-infra", "CostCenter": "cc-1234"}),
+			inventory.WithLabels(map[string]string{"Name": "test-server", "key": "value", "Owner": "team-infra", "CostCenter": "cc-1234", "Role": "sre"}),
 			inventory.WithCloud(inventory.Cloud{
 				Provider:         inventory.AwsCloudProvider,
 				Region:           "us-east",
@@ -124,7 +125,7 @@ func TestEC2InstanceFetcher_Fetch(t *testing.T) {
 				IP:           []string{"public-ip-addr", "private-ip-addre"},
 				MacAddress:   []string{"mac1", "mac2"},
 			}),
-			inventory.WithEntityAttributes(map[string]any{
+			inventory.WithEntityDetails(map[string]any{
 				"ImageId":            "image-id",
 				"Platform":           "linux",
 				"VpcId":              "vpc-id",
@@ -134,6 +135,7 @@ func TestEC2InstanceFetcher_Fetch(t *testing.T) {
 				"RoleArn":            testRoleArn,
 				"Owner":              "team-infra",
 				"CostCenter":         "cc-1234",
+				"Role":               "sre",
 			}),
 			inventory.WithCreatedAt(&launchTime),
 			inventory.WithUser(inventory.User{
@@ -193,7 +195,7 @@ func TestEC2InstanceFetcher_Fetch_ResolverError(t *testing.T) {
 			"private-dns",
 			inventory.WithRelatedAssetIds([]string{"234567890"}),
 			inventory.WithRawAsset(instance),
-			inventory.WithLabels(map[string]string{"Name": "test-server", "key": "value", "Owner": "team-infra", "CostCenter": "cc-1234"}),
+			inventory.WithLabels(map[string]string{"Name": "test-server", "key": "value", "Owner": "team-infra", "CostCenter": "cc-1234", "Role": "sre"}),
 			inventory.WithCloud(inventory.Cloud{
 				Provider:         inventory.AwsCloudProvider,
 				Region:           "us-east",
@@ -213,7 +215,7 @@ func TestEC2InstanceFetcher_Fetch_ResolverError(t *testing.T) {
 				IP:           []string{"public-ip-addr", "private-ip-addre"},
 				MacAddress:   []string{"mac1", "mac2"},
 			}),
-			inventory.WithEntityAttributes(map[string]any{
+			inventory.WithEntityDetails(map[string]any{
 				"ImageId":            "image-id",
 				"Platform":           "linux",
 				"VpcId":              "vpc-id",
@@ -223,6 +225,7 @@ func TestEC2InstanceFetcher_Fetch_ResolverError(t *testing.T) {
 				// RoleArn is absent because the resolver failed.
 				"Owner":      "team-infra",
 				"CostCenter": "cc-1234",
+				"Role":       "sre",
 			}),
 			inventory.WithCreatedAt(&launchTime),
 			// WithUser falls back to the profile ARN when role resolution fails.

internal/inventory/awsfetcher/fetcher_eks.go

@@ -78,37 +78,37 @@ func (f *eksFetcher) Fetch(ctx context.Context, assetChannel chan<- inventory.As
 				AccountName: f.accountName,
 				ServiceName: "AWS EKS",
 			}),
-			inventory.WithEntityAttributes(buildEKSAttributes(cluster)),
+			inventory.WithEntityDetails(buildEKSDetails(cluster)),
 			inventory.WithCreatedAt(cluster.CreatedAt),
 		)
 	}
 }
 
-// buildEKSAttributes maps a cluster's non-ECS fields into entity.attributes using
+// buildEKSDetails maps a cluster's non-ECS fields into entity.Details using
 // UpperCamelCase keys. The endpoint-access booleans are always included as they are
 // meaningful even when false; other empty values are omitted.
-func buildEKSAttributes(cluster eks.Cluster) map[string]any {
-	attrs := map[string]any{
+func buildEKSDetails(cluster eks.Cluster) map[string]any {
+	details := map[string]any{
 		"EndpointPublicAccess":  cluster.EndpointPublicAccess,
 		"EndpointPrivateAccess": cluster.EndpointPrivateAccess,
 	}
 	if cluster.Status != "" {
-		attrs["Status"] = cluster.Status
+		details["Status"] = cluster.Status
 	}
 	if cluster.Version != "" {
-		attrs["Version"] = cluster.Version
+		details["Version"] = cluster.Version
 	}
 	if cluster.Endpoint != "" {
-		attrs["Endpoint"] = cluster.Endpoint
+		details["Endpoint"] = cluster.Endpoint
 	}
 	if cluster.RoleArn != "" {
-		attrs["RoleArn"] = cluster.RoleArn
+		details["RoleArn"] = cluster.RoleArn
 	}
 	if cluster.PlatformVersion != "" {
-		attrs["PlatformVersion"] = cluster.PlatformVersion
+		details["PlatformVersion"] = cluster.PlatformVersion
 	}
 	if v := cluster.GetOwnerTag(); v != "" {
-		attrs["OwnerTag"] = v
+		details["OwnerTag"] = v
 	}
-	return attrs
+	return details
 }

