Omnitam records everything and turns it into answers.
Every account and region, with owners, history and evidence, from one read-only role. AWS already records all of this; here is what Omnitam adds on top.
What AWS gives you, how Omnitam connects, what Omnitam adds.
| AWS gives you | How Omnitam connects | What Omnitam adds |
|---|---|---|
| Organizations (the account list) | Read-only role, or StackSets across OUs | One inventory across all accounts and regions |
| Describe/List APIs and tags | ExternalId; secret and data reads denied | 84 types, 47 relationship types, blast radius, owners |
| Config, EventBridge, CloudTrail | Optional change-event stack per region | Rebuild-proof history, plus who changed what |
| SSM Inventory, ECR, AMIs | Opt-in SBOM permissions | Installed software, no agent; trace a library to hosts |
From raw material to answers.
Every account, one inventory
Connect with one read-only role per account, via CloudFormation, Terraform, or StackSets across whole OUs. New accounts are picked up every 6 hours when you add a role in the management account.
84 resource types, 47 relationship types
Omnitam discovers 84 AWS resource types across 30 services and maps 47 relationship types, giving you blast radius. Ownership rules apply your tags, and unowned resources are flagged. See the capabilities guide.
History that survives rebuilds
An optional change-event stack per region adds change events as they happen. History survives auto-scaling-group and launch-template rebuilds, and shows who changed what. History starts when the account is connected.
Installed software, no agent
With opt-in SBOM permissions, Omnitam lists installed software from SSM Inventory, ECR and machine images without an Omnitam agent, and traces a library to the hosts running it.
Least privilege you can read.
SecurityAudit-based policy · explicit deny on secret and data reads · ExternalId · every session in your own CloudTrail. The connect wizard offers three policy levels (Managed, recommended; Verb-driven; Explicit), as CloudFormation or Terraform, so your security team can read every line before anyone clicks. How the access model works →
Omnitam works alongside AWS Config, Security Hub and Audit Manager. It doesn’t replace them.
Works alongside AWS Config, Security Hub and Audit Manager.
Size your estate first with the free count script: read-only, AWS Config optional.