AWS Infrastructure Coverage
Complete visibility across your AWS accounts. Every supported service is inventoried, analyzed, and monitored — with Terraform drift detection built in.
1 min read
How it works
Four capabilities compose the coverage below.
- Inventory
- Discovers and syncs resources from AWS into the database. Runs on a schedule or on-demand per account and region.
- Metrics
- Pulls CloudWatch time-series data (CPU, memory, IOPS, latency…) and stores it for trend analysis and anomaly detection.
- Optimization
- Evaluates metric history against thresholds and turns findings into actionable cost-saving recommendations: right-sizing, Reserved Instance purchases, or deletion candidates.
- Drift detection
- Compares live inventory against Terraform state files to find resources created outside IaC — unmanaged infrastructure.
Coverage by service
One card per service. Each card lists its resource types and the capabilities they support.
Inventory
Metrics
Optimization
Drift detection
Storage
5 resource types
-
CloudWatch Log Groups
-
EBS Volumes
-
EBS Snapshots
-
EFS File Systems
-
S3 Buckets
Databases
9 resource types
-
DynamoDB Tables
-
ElastiCache Clusters
-
Replication Groups
-
ElastiCache Reserved
-
OpenSearch Domains
-
OpenSearch Reserved
-
RDS Instances
-
Aurora Clusters
-
RDS Reserved
Compute
4 resource types
-
EC2 Instances
-
Reserved Instances
-
Lambda Functions
-
Savings Plan
Network
10 resource types
-
Elastic IPs
-
VPCs
-
Subnets
-
Internet Gateways
-
NAT Gateways
-
VPC Endpoints
-
Classic Load Balancers
-
ALB / NLB
-
Target Groups
-
Route 53 Hosted Zones
Security
5 resource types
-
Security Groups
-
IAM Policies
-
IAM Roles
-
KMS Keys
-
Secrets
Messaging
2 resource types
-
SNS Topics
-
SQS Queues
Role template
Deploy as-is, then paste the resulting RoleArn output into the "Assume Role ARN" field.
Download role template
Choose the format that matches your infrastructure-as-code stack.
Required permissions
Grouped by AWS service. Read-only actions only — no create, modify, or delete.
| Service | IAM actions (70 actions) |
|---|---|
| CloudwatchReadOnly |
cloudwatch:GetMetricStatistics
|
| DynamodbReadOnly |
dynamodb:DescribeTable
dynamodb:ListTables
dynamodb:ListTagsOfResource
|
| Ec2ReadOnly |
ec2:DescribeAddresses
ec2:DescribeInstances
ec2:DescribeInternetGateways
ec2:DescribeNatGateways
ec2:DescribeReservedInstances
ec2:DescribeSecurityGroups
ec2:DescribeSnapshots
ec2:DescribeSubnets
ec2:DescribeVolumes
ec2:DescribeVpcEndpoints
ec2:DescribeVpcs
|
| ElasticacheReadOnly |
elasticache:DescribeCacheClusters
elasticache:DescribeReplicationGroups
elasticache:DescribeReservedCacheNodes
elasticache:ListTagsForResource
|
| ElasticfilesystemReadOnly |
elasticfilesystem:DescribeFileSystems
elasticfilesystem:DescribeLifecycleConfiguration
elasticfilesystem:DescribeTags
|
| ElasticloadbalancingReadOnly |
elasticloadbalancing:DescribeLoadBalancers
elasticloadbalancing:DescribeTags
elasticloadbalancing:DescribeTargetGroups
|
| EsReadOnly |
es:DescribeDomains
es:DescribeReservedInstances
es:ListDomainNames
es:ListTags
|
| IamReadOnly |
iam:GetPolicyVersion
iam:GetRolePolicy
iam:ListAttachedRolePolicies
iam:ListEntitiesForPolicy
iam:ListPolicies
iam:ListPolicyTags
iam:ListRolePolicies
iam:ListRoleTags
iam:ListRoles
|
| KmsReadOnly |
kms:DescribeKey
kms:GetKeyRotationStatus
kms:ListAliases
kms:ListKeys
kms:ListResourceTags
|
| LambdaReadOnly |
lambda:GetFunctionConfiguration
lambda:ListFunctions
lambda:ListTags
|
| LogsReadOnly |
logs:DescribeLogGroups
logs:ListTagsForResource
logs:ListTagsLogGroup
|
| RdsReadOnly |
rds:DescribeDBClusters
rds:DescribeDBInstances
rds:DescribeReservedDBInstances
rds:ListTagsForResource
|
| Route53ReadOnly |
route53:ListHostedZones
route53:ListResourceRecordSets
route53:ListTagsForResource
|
| S3ReadOnly |
s3:GetBucketLocation
s3:GetBucketTagging
s3:GetObject
s3:ListAllMyBuckets
s3:ListBucket
|
| SavingsplansReadOnly |
savingsplans:DescribeSavingsPlans
|
| SecretsmanagerReadOnly |
secretsmanager:ListSecrets
|
| SnsReadOnly |
sns:GetTopicAttributes
sns:ListSubscriptionsByTopic
sns:ListTagsForResource
sns:ListTopics
|
| SqsReadOnly |
sqs:GetQueueAttributes
sqs:ListQueueTags
sqs:ListQueues
|
First sync
Once the account is saved, inventory runs on the next hourly cycle — or trigger it immediately from the account's detail page. Discovered resources, grouped by service (EC2, RDS, S3, ...) appear under Audit → AWS.