Multi-cloud honesty

Service coverage

Every individual service across Azure, AWS, GCP, Kubernetes, identity systems, and hybrid connectivity — with a fully / partially / planned / not-supported grade per capability. We do not pretend coverage we haven't built. See the guide.

Executive Engineer Architect

Cloud:all azure aws gcp kubernetes saas onprem

Status:all Production-quality Common case covered Synthesised from adjacent data Planned Not in scope

Enhanced by:all wiz dynatrace datadog crowdstrike veracode

Legend:●Production-quality◐Common case covered◔Synthesised from adjacent data○Planned✕Not in scope

Service	Cloud	Disc	Inv	Topo	Sec	Net	IAM	Obs	$	Recs	Notes
EC2 aws.compute.ec2	aws	◐	◐	○	○	✕	○	○	◐	○
Auto Scaling Groups aws.compute.asg	aws	◐	◐	○	○	✕	○	○	◐	○
ECS aws.compute.ecs	aws	◐	◐	○	○	✕	○	○	◐	○
EKS aws.compute.eks	aws	◐	◐	○	○	✕	○	○	◐	○	Gap: In-cluster object inventory needs the Kubernetes connector with kubeconfig.
Fargate aws.compute.fargate	aws	◐	◐	○	○	✕	○	○	◐	○
Lambda aws.compute.lambda	aws	◐	◐	○	○	✕	○	○	◐	◐	awsLambdaVpc playbook exists for VPC + IAM posture.
Batch aws.compute.batch	aws	◐	◐	○	○	✕	○	○	◐	○
App Runner aws.compute.apprunner	aws	◐	◐	○	○	✕	○	○	◐	○
VPC aws.network.vpc	aws	◐	◐	○	○	✕	○	○	◐	○
Subnet aws.network.subnet	aws	◐	◐	○	○	✕	○	○	◐	○
Security Group aws.network.sg	aws	◐	◐	○	○	✕	○	○	◐	◐	awsSgBroadSource playbook computes SG tier + flags 0.0.0.0/0 ingress.
Network ACL aws.network.nacl	aws	◐	◐	○	○	✕	○	○	◐	○
Route Table aws.network.routetable	aws	◐	◐	○	○	✕	○	○	◐	○
Internet Gateway aws.network.igw	aws	◐	◐	○	○	✕	○	○	◐	○
NAT Gateway aws.network.natgw	aws	◐	◐	○	○	✕	○	○	◐	○
Transit Gateway aws.network.tgw	aws	◐	◐	○	○	✕	○	○	◐	○
VPN Gateway aws.network.vpngw	aws	◐	◐	○	○	✕	○	○	◐	○
Direct Connect aws.network.directconnect	aws	◐	◐	○	○	✕	○	○	◐	○
ELB (classic) aws.network.elb	aws	◐	◐	○	○	✕	○	○	◐	○
Application Load Balancer aws.network.alb	aws	◐	◐	○	○	✕	○	○	◐	○
Network Load Balancer aws.network.nlb	aws	◐	◐	○	○	✕	○	○	◐	○
CloudFront aws.network.cloudfront	aws	◐	◐	○	○	✕	○	○	◐	○
Route 53 aws.network.route53	aws	◐	◐	○	○	✕	○	○	◐	○
PrivateLink aws.network.privatelink	aws	◐	◐	○	○	✕	○	○	◐	○
S3 aws.storage.s3	aws	◐	◐	○	○	✕	○	○	◐	◐	awsS3CrossAccount playbook computes cross-account access + Block Public Access posture.
EBS aws.storage.ebs	aws	◐	◐	○	○	✕	○	○	◐	○
EFS aws.storage.efs	aws	◐	◐	○	○	✕	○	○	◐	○
FSx aws.storage.fsx	aws	◐	◐	○	○	✕	○	○	◐	○
S3 Glacier aws.storage.glacier	aws	◐	◐	○	○	✕	○	○	◐	○
