---
agentTools:
  projectIndex: https://regscale.readme.io/llms.txt
---

# Asset Inventory

# AWS Asset Inventory

## Overview

AWS Asset Inventory integration - `regscale aws sync_assets` - collects comprehensive AWS resource inventory across compute, storage, networking, and security services. This integration provides complete asset visibility for compliance, security posture management, and resource tracking.

## Command Syntax

```bash
regscale aws sync_assets [OPTIONS]
regscale aws inventory collect [OPTIONS]
```

## Basic Usage

### Sync All AWS Assets to RegScale

```bash
regscale aws sync_assets --regscale-id 123
```

### Sync Assets with Filtering

```bash
# Filter by AWS account
regscale aws sync_assets \
  --regscale-id 123 \
  --account-id 123456789012

# Filter by tags
regscale aws sync_assets \
  --regscale-id 123 \
  --tags Environment=production,Team=security

# Combine filters
regscale aws sync_assets \
  --regscale-id 123 \
  --account-id 123456789012 \
  --tags Environment=production
```

### Collect Inventory to JSON File

```bash
# Export inventory to file
regscale aws inventory collect \
  --output inventory.json

# With filtering
regscale aws inventory collect \
  --tags Environment=production \
  --output prod-inventory.json
```

## Supported AWS Services

The AWS inventory collector provides comprehensive information about **\~78 AWS Services** across 12 categories with universal account and tag filtering support.

### Compute Services (8 services)

* **EC2 (Elastic Compute Cloud)** - Instances, AMIs, snapshots, volumes
* **Lambda** - Functions, layers, aliases
* **ECS (Elastic Container Service)** - Clusters, services, task definitions
* **AWS Batch**  - Compute environments, job queues, job definitions
* **App Runner**  - Services, configurations, deployments
* **Elastic Beanstalk**  - Applications, environments, configurations
* **Amazon Lightsail**  - Instances, containers, databases
* **Systems Manager** - Managed instances, patch compliance, parameters

### Storage Services (6 services)

* **S3 (Simple Storage Service)** - Buckets, encryption, versioning, logging
* **EBS (Elastic Block Store)** - Volumes, snapshots, encryption status
* **Amazon EFS**  - File systems, mount targets, performance modes
* **Amazon FSx**  - File systems for Windows, Lustre, NetApp ONTAP, OpenZFS
* **AWS Storage Gateway**  - Gateways, volumes, tape libraries
* **AWS Backup**  - Backup vaults, plans, recovery points

### Database Services (9 services)

* **RDS (Relational Database Service)** - Instances, engines, Multi-AZ, encryption
* **DynamoDB** - Tables, indexes, capacity units, encryption
* **Amazon ElastiCache**  - Redis and Memcached clusters
* **Amazon Neptune**  - Graph database clusters
* **Amazon DocumentDB**  - MongoDB-compatible clusters
* **Amazon Redshift** - Data warehouse clusters
* **Amazon Keyspaces**  - Cassandra-compatible keyspaces
* **Amazon Timestream**  - Time-series databases

### Networking & Content Delivery (11 services)

* **VPC (Virtual Private Cloud)** - VPCs, subnets, security groups, NACLs
* **Elastic IP** - Public IPs, allocation IDs
* **Load Balancers (ALB/NLB)** - Application and Network load balancers
* **CloudFront** - Distributions, origins, behaviors
* **Route 53** - Hosted zones, record sets, health checks
* **AWS Direct Connect** - Connections, virtual interfaces
* **Transit Gateway**  - Gateways, attachments, route tables
* **VPN Connections**  - Site-to-site VPNs, customer gateways
* **AWS Global Accelerator**  - Accelerators, listeners, endpoint groups
* **AWS Network Firewall**  - Firewalls, policies, rule groups
* **Route53 Resolver**  - Resolver endpoints, rules

### Security, Identity & Compliance (11 services)

* **IAM (Identity and Access Management)** - Users, roles, groups, policies
* **KMS (Key Management Service)** - Keys, aliases, rotation status
* **Secrets Manager** - Secrets, rotation configurations
* **WAF (Web Application Firewall)** - Web ACLs, IP sets, rule groups
* **ACM (Certificate Manager)** - SSL/TLS certificates, validation status
* **CloudTrail** - Trails, event selectors, log file validation
* **AWS Config** - Configuration recorders, rules, compliance status
* **GuardDuty** - Detectors, findings, threat intelligence
* **Security Hub** - Security standards, controls, findings
* **AWS Inspector** - Assessment templates, findings, vulnerability scans
* **AWS Audit Manager** - Assessments, frameworks, controls, evidence

### Analytics Services  (6 services)

* **Amazon EMR** - Clusters, instance groups, steps
* **Amazon Kinesis Data Streams** - Streams, shards, retention periods
* **Amazon Kinesis Firehose** - Delivery streams, destinations
* **AWS Glue** - Databases, tables, crawlers, jobs
* **Amazon Athena** - Workgroups, query executions
* **Amazon MSK (Managed Streaming for Kafka)** - Kafka clusters, brokers

