AWS Asset Inventory

Overview

AWS Asset Inventory integration - regscale aws sync_assets - collects comprehensive AWS resource inventory across compute, storage, networking, and security services. This integration provides complete asset visibility for compliance, security posture management, and resource tracking.

regscale aws inventory collect writes every supported service to a JSON file. regscale aws sync_assets creates RegScale assets only for these resource types:

• The AWS account
• Compute: EC2 instances, Lambda functions, EKS clusters
• Storage: S3 buckets, EBS volumes, EFS file systems
• Database: RDS instances, DynamoDB tables, Redshift clusters
• Networking: VPCs, security groups, load balancers
• Security: IAM users, KMS keys, ACM certificates, CloudTrail trails, GuardDuty detectors
• Other: ECR repositories, Athena workgroups, AWS Directory Service directories

Command Syntax

regscale aws sync_assets [OPTIONS]
regscale aws inventory collect [OPTIONS]

Basic Usage

Sync All AWS Assets to RegScale

regscale aws sync_assets --regscale-id 123

Sync Assets with Filtering

# Filter by AWS account
regscale aws sync_assets \
  --regscale-id 123 \
  --account-id 123456789012

# Filter by tags
regscale aws sync_assets \
  --regscale-id 123 \
  --tags Environment=production,Team=security

# Combine filters
regscale aws sync_assets \
  --regscale-id 123 \
  --account-id 123456789012 \
  --tags Environment=production

Collect Inventory to JSON File

# Export inventory to file
regscale aws inventory collect \
  --output inventory.json

# With filtering
regscale aws inventory collect \
  --tags Environment=production \
  --output prod-inventory.json

Supported AWS Services

The AWS inventory collector provides information about 72 AWS services across 13 categories with universal account and tag filtering support.

Compute Services (8 services)

• EC2 (Elastic Compute Cloud) - Instances, AMIs, snapshots, volumes
• Lambda - Functions, layers, aliases
• ECS (Elastic Container Service) - Clusters, services, task definitions
• AWS Batch - Compute environments, job queues, job definitions
• App Runner - Services, configurations, deployments
• Elastic Beanstalk - Applications, environments, configurations
• Amazon Lightsail - Instances, containers, databases
• Systems Manager - Managed instances, patch compliance, parameters

Storage Services (6 services)

• S3 (Simple Storage Service) - Buckets, encryption, versioning, logging
• EBS (Elastic Block Store) - Volumes, snapshots, encryption status
• Amazon EFS - File systems, mount targets, performance modes
• Amazon FSx - File systems for Windows, Lustre, NetApp ONTAP, OpenZFS
• AWS Storage Gateway - Gateways, volumes, tape libraries
• AWS Backup - Backup vaults, plans, recovery points

Database Services (9 services)

• RDS (Relational Database Service) - Instances, engines, Multi-AZ, encryption
• DynamoDB - Tables, indexes, capacity units, encryption
• Amazon ElastiCache - Redis and Memcached clusters
• Amazon Neptune - Graph database clusters
• Amazon DocumentDB - MongoDB-compatible clusters
• Amazon Redshift - Data warehouse clusters
• Amazon Keyspaces - Cassandra-compatible keyspaces
• Amazon Timestream - Time-series databases
• Amazon QLDB - Ledgers (off by default)

Networking & Content Delivery (11 services)

• VPC (Virtual Private Cloud) - VPCs, subnets, security groups, NACLs
• Elastic IP - Public IPs, allocation IDs
• Load Balancers (ALB/NLB) - Application and Network load balancers
• CloudFront - Distributions, origins, behaviors
• Route 53 - Hosted zones, record sets, health checks
• AWS Direct Connect - Connections, virtual interfaces
• Transit Gateway - Gateways, attachments, route tables
• VPN Connections - Site-to-site VPNs, customer gateways
• AWS Global Accelerator - Accelerators, listeners, endpoint groups
• AWS Network Firewall - Firewalls, policies, rule groups
• Route53 Resolver - Resolver endpoints, rules

Security, Identity & Compliance (11 services)

• IAM (Identity and Access Management) - Users, roles, groups, policies
• KMS (Key Management Service) - Keys, aliases, rotation status
• Secrets Manager - Secrets, rotation configurations
• WAF (Web Application Firewall) - Web ACLs, IP sets, rule groups
• ACM (Certificate Manager) - SSL/TLS certificates, validation status
• CloudTrail - Trails, event selectors, log file validation
• AWS Config - Configuration recorders, rules, compliance status
• GuardDuty - Detectors, findings, threat intelligence
• Security Hub - Security standards, controls, findings
• AWS Inspector - Assessment templates, findings, vulnerability scans
• AWS Audit Manager - Assessments, frameworks, controls, evidence

Analytics Services (6 services)

