Amazon EC2

Amazon Web Services

Overview

Integrates with Amazon Elastic Compute Cloud (EC2) to synchronize compute and networking inventory across the configured AWS accounts and regions. The connector uses the AWS SDK for Java v2 Ec2Client to describe EC2 resources and emits ten object types: EC2 instances, security groups, subnets, route tables, network ACLs, Elastic IP addresses, network interfaces, VPC peering connections, EBS volumes, and EBS snapshots. Each object type is synced independently, once per assumed role per region.

Data retrieved from Amazon EC2

Connector Object	Required	Maps to Data Model
Instance	Yes	Host
SecurityGroup	Yes	Cloud Resource
Subnet	Yes	Network
RouteTable	Yes	Cloud Resource
NetworkAcl	Yes	Cloud Resource
ElasticIp	Yes	Cloud Resource
NetworkInterface	Yes	Cloud Resource
VpcPeeringConnection	Yes	Cloud Resource
EbsVolume	Yes	Cloud Resource
EbsSnapshot	Yes	Cloud Resource

note

For detailed steps on how to view the data retrieved from Amazon EC2 in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Amazon EC2 from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Access key ID	No	—	AWS user access key ID, if not specified, the connector consults the default credentials provider chain to try and determine the \
Secret access key	No	—	AWS user secret access key, if not specified, the connector consults the default credentials provider chain to try and determine the \
Default region	No	us-east-1	Default AWS region, if not specified, the connector consults the default region provider chain to try and determine the region to use.
Assume role	No	—	Amazon Resource Name for the role to assume.
Session duration	No	900	Assume role session duration in seconds.
Page size	No	100	The maximum number of results to retrieve per operation.

Authentication

Authentication is shared across the AWS connector bundle via the AwsConfiguration base class. The EC2 sub-connector uses the AWS SDK for Java v2 Ec2Client, which signs every request with AWS SigV4 using credentials resolved through the following chain (in order):

1. STS AssumeRole — if assumeRoleARN is configured, the connector assumes that role (using the credentials below as the principal) and uses the resulting temporary session credentials.
2. Static access keys — if accessKey / secretKey are configured, they are used directly.
3. Default credentials provider chain — environment variables, ~/.aws/credentials, container role, or EC2 instance metadata.

Assumed-role sessions use the configurable sessionDuration (default 900 s) with a unique session name per sync. assumeRoleARN may be a comma-separated list to sync multiple accounts in one run. An Ec2Client is constructed per role per region; each client is closed when its region has been fully synced. When no explicit region is provided via operation options, the connector discovers all enabled regions with ec2:DescribeRegions and iterates over them.

Required AWS API permissions

Permission	Purpose
ec2:DescribeRegions	Discover enabled regions when no region option is supplied
ec2:DescribeInstances	List EC2 instances (Instance model)
ec2:DescribeTags	Enumerate instance tag keys for tag-based operation options
ec2:DescribeSecurityGroups	List security groups (SecurityGroup model)
ec2:DescribeSubnets	List subnets (Subnet model)
ec2:DescribeRouteTables	List route tables (RouteTable model)
ec2:DescribeNetworkAcls	List network ACLs (NetworkAcl model)
ec2:DescribeAddresses	List Elastic IP addresses (ElasticIp model)
ec2:DescribeNetworkInterfaces	List elastic network interfaces (NetworkInterface model)
ec2:DescribeVpcPeeringConnections	List VPC peering connections (VpcPeeringConnection model)
ec2:DescribeVolumes	List EBS volumes (EbsVolume model)
ec2:DescribeSnapshots	List account-owned EBS snapshots (EbsSnapshot model)
sts:AssumeRole	Only when assumeRoleARN is set

How to obtain Amazon EC2 credentials

Create an IAM user for Amazon EC2 access

For the Amazon EC2 connector to interact with the AWS SDK and retrieve instances, you must provide specific AWS credentials and permissions. If you want to configure cross-account access, you can skip this section and go to the Set up permissions for cross-account access section instead.