### Machine Learning Services  (6 services)

* **Amazon SageMaker** - Inference endpoints, models, notebook instances
* **Amazon Rekognition** - Face collections, custom labels
* **Amazon Comprehend** - Custom model endpoints, entity recognizers

### Developer Tools  (4 services)

* **AWS CodePipeline** - Pipelines, stages, actions
* **AWS CodeBuild** - Build projects, environments, artifacts
* **AWS CodeDeploy** - Applications, deployment groups
* **AWS CodeCommit** - Repositories, branches, commits

### Application Services  (4 services)

* **AWS Step Functions** - State machines, executions
* **AWS AppSync** - GraphQL APIs, schemas, resolvers
* **Amazon WorkSpaces** - Virtual desktops, bundles
* **AWS IoT Core** - Things, certificates, policies, rules

### Application Integration (4 services)

* **API Gateway** - REST and HTTP APIs, stages, deployments
* **SNS (Simple Notification Service)** - Topics, subscriptions
* **SQS (Simple Queue Service)** - Queues, dead-letter queues
* **EventBridge (CloudWatch Events)** - Event buses, rules, targets

### Containers (1 service)

* **ECR (Elastic Container Registry)** - Repositories, images, image scanning

### Configuration Management (1 service)

* **AWS Config** - Configuration items, snapshots, compliance timeline

## Filtering Options

### Account ID Filtering

```bash
regscale aws sync_assets --regscale-id 3 --account-id 123456789012
```

### Tag Filtering

```bash
# Single tag
regscale aws sync_assets --regscale-id 3 --tags Environment=production

# Multiple tags (AND logic - all must match)
regscale aws sync_assets --regscale-id 3 \
    --tags Environment=production,Team=security,CostCenter=Engineering
```

### Combined Filtering

```bash
regscale aws sync_assets --regscale-id 3 \
    --account-id 123456789012 \
    --tags Environment=production,Compliance=required
```

**Note:** Tag filtering uses AND logic - all specified tags must match. Resources without tags are excluded when filtering by tags.

**Tag Requirements:**

* Tags are case-sensitive
* Resources without tags are excluded when filtering
* Use commas to separate tag pairs (no spaces)
* Format: `key1=value1,key2=value2`

### By Region

```bash
# Specific region
regscale aws sync_assets \
  --regscale_id 123 \
  --region us-west-2
```

**Note:** Most services are regional. Run for each region where resources exist.

## Cache Management

### Default Caching

Asset sync uses caching to improve performance and reduce AWS API costs:

* **Asset cache:** 8 hours
* **Service data cache:** 4 hours

### Force Refresh

Bypass cache to get fresh data:

```bash
regscale aws sync_assets \
  --regscale_id 123 \
  --force-refresh
```

**When to use `--force-refresh`:**

* Initial setup
* After major infrastructure changes
* Troubleshooting sync issues
* Compliance audit preparation

## What Gets Created in RegScale

### Asset Records

Each AWS resource becomes an asset in RegScale with:

**Core Fields:**

* **Name**: Resource name or ID
* **Asset Type**: Mapped to RegScale asset types (Server, Database, Storage, etc.)
* **Status**: Active, Inactive, or Decommissioned
* **ARN**: Full Amazon Resource Name
* **Asset Category**: Hardware or Software

**Metadata:**

* **Region**: AWS region
* **Account ID**: AWS account
* **Tags**: Resource tags from AWS
* **IP Address**: For compute resources
* **Configuration**: Service-specific details

**Compliance Fields:**

* **Other Tracking Number**: AWS ARN for unique identification
* **Date Created**: Resource creation date
* **Date Last Updated**: Last modification date
* **Parent ID**: Linked to Security Plan

**Relationships:**

* Linked to security findings
* Linked to compliance controls
* Linked to vulnerabilities

### Asset Types Mapping

| AWS Resource            | RegScale Asset Type  |
| ----------------------- | -------------------- |
| EC2 Instance            | Virtual Machine (VM) |
| RDS Instance            | Database             |
| S3 Bucket               | Storage              |
| Lambda Function         | Software/Application |
| Load Balancer           | Network Appliance    |
| CloudFront Distribution | Network Service      |
| IAM User                | Identity             |
| KMS Key                 | Security Control     |
| Security Group          | Firewall Rule        |

## Common Use Cases

### Use Case 1: Initial Asset Discovery

```bash
# First-time comprehensive inventory
regscale aws sync_assets \
  --regscale-id 123 \
  --force-refresh
```

### Use Case 2: Production Environment Inventory

```bash
# Tag-filtered production assets
regscale aws sync_assets \
  --regscale-id 123 \
  --tags Environment=production,CostCenter=Engineering
```

### Use Case 3: Compliance Boundary Assets

```bash
# FedRAMP ATO boundary
regscale aws sync_assets \
  --regscale-id 123 \
  --tags ATO=FedRAMP,Boundary=Moderate \
  --account-id 123456789012
```

