Skip to content

The AWS deep collector

Section 5 · From docs/INVENTORY_INTERNALS.md on GitHub

In this section

  • 5.1 Composition

    AWSDeepInventoryCollector is a stack of mixins on top of AsyncAWSCollector:

  • 5.2 The task registry

    collect() runs every task returned by _service_tasks() concurrently, each wrapped by _run_service_collector(name, coroutine) which records a ServiceCoverage...

  • 5.3 Service families and tasks

    The 133 tasks, their family (the value --services / --exclude-services accept besides task names), the module that implements them, and whether they run...

  • 5.4 collect() and sweep precedence

    AWSDeepInventoryCollector.collect() calls the base collect() and then deduplicates the breadth sweeps against the dedicated collectors in three tiers:

  • 5.5 Shared helpers (aws_services/_base.py)

    Module functions:

  • 5.6 AWS service modules

    What each module collects, the asset types it creates, and the (edge, relationship) pairs it declares (none = no asset type or no relationship). Generated...

  • 5.7 The Cloud Control sweep (aws_services/cloudcontrol.py)

    1. Discover listable types. _cc_listable_types() lists every CloudFormation resource type (cloudformation:ListTypes, public and AWS-provided) and describes...

  • 5.8 The Tagging API sweep

    _collect_tagging_sweep() pages through resourcegroupstaggingapi:GetResources, which returns every tagged resource of the region (AWS never returns...

  • 5.9 Kubernetes (kubernetes.py)

    For each ACTIVE EKS cluster with an endpoint (when Kubernetes mapping is enabled), the EKS collector calls collect_eks_workloads() in a worker thread and...

  • 5.10 Security services and coverage gaps

    Security collectors (GuardDuty, Security Hub, Inspector, Macie, Config, Access Analyzer, Detective, CloudTrail, WAF, Network Firewall, Shield) produce, per...