To create an IAM user for EC2 access, follow these steps:

1. Log in to your organization's AWS Management Console as an administrator.

2. Navigate to the Identity and Access Management (IAM) dashboard.

3. From the navigation pane under Access management, click Users, and then click Create user.

4. Provide a User name, leave the Provide user access to AWS Management Console option unchecked, and then click Next.

5. Click the Attach policies directly option, search for and select the AmazonEC2ReadOnlyAccess permission.

   

6. Click Next and then click Create user.

   The Users page displays and the new IAM user is available in the Users table.

Note: If you do not have permissions to create a new IAM user, contact your AWS administrator. For additional information, see AWS documentation.

Obtain Amazon EC2 access keys

After you have created an IAM user, you can then generate the access keys that are required for the Amazon EC2 connector to access the AWS SDK. To do so, follow these steps:

1. Navigate to the IAM dashboard.

2. From the navigation pane under Access management, click Users.

3. Choose the IAM user you created in the earlier steps.

4. Click the Security credentials tab and then click Create access key.

5. Select the Application running outside AWS use case and then click Next.

6. Provide a description and then click Create access key.

   The access key ID and secret access key display. The secret access key is shown only once and cannot be retrieved again, so copy the key and save it to a secure location.

   

Note: If you do not have the permissions to create access keys, contact your Amazon EC2 administrator. For additional information, see AWS documentation.

Create a role and assign permissions

After creating an IAM user and obtaining the Amazon EC2 access keys, the next step is to create a role and obtain the ARN that is required for the integration. To do so, follow these steps:

1. From the IAM dashboard, click Roles, and then click Create role.

2. For the Trusted entity type, choose AWS account, and then click Next.

3. Search for and select the AmazonEC2ReadOnlyAccess permission from the list of permissions and click Next.

4. Assign a name and description and then click Create role.

5. Back on the Roles page, click the new role and copy the value in the ARN field as shown below:

   

   The ARN, along with the access key ID and secret access key, are required for authentication in the integration configuration.

Note: If you do not have the permissions to create roles, contact your Amazon EC2 administrator. For additional information, see AWS documentation.

(Optional) Set up permissions for cross-account access

You can configure cross-account access to allow the Amazon EC2 connector to interact with multiple AWS accounts. If this is what you want to do, you can skip the Create an IAM user for Amazon EC2 access section.

Before we begin, let's introduce some terms for clarity:

• Source account: The AWS account with EC2 instances that the connector will access.

• Target account: The AWS account that is connected to the EC2 instances in the source account.

In every AWS target account with EC2 Instances, follow these steps:

1. From the IAM dashboard, click Roles, and then click Create role.

2. For the Trusted entity type, select AWS account, and then select Another AWS account.

3. Enter the AWS account ID of the AWS source account and then click Next

4. Attach a policy to the role that grants permissions for the actions you want to allow in the target account (e.g., AmazonEC2ReadOnlyAccess).

5. After creating the role, select it from the list of roles and then click the Trust relationships tab.

6. Click Edit trust policy and edit the trust relationship policy document to include the AWS source account ID you entered in step 3.

7. Click Update policy and note down the Role ARN, as you will need this ARN in the source account for the next steps.

In the AWS source account connecting to the EC2 Instances, follow these steps:

1. From the IAM dashboard, click Users, and then click Create user.

2. Enter a username (e.g., CrossAccountUser) and click Next.

3. Select Attach policies directly and then click Create policy.

4. Click the JSON tab and attach a policy to the user that allows it to assume roles in the target account. For example, the policy should allow sts:AssumeRole for the target account's role:

   {
       "Version": "2024-05-30",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "sts:AssumeRole",
               "Resource": "<target-role-arn>"
           }
       ]
   }

   Replace <target-role-arn> with the ARN of the role created in the target account.

5. Click Next.

6. Repeat steps 3-5 for each target ARN.

7. Search for and select the AmazonEC2ReadOnlyAccess permission from the list of permissions and click Next.

8. Click Create user.

   After creating the user, follow the steps for obtaining access keys. Use these credentials in the integration configuration along with the role ARN for the target you created earlier. You can enter the ARNs in a comma-separated format: target1RoleARN, target2RoleARN, target3RoleARN.

