Capabilities

Every AWS resource type, classified.

Omnitam discovers 84 resource types across 30 AWS services. Each is a Managed Resource Unit (MRU), classified as an Asset, a Configuration Item, or both, with resource-tag support noted per type.

AWS coverage

The AWS capabilities matrix.

Discovery covers 84 resource types across 30 AWS services: 39 classified as Assets and 45 as Configuration Items. 72 support resource tags; 12 do not, so a tag filter must skip them rather than drop them.

ServiceResource typeClassificationTags
ACMacm:certificateAssetYes
API Gatewayapigateway:rest-apiCIYes
API Gatewayapigateway:resourceCINo
API Gatewayapigateway:integrationCINo
API Gateway v2apigatewayv2:apiCIYes
API Gateway v2apigatewayv2:integrationCINo
Auto Scalingautoscaling:groupCIYes
CloudFormationcloudformation:stackCIYes
CloudFormationcloudformation:stack-setCIYes
CloudFormationcloudformation:driftCINo
CloudFrontcloudfront:distributionAssetYes
CloudWatchcloudwatch:composite-alarmCIYes
CloudWatchcloudwatch:metric-alarmCIYes
DynamoDBdynamodb:tableAssetYes
EC2ec2:instanceAssetYes
EC2ec2:vpcCIYes
EC2ec2:subnetCIYes
EC2ec2:security-groupCIYes
EC2ec2:route-tableCIYes
EC2ec2:nat-gatewayAssetYes
EC2ec2:internet-gatewayCIYes
EC2ec2:vpc-endpointAssetYes
EC2ec2:vpc-peeringCIYes
EC2ec2:transit-gatewayAssetYes
EC2ec2:transit-gateway-route-tableCIYes
EC2ec2:key-pairCIYes
EC2ec2:launch-templateCIYes
EC2ec2:launch-template-versionCINo
EC2 (EBS)ec2:volumeAssetYes
EC2 (EBS)ec2:snapshotAssetYes
EC2ec2:amiAssetYes
EC2ec2:network-interfaceCIYes
EC2ec2:elastic-ipAssetYes
ECSecs:clusterCIYes
ECSecs:serviceCIYes
ECSecs:task-definitionCIYes
EKSeks:clusterAssetYes
EKSeks:nodegroupAssetYes
EKSeks:fargate-profileCIYes
ElastiCacheelasticache:clusterAssetYes
ElastiCacheelasticache:replication-groupAssetYes
ElastiCacheelasticache:serverless-cacheAssetYes
ElastiCacheelasticache:subnet-groupCIYes
ELB (classic)elb:classicAssetYes
ELBv2 (ALB)elbv2:applicationAssetYes
ELBv2 (NLB)elbv2:networkAssetYes
ELBv2 (GWLB)elbv2:gatewayAssetYes
ELBv2elbv2:listenerCIYes
ELBv2elbv2:target-groupCIYes
GuardDutyguardduty:detectorCIYes
IAMiam:userAssetYes
IAMiam:roleCIYes
IAMiam:groupCINo
IAMiam:policyCIYes
IAMiam:instance-profileCIYes
IAMiam:saml-providerCIYes
IAMiam:oidc-providerCIYes
IAMiam:server-certificateAssetYes
MSKkafka:provisionedAssetYes
MSKkafka:serverlessAssetYes
KMSkms:keyAssetYes
KMSkms:grantCINo
Lambdalambda:functionAssetYes
CloudWatch Logslogs:log-groupAssetYes
CloudWatch Logslogs:subscription-filterCINo
RDSrds:aurora-postgresAssetYes
RDSrds:aurora-mysqlAssetYes
RDSrds:clusterAssetYes
RDSrds:db-instanceAssetYes
RDSrds:db-proxyAssetYes
Route 53route53:hosted-zoneAssetYes
Route 53route53:record-setCINo
Route 53route53:health-checkAssetYes
S3s3:bucketAssetYes
Secrets Managersecretsmanager:secretAssetYes
Security Hubsecurityhub:hubCIYes
Security Hubsecurityhub:standards-subscriptionCINo
SNSsns:topicAssetYes
SNSsns:subscriptionCINo
EventBridgeevents:ruleCIYes
EventBridgeevents:event-busCIYes
SQSsqs:queueAssetYes
Step Functionsstepfunctions:state-machineAssetYes
Account (synthetic)account:informationCINo
Discovery pipeline

How resources reach the inventory.

Discovery draws on five complementary ingestion paths, or lanes. Each observes your AWS accounts a different way and carries its own value; together they keep the inventory both fast to update and complete.

CloudTrail management events near-real-time trigger

A mutating API call in a connected account forwards cross-account within seconds and triggers a scoped re-scan of just what changed. Value: the fastest signal that something changed.

CloudTrail read reconcile

A periodic pull of recent management events, independent of live forwarding. Value: catches changes if live forwarding is off, or if a forwarded event was missed.

AWS Config configuration items event · tier-1

On every change, AWS Config emits a full configuration item; Omnitam ingests that item itself as the data, with no API round-trip back to the account. Value: authoritative per-resource state, including relationships.

AWS Config read history reconcile

An hourly pull of Config history for the in-scope resource types. Value: backfills anything the Config event lane did not deliver.

Direct scan scheduled inventory

A scheduled list/describe sweep of every in-scope service. Value: authoritative enumeration plus soft-delete reconciliation, so deletions are caught — the always-on backstop that works even when none of the lanes above are available.

Best with every lane enabled — and built to degrade gracefully without them. Some accounts won't offer all five: AWS Config may not be enabled, or there may be no organization CloudTrail. Omnitam has controls for each absence. Hybrid connectors fall back to polling, the Direct sweep is the always-on backstop, and Config-read backfills whenever Config events aren't forwarded. Missing one lane never means missing inventory — only slightly higher update latency.
Why near-real-time, not instantaneous. Each lane is bounded by AWS's own emission cadence. CloudTrail management events forward within seconds; AWS Config configuration items lag seconds to minutes, covering Config's own record-and-deliver time; the Config-read reconcile runs hourly; and the Direct sweep runs on its schedule. Updates are therefore near-real-time — as fast as AWS emits the underlying signal, which Omnitam cannot make instantaneous.

See your own CI and Asset counts.

Connect one AWS account read-only and watch every resource classify itself, Asset, CI, or both, in under an hour.

84 resource types 30 AWS services Agentless, read-only