Cloud Inventory
Inventory continuously collects your AWS resources into a queryable graph. Pick a service, filter by fields or in plain English, and walk relationships between resources — an instance's security groups, a subnet's instances, a role's activity. The same graph powers automation's resource gate and target resolution.
In the app: /inventory
Services & snapshots
Each service (EC2 instances, security groups and rules, subnets, VPCs, ECS, and more) is collected into a snapshot you can query. The catalog is data-driven — adding or changing a service is a configuration row, not a code change. Snapshot freshness is shown per service, and you can trigger a refresh for a scope on demand.
Filtering
Two ways to narrow a result set:
- Field filters — pick a field, operator and value (eq, contains, in, and more) per the service's filterable fields.
- Natural-language — describe what you want ("all instances with a public IP in us-east-1") and it generates the structured filter for you.
Relationship filters
Beyond a single service, you can filter resources by their connections — for example, EC2 instances that use a security group where open ingress is true, matched across one to several hops through the graph. Relationships are derived from declarative catalog rules and are account-scoped.
Accounts & collection
Inventory collects only the accounts configured on the Accounts page (the application account is auto-collected only when none are configured). If a query returns nothing unexpectedly, confirm the account and region are configured and have been collected — an empty result is often a collection scope issue, not a missing resource.
Powering automation
The inventory graph is what an automation rule's resource gate evaluates against, and what runbooks use to resolve graph-relative action targets (for example, from a triggering volume to the instance that attaches it). Keeping inventory fresh makes gated rules match precisely instead of failing open.
💡 Tip
Use natural-language filters to draft a query quickly, then open the generated structured filter to fine-tune operators and values.
ℹ️ Note
Graph edges are intra-account and derived from catalog rules that are re-applied on every deploy, so relationship queries stay consistent as the catalog evolves.