Inventory
The live multi-cloud asset register — with scan lineage, stale-resource detection, runtime coverage measurement, and a service graph.
At a glance
| Route | /inventory |
| Group | Security |
| Page permission | cloud_inventory |
What it is
The live multi-cloud asset register. It enumerates what actually exists across every connected account, with scan lineage, stale-resource detection, runtime coverage measurement, a service graph, and a control tower view of detector coverage per provider.
Who it is for
Platform engineers, security teams, and FinOps practitioners who need to know what exists before they can reason about what it costs or what it exposes.
How it works
Scans enumerate resources per region per account, and persist them against a scan run — which is what provides scan lineage. Every resource can be traced to the scan that observed it and the time it was observed.
The Cloud Control Tower view reports live detector coverage per provider, computed from the rule registry rather than hard-coded.
Generation obsolescence identifies resources running on superseded instance families, and stale-resource detection finds resources that exist but are no longer referenced.
Features
- Live multi-cloud resource enumeration across AWS, Azure, GCP, and OCI
- Scan lineage with per-run provenance and timing
- Region-level coverage reporting
- Stale and orphaned resource detection
- Generation obsolescence detection for superseded instance families
- Service graph showing resource relationships
- Operations timeline of estate change over time
- Risk view over the inventory
- Cloud Control Tower with live per-provider detector counts
- Runtime coverage measurement — what proportion of the estate is actually being scanned
How to use it
Configure scan regions per cloud account
Scanning every region wastes time and API quota; scanning too few creates blind spots you will not notice.
Run a scan and sanity-check the resource count
Against your expectations. An implausible number is a signal, not a curiosity.
Check runtime coverage
Low coverage means findings are computed over part of the estate — and the absence of a finding proves nothing. This is the single most important number on the page.
Review stale and orphaned resources
These are usually immediate, low-risk savings and a good first target.
Review generation obsolescence
Newer instance families are frequently both cheaper and faster — an unusual case where there is no trade-off.
Use the service graph before acting on anything
To understand dependencies. A resource that looks orphaned may be load-bearing.
Consult the Control Tower
To see detector coverage per provider, and where depth is thinner.
Why it matters
Nobody can optimise or secure an estate they cannot enumerate — and in practice most organisations cannot. Resources are created across many accounts and regions, by many teams, over many years.
A live register with scan lineage and explicit coverage measurement replaces assumption with fact.
The coverage figure in particular prevents the dangerous inference that no findings means no problems.
Connects to
- Feeds Opportunity Queue, FinSecOps, Resource Parking candidate matching, and Cloud Playground scenario seeding
- Shares the
cloud_inventorypermission with FinSecOps