Every AWS resource type, classified.
Omnitam discovers 84 resource types across 30 AWS services. Each is a Managed Resource Unit (MRU), classified as an Asset, a Configuration Item, or both, with resource-tag support noted per type.
The AWS capabilities matrix.
Discovery covers 84 resource types across 30 AWS services: 39 classified as Assets and 45 as Configuration Items. 72 support resource tags; 12 do not, so a tag filter must skip them rather than drop them.
| Service | Resource type | Classification | Tags |
|---|---|---|---|
| ACM | acm:certificate | Asset | Yes |
| API Gateway | apigateway:rest-api | CI | Yes |
| API Gateway | apigateway:resource | CI | No |
| API Gateway | apigateway:integration | CI | No |
| API Gateway v2 | apigatewayv2:api | CI | Yes |
| API Gateway v2 | apigatewayv2:integration | CI | No |
| Auto Scaling | autoscaling:group | CI | Yes |
| CloudFormation | cloudformation:stack | CI | Yes |
| CloudFormation | cloudformation:stack-set | CI | Yes |
| CloudFormation | cloudformation:drift | CI | No |
| CloudFront | cloudfront:distribution | Asset | Yes |
| CloudWatch | cloudwatch:composite-alarm | CI | Yes |
| CloudWatch | cloudwatch:metric-alarm | CI | Yes |
| DynamoDB | dynamodb:table | Asset | Yes |
| EC2 | ec2:instance | Asset | Yes |
| EC2 | ec2:vpc | CI | Yes |
| EC2 | ec2:subnet | CI | Yes |
| EC2 | ec2:security-group | CI | Yes |
| EC2 | ec2:route-table | CI | Yes |
| EC2 | ec2:nat-gateway | Asset | Yes |
| EC2 | ec2:internet-gateway | CI | Yes |
| EC2 | ec2:vpc-endpoint | Asset | Yes |
| EC2 | ec2:vpc-peering | CI | Yes |
| EC2 | ec2:transit-gateway | Asset | Yes |
| EC2 | ec2:transit-gateway-route-table | CI | Yes |
| EC2 | ec2:key-pair | CI | Yes |
| EC2 | ec2:launch-template | CI | Yes |
| EC2 | ec2:launch-template-version | CI | No |
| EC2 (EBS) | ec2:volume | Asset | Yes |
| EC2 (EBS) | ec2:snapshot | Asset | Yes |
| EC2 | ec2:ami | Asset | Yes |
| EC2 | ec2:network-interface | CI | Yes |
| EC2 | ec2:elastic-ip | Asset | Yes |
| ECS | ecs:cluster | CI | Yes |
| ECS | ecs:service | CI | Yes |
| ECS | ecs:task-definition | CI | Yes |
| EKS | eks:cluster | Asset | Yes |
| EKS | eks:nodegroup | Asset | Yes |
| EKS | eks:fargate-profile | CI | Yes |
| ElastiCache | elasticache:cluster | Asset | Yes |
| ElastiCache | elasticache:replication-group | Asset | Yes |
| ElastiCache | elasticache:serverless-cache | Asset | Yes |
| ElastiCache | elasticache:subnet-group | CI | Yes |
| ELB (classic) | elb:classic | Asset | Yes |
| ELBv2 (ALB) | elbv2:application | Asset | Yes |
| ELBv2 (NLB) | elbv2:network | Asset | Yes |
| ELBv2 (GWLB) | elbv2:gateway | Asset | Yes |
| ELBv2 | elbv2:listener | CI | Yes |
| ELBv2 | elbv2:target-group | CI | Yes |
| GuardDuty | guardduty:detector | CI | Yes |
| IAM | iam:user | Asset | Yes |
| IAM | iam:role | CI | Yes |
| IAM | iam:group | CI | No |
| IAM | iam:policy | CI | Yes |
| IAM | iam:instance-profile | CI | Yes |
| IAM | iam:saml-provider | CI | Yes |
| IAM | iam:oidc-provider | CI | Yes |
| IAM | iam:server-certificate | Asset | Yes |
| MSK | kafka:provisioned | Asset | Yes |
| MSK | kafka:serverless | Asset | Yes |
| KMS | kms:key | Asset | Yes |
| KMS | kms:grant | CI | No |
| Lambda | lambda:function | Asset | Yes |
| CloudWatch Logs | logs:log-group | Asset | Yes |
| CloudWatch Logs | logs:subscription-filter | CI | No |
| RDS | rds:aurora-postgres | Asset | Yes |
| RDS | rds:aurora-mysql | Asset | Yes |
| RDS | rds:cluster | Asset | Yes |
| RDS | rds:db-instance | Asset | Yes |
| RDS | rds:db-proxy | Asset | Yes |
| Route 53 | route53:hosted-zone | Asset | Yes |
| Route 53 | route53:record-set | CI | No |
| Route 53 | route53:health-check | Asset | Yes |
| S3 | s3:bucket | Asset | Yes |
| Secrets Manager | secretsmanager:secret | Asset | Yes |
| Security Hub | securityhub:hub | CI | Yes |
| Security Hub | securityhub:standards-subscription | CI | No |
| SNS | sns:topic | Asset | Yes |
| SNS | sns:subscription | CI | No |
| EventBridge | events:rule | CI | Yes |
| EventBridge | events:event-bus | CI | Yes |
| SQS | sqs:queue | Asset | Yes |
| Step Functions | stepfunctions:state-machine | Asset | Yes |
| Account (synthetic) | account:information | CI | No |
How resources reach the inventory.
Discovery draws on five complementary ingestion paths, or lanes. Each observes your AWS accounts a different way and carries its own value; together they keep the inventory both fast to update and complete.
CloudTrail management events near-real-time trigger
A mutating API call in a connected account forwards cross-account within seconds and triggers a scoped re-scan of just what changed. Value: the fastest signal that something changed.
CloudTrail read reconcile
A periodic pull of recent management events, independent of live forwarding. Value: catches changes if live forwarding is off, or if a forwarded event was missed.
AWS Config configuration items event · tier-1
On every change, AWS Config emits a full configuration item; Omnitam ingests that item itself as the data, with no API round-trip back to the account. Value: authoritative per-resource state, including relationships.
AWS Config read history reconcile
An hourly pull of Config history for the in-scope resource types. Value: backfills anything the Config event lane did not deliver.
Direct scan scheduled inventory
A scheduled list/describe sweep of every in-scope service. Value: authoritative enumeration plus soft-delete reconciliation, so deletions are caught — the always-on backstop that works even when none of the lanes above are available.
See your own CI and Asset counts.
Connect one AWS account read-only and watch every resource classify itself, Asset, CI, or both, in under an hour.