Note: For additional information on configuring cross-account access, see AWS documentation

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Instance

Source Field Name	SDM Attribute
composed from platformDetails + instanceType + architecture + "EC2 instance"	Description
constants ASSET_CATEGORY_HOST, ASSET_CATEGORY_VIRTUAL_MACHINE	Categories
Instance.architectureAsString()	Architecture
Instance.blockDeviceMappings[] rendered as device=volumeId	Block device mappings (multivalued)
Instance.hypervisorAsString()	Hypervisor
Instance.iamInstanceProfile().arn()	IAM instance profile ARN
Instance.imageId	AMI ID
Instance.instanceId	UID
Instance.instanceId	Instance ID
Instance.instanceTypeAsString()	Instance type
Instance.keyName	Key name
Instance.launchTime	First seen
Instance.launchTime	Launch time
Instance.metadataOptions().httpTokensAsString() == "required"	IMDSv2 required
Instance.monitoring().stateAsString()	Monitoring
Instance.networkInterfaces[].ipv6Addresses[].ipv6Address	IPv6 addresses (multivalued)
Instance.placement().availabilityZone()	Availability zone
Instance.platformAsString() else Instance.platformDetails()	Operating system
Instance.privateDnsName	Private DNS names
Instance.publicDnsName	Public DNS names
Instance.ramdiskId	RAM disk ID
Instance.rootDeviceName	Root device name
Instance.rootDeviceTypeAsString()	Root device type
Instance.securityGroups[].groupId	Security group IDs (multivalued)
Instance.securityGroups[].groupName	Security group (multivalued)
Instance.state().nameAsString()	Source status
Instance.stateTransitionReason	State transition reason
Instance.subnetId	Subnet ID
Instance.tags[] as key:value	Tags (multivalued)
Instance.tags[Name] else Instance.instanceId	Name
Instance.virtualizationTypeAsString()	Virtualization type
Instance.vpcId	VPC ID
literal "AWS"	Cloud provider
NIC association public IPs + Instance.publicIpAddress	Public IP addresses (multivalued)
NIC private IPs + Instance.privateIpAddress	Private IP addresses (multivalued)
NIC private IPs + NIC/instance public IPs + Instance.privateIpAddress + Instance.publicIpAddress	IP addresses (multivalued)
normalized Instance.networkInterfaces[].macAddress	MAC addresses (multivalued)
normalized Instance.privateDnsName	Hostnames
normalized Instance.state().nameAsString()	Status
region being synced	Region
Reservation.ownerId	Owner ID
sync timestamp	Last seen
sync timestamp	Last captured

SecurityGroup

Source Field Name	SDM Attribute
derived: any ingress 0.0.0.0/0 or ::/0	Ingress open to internet
ipPermissions[] ipRanges/ipv6Ranges equal to 0.0.0.0/0 or ::/0	Ingress open CIDRs (multivalued)
ipPermissions[]/ipPermissionsEgress[] userIdGroupPairs[].groupId	Referenced group IDs (multivalued)
literal "AWS"	Cloud provider
region being synced	Region
SecurityGroup.description	Description
SecurityGroup.groupId	UID
SecurityGroup.groupId	Group ID
SecurityGroup.groupName	Group name
SecurityGroup.groupName else SecurityGroup.groupId	Name
SecurityGroup.ipPermissions[] rendered protocol:ports:cidr / :sg=<groupId>	Ingress rules (multivalued)
SecurityGroup.ipPermissionsEgress[] rendered protocol:ports:cidr / :sg=<groupId>	Egress rules (multivalued)
SecurityGroup.ownerId	Owner ID
SecurityGroup.tags[] as key:value	Tags (multivalued)
SecurityGroup.vpcId	VPC ID
sync timestamp	Last captured

Subnet

Source Field Name	SDM Attribute
literal "AWS"	Cloud provider
region being synced	Region
Subnet.availabilityZone	Availability zone
Subnet.availableIpAddressCount	Available IP count
Subnet.cidrBlock	CIDR block
Subnet.ipv6CidrBlockAssociationSet[].ipv6CidrBlock	IPv6 CIDR blocks (multivalued)
Subnet.mapPublicIpOnLaunch	Map public IP on launch
Subnet.ownerId	Owner ID
Subnet.stateAsString()	Source status
Subnet.subnetArn	Subnet ARN
Subnet.subnetId	UID
Subnet.subnetId	Subnet ID
Subnet.tags[] as key:value	Tags (multivalued)
Subnet.tags[Name] else Subnet.subnetId	Name
Subnet.vpcId	VPC ID
sync timestamp	Last captured