• Amazon EMR - Clusters, instance groups, steps
• Amazon Kinesis Data Streams - Streams, shards, retention periods
• Amazon Kinesis Firehose - Delivery streams, destinations
• AWS Glue - Databases, tables, crawlers, jobs
• Amazon Athena - Workgroups, query executions
• Amazon MSK (Managed Streaming for Kafka) - Kafka clusters, brokers

Machine Learning Services (6 services)

• Amazon SageMaker endpoints - Inference endpoints
• Amazon SageMaker models - Models
• Amazon SageMaker notebook instances - Notebook instances
• Amazon SageMaker training jobs - Training jobs
• Amazon Rekognition - Face collections, custom labels
• Amazon Comprehend - Custom model endpoints, entity recognizers

Developer Tools (4 services)

• AWS CodePipeline - Pipelines, stages, actions
• AWS CodeBuild - Build projects, environments, artifacts
• AWS CodeDeploy - Applications, deployment groups
• AWS CodeCommit - Repositories, branches, commits

Application Services (4 services)

• AWS Step Functions - State machines, executions
• AWS AppSync - GraphQL APIs, schemas, resolvers
• Amazon WorkSpaces - Virtual desktops, bundles
• AWS IoT Core - Things, certificates, policies, rules

Application Integration (4 services)

• API Gateway - REST and HTTP APIs, stages, deployments
• SNS (Simple Notification Service) - Topics, subscriptions
• SQS (Simple Queue Service) - Queues, dead-letter queues
• EventBridge (CloudWatch Events) - Event buses, rules, targets

Containers (2 services)

• ECR (Elastic Container Registry) - Repositories, images, image scanning
• Amazon EKS (Elastic Kubernetes Service) - Clusters

Directory Services (1 service)

• AWS Directory Service - Directories

Configuration Management

• AWS Config - Configuration recorders, recorder status, delivery channels, rules, compliance summary

Filtering Options

Account ID Filtering

regscale aws sync_assets --regscale-id 3 --account-id 123456789012

Tag Filtering

# Single tag
regscale aws sync_assets --regscale-id 3 --tags Environment=production

# Multiple tags (AND logic - all must match)
regscale aws sync_assets --regscale-id 3 \
    --tags Environment=production,Team=security,CostCenter=Engineering

Combined Filtering

regscale aws sync_assets --regscale-id 3 \
    --account-id 123456789012 \
    --tags Environment=production,Compliance=required

Note: Tag filtering uses AND logic - all specified tags must match. Resources without tags are excluded when filtering by tags.

Tag Requirements:

• Tags are case-sensitive
• Resources without tags are excluded when filtering
• Use commas to separate tag pairs
• Format: key1=value1,key2=value2

By Region

# Specific region
regscale aws sync_assets \
  --regscale_id 123 \
  --region us-west-2

Note: Most services are regional. Run for each region where resources exist. If you omit --region, the CLI uses the AWS_REGION environment variable, or us-east-1 if that variable is not set.

Cache Management

Default Caching

Asset sync uses caching to improve performance and reduce AWS API costs:

• Asset cache: 8 hours, in artifacts/aws/inventory.json

Note: The cache file is artifacts/aws/inventory.json under the folder you run the command from, or under artifactsDir when init.yaml sets it. The cache records the region, account ID, tags, profile, access key and enabled services of the run that collected it. A later run uses the cache only when all of these match and the cache is less than 8 hours old. Otherwise it collects again and replaces the cache.

Force Refresh

Bypass cache to get fresh data:

regscale aws sync_assets \
  --regscale_id 123 \
  --force-refresh

When to use --force-refresh:

• Initial setup
• After major infrastructure changes
• Troubleshooting sync issues
• Compliance audit preparation

What Gets Created in RegScale

Asset Records

Each AWS resource of a type listed in the Overview becomes an asset in RegScale with:

Core Fields:

• Name: Resource name or ID
• Asset Type: Mapped to RegScale asset types (see Asset Types Mapping)
• Status: Active (On Network) or Off-Network, from the state of the resource
• AWS Identifier: Full Amazon Resource Name
• Asset Category: Hardware or Software

Metadata:

• Region: AWS region
• IP Address: For compute resources
• Configuration: Service-specific details

Compliance Fields:

• Other Tracking Number: AWS ARN for unique identification
• Date Last Updated: Time of the sync
• Parent ID: Linked to Security Plan

Relationships:

• Linked to security findings
• Linked to vulnerabilities

Asset Types Mapping

An EC2 instance that runs a Palo Alto Networks VM-Series image (pa-vm-aws) is created as an Appliance.

