Discovery Coverage

Reference the scope, resource coverage, and collection limits of AWS, Azure, and Google Cloud discovery.

Cloud discovery inventories the control plane visible to the identity attached to the agent VM. It creates a cloud scope for the detected provider environment, imports validated resources and relationships, and records collection gaps.

Discovery does not read every resource in a provider account. The detected machine location and the enforced provider boundary decide what can be collected.

Scope Boundaries

Provider	Discovered scope	Enforced boundary
AWS	Detected AWS account	EC2 instance region and configured literal resource-name prefixes
Azure	Detected Azure subscription	Resource group containing the agent virtual machine
Google Cloud	Detected project	Project attached to the Compute Engine VM

The agent rejects a configured provider, account, subscription, resource group, project, or metadata endpoint that does not match the machine metadata. Static credentials and local CLI profiles are not alternate credential sources.

AWS Inventory

AWS discovery runs only in the EC2 instance region. SECAGENT_AWS_RESOURCE_NAME_PREFIXES supplies one or more literal prefixes. Wildcards and empty prefixes are rejected.

The default cloud collection can inventory prefix-bounded:

• EC2 instances, instance metadata settings, security groups, network interfaces, EBS volumes, and instance-profile relationships;

• VPCs, subnets, VPC peering, VPC flow logs, and EBS snapshots;

• Secrets Manager secret metadata without secret values;

• SQS queues and queue identifiers.

The current automatic collection does not enumerate account-wide IAM, S3, KMS, GuardDuty, or CloudTrail resources because those paths cannot be constrained by the required literal name-prefix boundary. Lambda and EKS collection require exact in-scope resource names and are skipped when those exact allowlists are absent.

A completed AWS discovery means the bounded collectors completed. It does not mean every account resource or region was inventoried.

Azure Inventory

Azure discovery is restricted to the detected subscription and the agent VM's resource group. It can inventory:

• the subscription, resource group, current managed identity, role assignments, and role definitions;

• virtual machines, managed disks, VM extensions, bootstrap metadata, network interfaces, public IPs, virtual networks, peerings, load balancers, Bastion hosts, and snapshots;

• DNS zones and records, network flow logs, diagnostic settings, and management locks;

• Arc machines, Automation accounts, runbooks, and hybrid workers;

• Functions, Logic Apps, API connections, Container Apps, and deployment history;

• Key Vault key and secret metadata;

• Storage accounts, queues, file shares, containers, and object metadata.

Microsoft Entra tenant-wide collectors are not enabled by automatic cloud discovery. Defender pricing is also skipped because it is subscription-scoped rather than resource-group-scoped.

Key Vault and Storage data-plane 401 and 403 responses are recorded as authorization boundaries. They prove that the attached identity could not cross that data-plane boundary. Other failed provider operations make the collection partial.

Google Cloud Inventory

Google Cloud discovery is restricted to the detected project. It can inventory:

• the project, current service account, project IAM policy, custom role definitions, and supported dynamic-group evidence;

• Compute Engine instances, disks, snapshots, images, networks, subnetworks, firewalls, load balancers, and forwarding resources;

• Cloud DNS zones and records;

• Cloud KMS key metadata, logging sinks, and Security Command Center service state;

• Secret Manager secret metadata and Cloud Storage buckets, objects, versions, IAM policy, and legacy ACL metadata;

• BigQuery datasets and tables;

• Cloud SQL instances and databases;

• Cloud Build builds and triggers;

• GKE clusters and node pools;

• Artifact Registry repositories and Docker image metadata;

• Cloud Functions, Cloud Run services, Eventarc triggers, and Pub/Sub topics and subscriptions.

The related Google Cloud APIs must be enabled. A disabled API, missing IAM permission, quota failure, or provider error makes discovery partial.

What Discovery Does Not Read

Cloud discovery avoids secret values during normal control-plane inventory. It records metadata and candidate locations that can feed explicitly enabled attack checks.

Discovery does not:

• accept static access keys, service-account key files, Azure CLI sessions, AWS profiles, or gcloud user credentials;

• follow resources into another AWS account, Azure subscription or resource group, or Google Cloud project;

• turn an authorization denial into successful coverage;

• prove exploitability only because a resource exists;

• treat missing graph data as proof that a resource is absent.

Complete, Partial, and Not Cloud

Result	Meaning	Operator action
Complete	All applicable bounded collectors completed, including explicit safe skips.	Confirm provider, scope, resource counts, and expected skips before attack configuration.
Partial	At least one collector returned an error. Validated nodes and relationships are still imported.	Review the failed collector and operation, fix permissions, API state, quota, or connectivity, then rerun.
Authorization boundary	Azure Key Vault or Storage rejected a data-plane metadata request with 401 or 403.	Decide whether the boundary is intended. Grant narrow data-plane read access only when the resource is approved for collection.
Not cloud	No supported cloud identity was detected on the VM.	Confirm the agent runs directly on EC2, Azure VM, or Compute Engine and can reach native instance metadata. Network discovery can still continue.

Coverage Verification

After discovery:

1. Confirm cloud collection reached a final state in Activity.

2. Read the collection summary and note provider, root scope, node count, relationship count, errors, authorization boundaries, and explicit skips.

3. Confirm the cloud scope label and provider match the approved environment.

4. Compare important provider resources with Dashboard -> Exploit Graph.

5. Rerun after fixing partial collection. Do not compare finding counts across runs with different collection completeness.

Set Up the Cloud Agent