Resource types – Docs

Search by a type with $type, such as $type:storage.bucket, to see buckets and storage accounts from all three clouds in one list. $nativeType is the cloud's own type, written the same way for every cloud, such as $nativeType:aws/ec2/instance, and each native type has a view in the inventory with all its properties.

Type	AWS	Azure	GCP
Virtual machine `compute.vm`	EC2 instances	Virtual machines	Compute Engine instances
Function `compute.function`	Lambda functions	Function Apps	Cloud Functions, Cloud Run
Container cluster `container.cluster`	EKS	AKS	GKE
Storage bucket `storage.bucket`	S3 buckets	Storage accounts	Cloud Storage buckets
Disk `storage.disk`	EBS volumes	Managed disks	Persistent disks
Database `database.instance`	RDS, Aurora, DynamoDB	Azure SQL, Cosmos DB	Cloud SQL
Virtual network `network.vpc`	VPCs	Virtual networks	VPC networks
Subnet `network.subnet`	Subnets	Subnets	Subnetworks
Load balancer `network.load-balancer`	ALB, NLB	Load balancers, Application Gateways	Forwarding rules
Public IP `network.public-ip`	Elastic IPs	Public IP addresses	External addresses
Firewall rules `network.firewall`	Security groups	Network security groups	Firewall rules
Identity `identity.principal`	IAM users and roles	Managed identities	Service accounts
DNS zone `dns.zone`	Route 53 hosted zones	DNS zones	Cloud DNS zones
Image `compute.image`	AMIs	Images	Compute Engine images
Scaling group `compute.scaling-group`	Auto Scaling groups, EKS node groups	VM scale sets	Managed instance groups
Workflow `compute.workflow`	Step Functions state machines	Logic Apps	Workflows
Service `container.service`	ECS and Lightsail services	Container Apps	Cloud Run services
Registry `container.registry`	ECR repositories	Container Registry	Artifact Registry repositories
Image `container.image`	ECR images	Container images	Container images
Snapshot `storage.snapshot`	EBS, database and Lightsail snapshots	Snapshots	Snapshots
Backup `storage.backup`	Backup vaults, recovery points, DynamoDB backups	Recovery Services vaults	Backup and DR
File system `storage.file-system`	EFS file systems	Azure Files	Filestore
Cache `database.cache`	ElastiCache, DAX	Azure Managed Redis	Memorystore
Warehouse `database.warehouse`	Redshift clusters	Synapse	BigQuery
Queue `messaging.queue`	SQS queues, Amazon MQ brokers	Service Bus queues	Cloud Tasks queues
Topic `messaging.topic`	SNS topics, EventBridge buses	Service Bus topics, Event Grid	Pub/Sub topics
Stream `messaging.stream`	Kinesis and Firehose streams	Event Hubs	Dataflow
Gateway `network.gateway`	Internet, NAT, VPN and transit gateways	Gateways	Cloud NAT, Cloud VPN
Route table `network.route-table`	Route tables, transit gateway route tables	Route tables	Routes
Interface `network.interface`	Network interfaces	Network interfaces	Network interfaces
Endpoint `network.endpoint`	VPC endpoints, Instance Connect endpoints	Private endpoints	Private Service Connect
Connection `network.connection`	VPC peerings, transit gateway attachments, VPN connections	Peerings, connections	Peerings, VPN tunnels
Cdn `network.cdn`	CloudFront, Lightsail distributions	Front Door, CDN	Cloud CDN
Api gateway `network.api-gateway`	API Gateway, AppSync APIs	API Management	API Gateway
Web firewall `network.web-firewall`	WAF web ACLs	Web Application Firewall	Cloud Armor
Record `dns.record`	Route 53 records	DNS records	DNS records
Group `identity.group`	IAM and Identity Center groups	Groups	Groups
Policy `identity.policy`	IAM and Organizations policies, Identity Center permission sets	Role definitions	IAM policies
Credential `identity.credential`	IAM access keys, MFA devices	Credentials	Service account keys
Provider `identity.provider`	IAM identity providers, Cognito, Identity Center	Identity providers	Identity providers
Key `security.key`	KMS keys	Key Vault keys	Cloud KMS keys
Secret `security.secret`	Secrets Manager secrets	Key Vault secrets	Secret Manager secrets
Certificate `security.certificate`	ACM and Lightsail certificates	Key Vault certificates	Certificate Manager
Log group `monitoring.log-group`	CloudWatch log groups	Log Analytics workspaces	Logging buckets
Alarm `monitoring.alarm`	CloudWatch and Lightsail alarms, Route 53 health checks	Monitor alerts	Monitoring alert policies
Trail `monitoring.trail`	CloudTrail trails, Config delivery channels, VPC flow logs	Activity logs	Audit logs
Repository `devops.repository`	CodeCommit repositories	Azure Repos	Repositories
Pipeline `devops.pipeline`	CodePipeline, CodeBuild, CodeDeploy	Azure Pipelines	Cloud Build, Cloud Deploy
Stack `management.stack`	CloudFormation stacks and StackSets	Deployments	Infrastructure Manager

Everything else

Azure and GCP report every resource they hold. Resources without a type above are kept as other with their cloud's own type, so you can still search for them.

What each asset holds

Every asset has the same normalized fields on every cloud, such as its name, type, region, account, tags and state. The raw data from its cloud is kept alongside, and you can open it from the asset's page.

How changes are recorded

Each collection takes a full snapshot of the asset source and compares it with the one before. A new asset is recorded as created, a changed one as updated with what changed, and one that's gone as deleted. Because every run is a full snapshot, deletes are never missed. See change history.