Common Use Cases

Use Case 1: Initial Asset Discovery

# First-time comprehensive inventory
regscale aws sync_assets \
  --regscale-id 123 \
  --force-refresh

Use Case 2: Production Environment Inventory

# Tag-filtered production assets
regscale aws sync_assets \
  --regscale-id 123 \
  --tags Environment=production,CostCenter=Engineering

Use Case 3: Compliance Boundary Assets

# FedRAMP ATO boundary
regscale aws sync_assets \
  --regscale-id 123 \
  --tags ATO=FedRAMP,Boundary=Moderate \
  --account-id 123456789012

Use Case 4: Multi-Account Organization

# Account A - Production
regscale aws sync_assets \
  --regscale-id 123 \
  --account-id 111111111111 \
  --tags Environment=production \
  --profile account-a \
  --force-refresh

# Account B - Staging
regscale aws sync_assets \
  --regscale-id 456 \
  --account-id 222222222222 \
  --tags Environment=staging \
  --profile account-b \
  --force-refresh

# Account C - Development
regscale aws sync_assets \
  --regscale-id 789 \
  --account-id 333333333333 \
  --tags Environment=development \
  --profile account-c \
  --force-refresh

Use Case 5: Export for Offline Analysis

# Export inventory to JSON
regscale aws inventory collect \
  --tags Environment=production \
  --output prod-inventory-$(date +%Y%m%d).json

Use Case 6: Team-Based Asset Management

# Security team assets
regscale aws sync_assets \
  --regscale-id 456 \
  --tags Team=security,Owner=security-lead \
  --force-refresh

# Engineering team assets
regscale aws sync_assets \
  --regscale-id 789 \
  --tags Team=engineering,Owner=eng-lead \
  --force-refresh

Command Options Reference

Best Practices

1. Tagging Strategy

• Tag all production resources with Environment=production
• Use Compliance=Required for compliance boundary resources
• Include CostCenter, Owner, Team tags for management
• Maintain consistent tag naming conventions

2. Initial Setup

# Run with force-refresh for initial sync
regscale aws sync_assets \
  --regscale-id 123 \
  --force-refresh

# Then run normally for updates
regscale aws sync_assets --regscale-id 123

3. Regular Updates

Schedule daily or weekly syncs:

#!/bin/bash
# Daily asset sync (cron: 0 1 * * *)

regscale aws sync_assets \
  --regscale-id 123 \
  --tags Environment=production

4. Multi-Region Coverage

# Sync all regions with resources
for region in us-east-1 us-west-2 eu-west-1; do
  regscale aws sync_assets \
    --regscale-id 123 \
    --region $region \
    --tags Environment=production \
    --force-refresh
done

5. Performance Optimization

• Use tag filtering to reduce scope
• Cache is enabled by default (8 hours for assets)
• Target specific regions where resources exist
• Run during off-peak hours for large inventories

6. Compliance Tracking

# Define ATO boundary with tags
regscale aws sync_assets \
  --regscale-id 123 \
  --tags ATO=FedRAMP,Boundary=Moderate,Compliance=Required

Enabled Services Configuration

The AWS integration uses the init.yaml configuration to control which services are enabled for inventory collection. sync_assets and aws inventory collect both read this setting.

Default Enabled Services:

All services in Supported AWS Services are enabled by default, except Amazon QLDB. A category or service that init.yaml does not list stays enabled. To turn one off, set it to false.

The init.yaml template lists these categories:

• ✅ Compute (EC2, Lambda, ECS, Systems Manager)
• ✅ Storage (S3, EBS)
• ✅ Database (RDS, DynamoDB)
• ✅ Networking (VPC, Elastic IP, Load Balancers, CloudFront, Route 53)
• ✅ Security (IAM, KMS, Secrets Manager, WAF, ACM, CloudTrail, Config, GuardDuty, Security Hub, Inspector, Audit Manager)
• ✅ Integration (API Gateway, SNS, SQS, EventBridge)
• ✅ Containers (ECR)

To modify enabled services, edit init.yaml:

aws:
  inventory:
    enabled_services:
      compute:
        enabled: true
        services:
          ec2: true
          lambda: true
          # ...

Troubleshooting

No Assets Returned

Cause: No resources or filters too restrictive.

Solution:

• Verify resources exist in AWS console
• Check tag values match exactly (case-sensitive)
• Try without filters: regscale aws sync_assets --regscale_id 123
• Use --force-refresh to bypass cache

Missing Asset Types

Cause: The resource type is not one that sync_assets creates assets for, the service is turned off in init.yaml, the cache holds an earlier run, or the resources are in another region.

Solution:

• Check the resource types listed in the Overview
• Check init.yaml for disabled services
• Use --force-refresh to bypass cache
• Run with --region flag for specific regions

Permission Errors

Cause: Insufficient IAM permissions.

Solution:

• Verify IAM user/role has read permissions for all services
• Use AWS ReadOnlyAccess managed policy
• Check for service control policies (SCPs) restrictions

Cache Issues

Cause: Cached data outdated or corrupted.

Solution:

• Use --force-refresh to bypass cache
• Delete artifacts/aws/inventory.json under the folder you run the command from, or under artifactsDir, if needed