Multi-cloud honesty

Service coverage

Every individual service across Azure, AWS, GCP, Kubernetes, identity systems, and hybrid connectivity — with a fully / partially / planned / not-supported grade per capability. We do not pretend coverage we haven't built. See the guide.

Executive Engineer Architect

Cloud:all azure aws gcp kubernetes saas onprem

Status:all Production-quality Common case covered Synthesised from adjacent data Planned Not in scope

Enhanced by:all wiz dynatrace datadog crowdstrike veracode

Legend:●Production-quality◐Common case covered◔Synthesised from adjacent data○Planned✕Not in scope

Service	Cloud	Disc	Inv	Topo	Sec	Net	IAM	Obs	$	Recs	Notes
Azure Virtual Machines azure.compute.virtualmachines	azure	●	●	●	◐	●	◐	◐	●	●	NIC → Subnet → NSG join is native. Process telemetry is partial via Defender for Servers; full process tree needs CrowdStrike/Dynatrace agent.
Azure Kubernetes Service (AKS) azure.compute.aks	azure	●	●	●	◐	◐	◐	◐	●	●	Cluster surface + nodepool config is native. In-cluster object inventory (Pods, Services, NetworkPolicies) needs the Kubernetes connector with kubeconfig.
Storage Account azure.storage.account	azure	●	●	◐	◐	◐	◐	◐	●	●	Public network access + firewall rules + PE attachments visible. Data-plane scans (blob malware, sensitive data) need Defender for Storage; DSPM classification adds with Wiz.
Microsoft Entra ID azure.identity.entraid	azure	●	●	○	◐	✕	●	◐	●	●	Users, groups, app regs, service principals, role assignments via Graph + ARM RBAC.
Microsoft Defender for Cloud azure.security.defender	azure	●	●	○	●	✕	◐	◐	●	●	Findings + secure score + plans. Defender for Servers/Containers/Storage/SQL all surface via assessments.
Azure Container Registry azure.devops.acr	azure	●	●	○	◐	✕	◐	◐	●	○

Read-only and advisory by design — we never modify cloud resources. The grades describe what we can observe, not what we can change.