Cloud Discovery

Discovery Architecture

StackFlow Cloud Discovery automatically populates the CMDB with resources from AWS, Azure, and GCP cloud accounts. Discovery runs as a scheduled Lambda function that calls each cloud provider's asset API to enumerate resources, then upserts CI records in Aurora and edges in the Neptune graph. Discovery is non-invasive — it uses read-only API credentials and makes no changes to cloud resources.

AWS Discovery

AWS discovery uses AWS Config (for resource inventory) and AWS Systems Manager (for server details). The minimum required IAM permissions are read-only access to Config, Systems Manager, EC2, RDS, Lambda, ELB, S3, VPC, and CloudWatch.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "config:List*", "config:Describe*", "config:Get*",
      "ec2:Describe*", "rds:Describe*", "lambda:List*", "lambda:Get*",
      "elasticloadbalancing:Describe*", "s3:ListAllMyBuckets", "s3:GetBucketLocation",
      "cloudwatch:GetMetricData", "ssm:List*", "ssm:Describe*"
    ],
    "Resource": "*"
  }]
}

Azure Discovery

Azure discovery uses the Azure Resource Manager API with a service principal that has the Reader role on the target subscription(s). Provide the service principal credentials (tenant ID, client ID, client secret) in Admin → Cloud Accounts → Add Azure Account. The credentials are stored in AWS Secrets Manager.

az ad sp create-for-rbac --name "StackFlow-Discovery-SP"   --role Reader   --scopes /subscriptions/{subscription-id}   --sdk-auth

GCP Discovery

GCP discovery uses the Cloud Asset Inventory API with a service account that has the cloudasset.viewer IAM role. Export the service account key JSON and store it in AWS Secrets Manager via the StackFlow admin console at Admin → Cloud Accounts → Add GCP Account.

Scheduling Discovery

Discovery schedules are configured per cloud account in Admin → Cloud Accounts → Discovery Schedule. Default schedule is every 6 hours for full discovery and every 15 minutes for change-event-triggered updates. EventBridge rules trigger the discovery Lambda on AWS Config change events for near-real-time CMDB accuracy.