Multi-cloud honesty

Service coverage

Every individual service across Azure, AWS, GCP, Kubernetes, identity systems, and hybrid connectivity — with a fully / partially / planned / not-supported grade per capability. We do not pretend coverage we haven't built. See the guide.

Executive Engineer Architect

Cloud:all azure aws gcp kubernetes saas onprem

Status:all Production-quality Common case covered Synthesised from adjacent data Planned Not in scope

Enhanced by:all wiz dynatrace datadog crowdstrike veracode

Legend:●Production-quality◐Common case covered◔Synthesised from adjacent data○Planned✕Not in scope

Service	Cloud	Disc	Inv	Topo	Sec	Net	IAM	Obs	$	Recs	Notes
Active Directory Federation Services (ADFS) identity.adfs	onprem	○	○	○	○	✕	○	◐	✕	○	Discovery: Read Entra federation settings (we infer ADFS presence from external federation config). Auth: n/a — read Entra side only. Reads: Federation trust metadata, claim mappings. Gap: We do not read ADFS server directly; on-prem agent would be required for full posture.
Active Directory (on-prem) identity.active_directory	onprem	○	○	○	○	✕	○	◐	✕	○	Discovery: Azure AD Connect sync state via Entra; on-prem LDAP optional via agent. Auth: Read sync state from Entra; on-prem agent for direct read. Reads: Hybrid join state, sync errors, stale objects (via Entra sync metrics). Gap: Direct AD attribute read requires deploying an on-prem agent; not in Tranche A.
LDAP / OpenLDAP identity.ldap	onprem	○	○	○	○	✕	○	◐	✕	○	Discovery: LDAP bind (on-prem connector or jump host). Auth: Bind DN + service-account password. Reads: OU tree, user/group attributes. Gap: Requires network reachability + service account; reference-class only.
ExpressRoute (Azure) hybrid.azure.expressroute	onprem	◐	◐	◐	○	◐	✕	○	✕	○	Azure side discovered via Resource Graph; hybridConnectivity playbook validates the chain. On-prem peer + carrier device not visible.
VPN Gateway (Azure) hybrid.azure.vpngateway	onprem	◐	◐	◐	○	◐	✕	○	✕	○	Azure side discovered. On-prem peer requires CMDB or agent.
Direct Connect (AWS) hybrid.aws.directconnect	onprem	◐	◐	◐	○	◐	✕	○	✕	○	AWS side enumerable via aiobotocore. On-prem peer not visible.
Site-to-Site VPN (AWS) hybrid.aws.sitevpn	onprem	◐	◐	◐	○	◐	✕	○	✕	○	Tunnel state visible AWS-side.
Cloud Interconnect (GCP) hybrid.gcp.interconnect	onprem	◐	◐	◐	○	◐	✕	○	✕	○	GCP side enumerable via google-cloud-resource-manager.
Cloud VPN (GCP) hybrid.gcp.cloudvpn	onprem	◐	◐	◐	○	◐	✕	○	✕	○	GCP side enumerable.
Hybrid DNS resolution hybrid.dns.resolver	onprem	◐	◐	◐	○	◐	✕	○	✕	○	Private DNS Zones (Azure/AWS/GCP) plus conditional forwarders. Resolution chain validated end-to-end by privateEndpointImpact playbook for Azure only.
Identity federation hybrid.identity.federation	onprem	◐	◐	◐	○	◐	✕	○	✕	○	Entra ↔ ADFS / Entra ↔ Okta / Entra ↔ Ping. Discovery requires reading Entra federation settings + the peer IdP via its API.
ServiceNow CMDB hybrid.cmdb.servicenow	onprem	◐	◐	◐	○	◐	✕	○	✕	○	Business services from cmdb_ci_service ingested. Reconciliation against live cloud inventory is roadmap.
Webhook integration bridge hybrid.webhook.bridge	onprem	◐	◐	◐	○	◐	✕	○	✕	○	Outbound webhooks fire on recommendation status changes. Inbound webhooks (receiving from external systems) are roadmap.

Read-only and advisory by design — we never modify cloud resources. The grades describe what we can observe, not what we can change.