RouteTable

Source Field Name	SDM Attribute
derived: any association main == true	Is main route table
derived: any internet gateway route present	Has internet gateway route
literal "AWS"	Cloud provider
region being synced	Region
RouteTable.associations[].subnetId	Associated subnet IDs (multivalued)
RouteTable.ownerId	Owner ID
RouteTable.routes[] rendered destination -> target	Routes (multivalued)
RouteTable.routes[].gatewayId starting with igw-	Internet gateway IDs (multivalued)
RouteTable.routes[].natGatewayId	NAT gateway IDs (multivalued)
RouteTable.routeTableId	UID
RouteTable.routeTableId	Route table ID
RouteTable.tags[] as key:value	Tags (multivalued)
RouteTable.tags[Name] else RouteTable.routeTableId	Name
RouteTable.vpcId	VPC ID
sync timestamp	Last captured

NetworkAcl

Source Field Name	SDM Attribute
literal "AWS"	Cloud provider
NetworkAcl.associations[].subnetId	Associated subnet IDs (multivalued)
NetworkAcl.entries[] where egress == false, rendered rule#:action:protocol:ports:cidr	Ingress entries (multivalued)
NetworkAcl.entries[] where egress == true, rendered rule#:action:protocol:ports:cidr	Egress entries (multivalued)
NetworkAcl.isDefault	Is default
NetworkAcl.networkAclId	UID
NetworkAcl.networkAclId	Network ACL ID
NetworkAcl.ownerId	Owner ID
NetworkAcl.tags[] as key:value	Tags (multivalued)
NetworkAcl.tags[Name] else NetworkAcl.networkAclId	Name
NetworkAcl.vpcId	VPC ID
region being synced	Region
sync timestamp	Last captured

ElasticIp

Source Field Name	SDM Attribute
Address.allocationId	Allocation ID
Address.allocationId else Address.publicIp	UID
Address.associationId	Association ID
Address.domainAsString()	Domain
Address.instanceId	Instance ID
Address.networkInterfaceId	Network interface ID
Address.networkInterfaceOwnerId	Network interface owner ID
Address.privateIpAddress	Private IP
Address.publicIp	Public IP
Address.publicIp	Public IP addresses (multivalued)
Address.publicIpv4Pool	Public IPv4 pool
Address.tags[] as key:value	Tags (multivalued)
literal "AWS"	Cloud provider
region being synced	Region
sync timestamp	Last captured

NetworkInterface

Source Field Name	SDM Attribute
literal "AWS"	Cloud provider
NetworkInterface.association().ipOwnerId()	Association IP owner ID
NetworkInterface.association().publicDnsName()	Public DNS names
NetworkInterface.association().publicIp()	Association public IP
NetworkInterface.association().publicIp()	Public IP addresses (multivalued)
NetworkInterface.attachment().instanceId()	Attached instance ID
NetworkInterface.attachment().statusAsString()	Attachment status
NetworkInterface.availabilityZone	Availability zone
NetworkInterface.description	Description
NetworkInterface.groups[].groupId	Security group IDs (multivalued)
NetworkInterface.interfaceTypeAsString()	Interface type
NetworkInterface.ipv6Addresses[].ipv6Address	IPv6 addresses (multivalued)
NetworkInterface.macAddress	MAC addresses (multivalued)
NetworkInterface.networkInterfaceId	UID
NetworkInterface.networkInterfaceId	Network interface ID
NetworkInterface.ownerId	Owner ID
NetworkInterface.privateDnsName	Private DNS names
NetworkInterface.privateIpAddress + privateIpAddresses[].privateIpAddress	Private IP addresses (multivalued)
NetworkInterface.statusAsString()	Source status
NetworkInterface.subnetId	Subnet ID
NetworkInterface.tagSet[] as key:value	Tags (multivalued)
NetworkInterface.vpcId	VPC ID
region being synced	Region
sync timestamp	Last captured