internal/inventory/awsfetcher/fetcher_eks_test.go

@@ -68,7 +68,7 @@ func TestEKSFetcher_Fetch(t *testing.T) {
 				AccountName: "alias",
 				ServiceName: "AWS EKS",
 			}),
-			inventory.WithEntityAttributes(map[string]any{
+			inventory.WithEntityDetails(map[string]any{
 				"EndpointPublicAccess":  true,
 				"EndpointPrivateAccess": false,
 				"Status":                "ACTIVE",
@@ -91,7 +91,7 @@ func TestEKSFetcher_Fetch(t *testing.T) {
 				AccountName: "alias",
 				ServiceName: "AWS EKS",
 			}),
-			inventory.WithEntityAttributes(map[string]any{
+			inventory.WithEntityDetails(map[string]any{
 				"EndpointPublicAccess":  false,
 				"EndpointPrivateAccess": false,
 			}),

internal/inventory/awsfetcher/fetcher_elb.go

@@ -94,27 +94,27 @@ func (f *elbFetcher) fetch(ctx context.Context, resourceName string, function el
 	}
 
 	for _, item := range awsResources {
-		var attrs map[string]any
+		var details map[string]any
 		var createdAt *time.Time
 		if r, ok := item.(elbInventoryResource); ok {
-			attrs = map[string]any{
+			details = map[string]any{
 				"DNSName":            r.GetDNSName(),
 				"PubliclyAccessible": r.IsPubliclyAccessible(),
 			}
 			if f.AccountId != "" {
-				attrs["AccountID"] = f.AccountId
+				details["AccountID"] = f.AccountId
 			}
 			if v := r.GetLoadBalancerType(); v != "" {
-				attrs["LoadBalancerType"] = v
+				details["LoadBalancerType"] = v
 			}
 			if v := r.GetState(); v != "" {
-				attrs["State"] = v
+				details["State"] = v
 			}
 			if v := r.GetIPAddresses(); len(v) > 0 {
-				attrs["IPAddresses"] = v
+				details["IPAddresses"] = v
 			}
 			if v := r.GetOwnerTag(); v != "" {
-				attrs["OwnerTag"] = v
+				details["OwnerTag"] = v
 			}
 			createdAt = r.GetCreatedAt()
 		}
@@ -131,7 +131,7 @@ func (f *elbFetcher) fetch(ctx context.Context, resourceName string, function el
 				AccountName: f.AccountName,
 				ServiceName: "AWS Networking",
 			}),
-			inventory.WithEntityAttributes(attrs),
+			inventory.WithEntityDetails(details),
 			inventory.WithCreatedAt(createdAt),
 		)
 	}

internal/inventory/awsfetcher/fetcher_elb_test.go

@@ -37,8 +37,8 @@ import (
 )
 
 func TestELBv1Fetcher_Fetch(t *testing.T) {
-	asset := elb.ElasticLoadBalancerInfo{
-		LoadBalancer: types.LoadBalancerDescription{
+	asset := elb.NewElasticLoadBalancerInfo(
+		types.LoadBalancerDescription{
 			AvailabilityZones:         []string{"us-east-1a"},
 			CanonicalHostedZoneName:   pointers.Ref("HZ-NAME"),
 			CanonicalHostedZoneNameID: pointers.Ref("HZ-ID"),
@@ -64,7 +64,11 @@ func TestELBv1Fetcher_Fetch(t *testing.T) {
 			Subnets: []string{"subnet-123"},
 			VPCId:   pointers.Ref("vpc-id"),
 		},
-	}
+		"", // awsAccount
+		"", // region
+		nil,
+		[]string{"203.0.113.1", "203.0.113.2"}, // DNS-resolved by the provider in real code
+	)
 	in := []awslib.AwsResource{asset}
 
 	expected := []inventory.AssetEvent{
@@ -79,11 +83,13 @@ func TestELBv1Fetcher_Fetch(t *testing.T) {
 				AccountName: "alias",
 				ServiceName: "AWS Networking",
 			}),
-			inventory.WithEntityAttributes(map[string]any{
+			inventory.WithEntityDetails(map[string]any{
 				"DNSName":            "internal-my-elb-v1.us-east-1.elb.amazonaws.com",
 				"PubliclyAccessible": false, // scheme is "internal"
 				"AccountID":          "123",
 				"LoadBalancerType":   "classic",
+				"State":              "active",
+				"IPAddresses":        []string{"203.0.113.1", "203.0.113.2"},
 			}),
 			inventory.WithCreatedAt(asset.GetCreatedAt()),
 		),
@@ -134,7 +140,7 @@ func TestELBv2Fetcher_Fetch(t *testing.T) {
 				AccountName: "alias",
 				ServiceName: "AWS Networking",
 			}),
-			inventory.WithEntityAttributes(map[string]any{
+			inventory.WithEntityDetails(map[string]any{
 				"DNSName":            "internal-my-elb-v2.us-east-1.elb.amazonaws.com",
 				"PubliclyAccessible": false, // scheme is internal
 				"AccountID":          "123",