### Use Case 4: Multi-Account Organization

```bash
# Account A - Production
regscale aws sync_assets \
  --regscale-id 123 \
  --account-id 111111111111 \
  --tags Environment=production \
  --profile account-a

# Account B - Staging
regscale aws sync_assets \
  --regscale-id 456 \
  --account-id 222222222222 \
  --tags Environment=staging \
  --profile account-b

# Account C - Development
regscale aws sync_assets \
  --regscale-id 789 \
  --account-id 333333333333 \
  --tags Environment=development \
  --profile account-c
```

### Use Case 5: Export for Offline Analysis

```bash
# Export inventory to JSON
regscale aws inventory collect \
  --tags Environment=production \
  --output prod-inventory-$(date +%Y%m%d).json
```

### Use Case 6: Team-Based Asset Management

```bash
# Security team assets
regscale aws sync_assets \
  --regscale-id 456 \
  --tags Team=security,Owner=security-lead

# Engineering team assets
regscale aws sync_assets \
  --regscale-id 789 \
  --tags Team=engineering,Owner=eng-lead
```

## Command Options Reference

| Option            | Description                           | Example                     |
| ----------------- | ------------------------------------- | --------------------------- |
| `--regscale-id`   | RegScale Security Plan ID (required)  | `--regscale-id 123`         |
| `--account-id`    | Filter by AWS account ID              | `--account-id 123456789012` |
| `--tags`          | Filter by resource tags               | `--tags Env=prod,Team=sec`  |
| `--region`        | AWS region                            | `--region us-east-1`        |
| `--force-refresh` | Bypass cache                          | `--force-refresh`           |
| `--profile`       | AWS profile name                      | `--profile production`      |
| `--output`        | Output file (for `inventory collect`) | `--output inventory.json`   |

## Best Practices

### 1. Tagging Strategy

* Tag all production resources with `Environment=production`
* Use `Compliance=Required` for compliance boundary resources
* Include `CostCenter`, `Owner`, `Team` tags for management
* Maintain consistent tag naming conventions

### 2. Initial Setup

```bash
# Run with force-refresh for initial sync
regscale aws sync_assets \
  --regscale-id 123 \
  --force-refresh

# Then run normally for updates
regscale aws sync_assets --regscale-id 123
```

### 3. Regular Updates

Schedule daily or weekly syncs:

```bash
#!/bin/bash
# Daily asset sync (cron: 0 1 * * *)

regscale aws sync_assets \
  --regscale-id 123 \
  --tags Environment=production
```

### 4. Multi-Region Coverage

```bash
# Sync all regions with resources
for region in us-east-1 us-west-2 eu-west-1; do
  regscale aws sync_assets \
    --regscale-id 123 \
    --region $region \
    --tags Environment=production
done
```

### 5. Performance Optimization

* Use tag filtering to reduce scope
* Cache is enabled by default (8 hours for assets)
* Target specific regions where resources exist
* Run during off-peak hours for large inventories

### 6. Compliance Tracking

```bash
# Define ATO boundary with tags
regscale aws sync_assets \
  --regscale-id 123 \
  --tags ATO=FedRAMP,Boundary=Moderate,Compliance=Required
```

## Enabled Services Configuration

The AWS integration uses the `init.yaml` configuration to control which services are enabled for inventory collection.

**Default Enabled Services:**

* ✅ Compute (EC2, Lambda, ECS, Systems Manager)
* ✅ Storage (S3, EBS)
* ✅ Database (RDS, DynamoDB)
* ✅ Networking (VPC, Load Balancers, CloudFront, Route 53)
* ✅ Security (IAM, KMS, Security Hub, Audit Manager)
* ✅ Integration (API Gateway, SNS, SQS, EventBridge)
* ✅ Containers (ECR)
* ✅ Management (Config)

To modify enabled services, edit `init.yaml`:

```yaml
aws:
  inventory:
    enabled_services:
      compute:
        enabled: true
        services:
          ec2: true
          lambda: true
          # ...
```

## Troubleshooting

### No Assets Returned

**Cause:** No resources or filters too restrictive.

**Solution:**

* Verify resources exist in AWS console
* Check tag values match exactly (case-sensitive)
* Try without filters: `regscale aws sync_assets --regscale_id 123`
* Use `--force-refresh` to bypass cache

### Missing Asset Types

**Cause:** Service not enabled in `init.yaml` or region-specific.

**Solution:**

* Check `init.yaml` for enabled services
* Verify resources are in the correct region
* Run with `--region` flag for specific regions

### Permission Errors

**Cause:** Insufficient IAM permissions.

**Solution:**

* Verify IAM user/role has read permissions for all services
* Use AWS `ReadOnlyAccess` managed policy
* Check for service control policies (SCPs) restrictions

### Cache Issues

**Cause:** Cached data outdated or corrupted.

**Solution:**

* Use `--force-refresh` to bypass cache
* Delete cache files if needed
* Check cache expiration settings