VpcPeeringConnection

Source Field Name	SDM Attribute
accepterVpcInfo().cidrBlock()	Accepter CIDR
accepterVpcInfo().ownerId()	Accepter owner ID
accepterVpcInfo().region()	Accepter region
accepterVpcInfo().vpcId()	Accepter VPC ID
derived: accepter and requester owner IDs differ	Is cross account
literal "AWS"	Cloud provider
region being synced	Region
requesterVpcInfo().cidrBlock()	Requester CIDR
requesterVpcInfo().ownerId()	Requester owner ID
requesterVpcInfo().region()	Requester region
requesterVpcInfo().vpcId()	Requester VPC ID
sync timestamp	Last captured
VpcPeeringConnection.status().codeAsString()	Source status
VpcPeeringConnection.tags[] as key:value	Tags (multivalued)
VpcPeeringConnection.vpcPeeringConnectionId	UID
VpcPeeringConnection.vpcPeeringConnectionId	Peering connection ID

EbsVolume

Source Field Name	SDM Attribute
literal "AWS"	Cloud provider
region being synced	Region
sync timestamp	Last captured
Volume.attachments[] rendered instanceId@device:state	Attachments (multivalued)
Volume.attachments[].instanceId	Attached instance IDs (multivalued)
Volume.availabilityZone	Availability zone
Volume.createTime	First seen
Volume.encrypted	Encrypted
Volume.iops	IOPS
Volume.kmsKeyId	KMS key ID
Volume.multiAttachEnabled	Multi-attach enabled
Volume.size	Size (GiB)
Volume.snapshotId	Snapshot ID
Volume.stateAsString()	Source status
Volume.tags[] as key:value	Tags (multivalued)
Volume.tags[Name] else Volume.volumeId	Name
Volume.throughput	Throughput
Volume.volumeId	UID
Volume.volumeId	Volume ID
Volume.volumeTypeAsString()	Volume type

EbsSnapshot

Source Field Name	SDM Attribute
literal "AWS"	Cloud provider
region being synced	Region
Snapshot.description	Description
Snapshot.encrypted	Encrypted
Snapshot.kmsKeyId	KMS key ID
Snapshot.ownerId	Owner ID
Snapshot.progress	Progress
Snapshot.snapshotId	UID
Snapshot.snapshotId	Snapshot ID
Snapshot.startTime	First seen
Snapshot.stateAsString()	Source status
Snapshot.storageTierAsString()	Storage tier
Snapshot.tags[] as key:value	Tags (multivalued)
Snapshot.tags[Name] else Snapshot.snapshotId	Name
Snapshot.volumeId	Volume ID
Snapshot.volumeSize	Volume size (GiB)
sync timestamp	Last captured

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Instance

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query (one client per region). regions takes precedence over region.	All enabled regions from ec2:DescribeRegions
pageSize	Page size (maxResults) for each DescribeInstances call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeInstances

SecurityGroup

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query. regions takes precedence over region.	All enabled regions from ec2:DescribeRegions
pageSize	Page size (maxResults) per DescribeSecurityGroups call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeSecurityGroups

Subnet

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query. regions takes precedence over region.	All enabled regions from ec2:DescribeRegions
pageSize	Page size (maxResults) per DescribeSubnets call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeSubnets

RouteTable

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query. regions takes precedence over region.	All enabled regions from ec2:DescribeRegions
pageSize	Page size (maxResults) per DescribeRouteTables call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeRouteTables

NetworkAcl

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query. regions takes precedence over region.	All enabled regions from ec2:DescribeRegions
pageSize	Page size (maxResults) per DescribeNetworkAcls call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeNetworkAcls

ElasticIp

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query. regions takes precedence over region.	All enabled regions from ec2:DescribeRegions

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeAddresses

NetworkInterface

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query. regions takes precedence over region.	All enabled regions from ec2:DescribeRegions
pageSize	Page size (maxResults) per DescribeNetworkInterfaces call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeNetworkInterfaces

VpcPeeringConnection

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query. regions takes precedence over region.	All enabled regions from ec2:DescribeRegions
pageSize	Page size (maxResults) per DescribeVpcPeeringConnections call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeVpcPeeringConnections

EbsVolume

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query. regions takes precedence over region.	All enabled regions from ec2:DescribeRegions
pageSize	Page size (maxResults) per DescribeVolumes call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeVolumes

EbsSnapshot

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query. regions takes precedence over region.	All enabled regions from ec2:DescribeRegions
pageSize	Page size (maxResults) per DescribeSnapshots call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 · Endpoint: ec2:DescribeSnapshots
• Default filters: ownerIds = self — restricts results to snapshots owned by the calling account.