RDS aws.db.rds	aws	◐	◐	○	○	✕	○	○	◐	◐	awsRdsPublic playbook detects publicly-accessible instances.
Aurora aws.db.aurora	aws	◐	◐	○	○	✕	○	○	◐	○
DynamoDB aws.db.dynamodb	aws	◐	◐	○	○	✕	○	○	◐	○
ElastiCache aws.db.elasticache	aws	◐	◐	○	○	✕	○	○	◐	○
DocumentDB aws.db.documentdb	aws	◐	◐	○	○	✕	○	○	◐	○
Neptune aws.db.neptune	aws	◐	◐	○	○	✕	○	○	◐	○
Redshift aws.db.redshift	aws	◐	◐	○	○	✕	○	○	◐	○
OpenSearch aws.db.opensearch	aws	◐	◐	○	○	✕	○	○	◐	○
IAM aws.identity.iam	aws	◐	◐	○	○	✕	◐	○	◐	◐	Role/Policy/User enumeration native via IAM API; least-privilege analyzer roadmap.
Cognito aws.identity.cognito	aws	◐	◐	○	○	✕	○	○	◐	○
AWS SSO / IAM Identity Center aws.identity.sso	aws	◐	◐	○	○	✕	○	○	◐	○
Secrets Manager aws.identity.secretsmanager	aws	◐	◐	○	○	✕	○	○	◐	○
KMS aws.identity.kms	aws	◐	◐	○	○	✕	○	○	◐	○
Security Hub aws.security.securityhub	aws	◐	◐	○	◐	✕	○	○	◐	○	Finding ingestion stub exists; full enrichment roadmap.
GuardDuty aws.security.guardduty	aws	◐	◐	○	○	✕	○	○	◐	○
Inspector aws.security.inspector	aws	◐	◐	○	○	✕	○	○	◐	○
Macie aws.security.macie	aws	◐	◐	○	○	✕	○	○	◐	○
Detective aws.security.detective	aws	◐	◐	○	○	✕	○	○	◐	○
AWS Config aws.security.config	aws	◐	◐	○	◐	✕	○	○	◐	○
CloudTrail aws.security.cloudtrail	aws	◐	◐	○	○	✕	○	○	◐	○
WAF aws.security.waf	aws	◐	◐	○	○	✕	○	○	◐	○
Shield aws.security.shield	aws	◐	◐	○	○	✕	○	○	◐	○
Firewall Manager aws.security.firewallmgr	aws	◐	◐	○	○	✕	○	○	◐	○
CloudWatch Metrics aws.obs.cloudwatch	aws	◐	◐	○	○	✕	○	◐	◐	○
CloudWatch Logs aws.obs.cwlogs	aws	◐	◐	○	○	✕	○	◐	◐	○
X-Ray aws.obs.xray	aws	◐	◐	○	○	✕	○	○	◐	○
EventBridge aws.obs.eventbridge	aws	◐	◐	○	○	✕	○	○	◐	○
SQS aws.integration.sqs	aws	◐	◐	○	○	✕	○	○	◐	○
SNS aws.integration.sns	aws	◐	◐	○	○	✕	○	○	◐	○
Step Functions aws.integration.stepfn	aws	◐	◐	○	○	✕	○	○	◐	○
API Gateway aws.integration.apigw	aws	◐	◐	○	○	✕	○	○	◐	○
AppSync aws.integration.appsync	aws	◐	◐	○	○	✕	○	○	◐	○
Organizations aws.mgmt.organizations	aws	◐	◐	○	○	✕	○	○	◐	○
Control Tower aws.mgmt.controltower	aws	◐	◐	○	○	✕	○	○	◐	○
Service Catalog aws.mgmt.servicecatalog	aws	◐	◐	○	○	✕	○	○	◐	○
CloudFormation aws.mgmt.cfn	aws	◐	◐	○	○	✕	○	○	◐	○
Systems Manager aws.mgmt.ssm	aws	◐	◐	○	○	✕	○	○	◐	○
ECR aws.devops.ecr	aws	◐	◐	○	○	✕	○	○	◐	○
CodeBuild aws.devops.codebuild	aws	◐	◐	○	○	✕	○	○	◐	○
CodePipeline aws.devops.codepipeline	aws	◐	◐	○	○	✕	○	○	◐	○
CodeArtifact aws.devops.codeartifact	aws	◐	◐	○	○	✕	○	○	◐	○

Read-only and advisory by design — we never modify cloud resources. The grades describe what we can observe, not what we can change.