Changelog

Changelog

The Amazon EC2 connector has undergone the following changes:

Version	Description	Migration Steps
3.2.2	No changes in this release.	N/A
3.2.1	No changes in this release.	N/A
3.2.0	No changes in this release.	N/A
3.1.0	New Features - Expanded EC2 visibility for network exposure and blast-radius analysis. The connector now also syncs Security Groups, Subnets, Route Tables, Network ACLs, Elastic IPs, Network Interfaces, VPC Peering Connections, EBS Volumes, and EBS Snapshots. EC2 Instance records now include the attached IAM instance profile, security-group IDs, IMDSv2 enforcement status, IPv6 addresses, and block-device mappings. Improvements - Secondary network-interface public IPs are no longer dropped. EC2 instance public-IP attributes now capture every public IP attached to an instance, not just the primary interface. - Sync failures are now visible. Previously, certain AWS API errors (throttling, server errors, transient network failures, validation errors) could be silently swallowed during multi-region sync, producing empty results without indicating a problem. These now surface as sync failures with a clear log entry detailing the HTTP status, AWS error code, request id, and service name. Per-region permission gaps (HTTP 401 / 403) still allow the sync to continue across other regions, but are now visible in logs.	N/A
3.0.20	Dependency Upgrades - Updated the AWS SDK and shared connector libraries to current versions. No functional change to EC2 syncs.	N/A
3.0.19	No changes in this release.	N/A
3.0.18	Dependency Upgrades - Updated the AWS SDK to a newer release. No functional change to EC2 syncs.	N/A
3.0.17	No changes in this release.	N/A
3.0.16	No changes in this release.	N/A
3.0.15	No changes in this release.	N/A
3.0.14	No changes in this release.	N/A
3.0.13	Dependency Upgrades - Updated the AWS SDK, Jackson, and shared connector libraries to current versions. No functional change to EC2 syncs.	N/A
3.0.12	No changes in this release.	N/A
3.0.11	Improvements - EC2 Instance records now retain every hostname, DNS name, and public IP, and list all attached security groups. Hostname, private DNS, public DNS, and public IP are now multi-valued so that instances with multiple values are captured in full rather than collapsed to a single entry, and the security group attribute now holds all groups attached to an instance.	• Instance: Hostname, public IP, public DNS, and private DNS attributes were converted to multi-valued identifiers, and the security group attribute became multi-valued. Action: re-sync the connector to repopulate these attributes in their new form.
3.0.10	No changes in this release.	N/A
3.0.9	No changes in this release.	N/A
3.0.8	No changes in this release.	N/A
3.0.7	Dependency Upgrades - Updated shared connector libraries to a newer version. No functional change to EC2 syncs.	N/A
3.0.6	New Features - Configurable sync parallelism. A new Parallelism Level setting controls how many regions are queried concurrently during a sync, letting you tune throughput against AWS API rate limits.	N/A
3.0.5	No changes in this release.	N/A
3.0.4	No changes in this release.	N/A
3.0.3	Bug Fixes - AWS clients are now released promptly during sync. EC2 service clients are closed as soon as each region finishes, preventing resource leaks during large multi-region syncs.	N/A
3.0.2	Improvements - Sync calls no longer hang indefinitely. Per-attempt and overall API call timeouts are now applied to AWS requests, so a slow or unresponsive endpoint fails fast instead of stalling the sync.	N/A
3.0.1	Improvements - Complete IP, MAC, and network detail for EC2 Instances. Instance records now aggregate IP and MAC addresses across all attached network interfaces rather than only the primary interface, and expose additional details including AMI ID, owner ID, instance type, availability zone, VPC and subnet IDs, root device, virtualization type, hypervisor, and launch time.	• Instance: Several instance attributes were re-keyed (for example the source instance state moved to a dedicated Source Status attribute and detail attributes adopted stable identifiers), and Launch Time is now stored as a timestamp. Action: re-sync the connector to repopulate instance attributes under their new identifiers.
3.0.0	Overview The Amazon EC2 connector integrates with Amazon Web Services to synchronize EC2 compute instances as host and virtual-machine assets. Category: Amazon Web Services Models	N/A