Discover listable types._cc_listable_types() lists every CloudFormation resource type
(cloudformation:ListTypes, public and AWS-provided) and describes its schema to keep only
types with a list handler, noting types whose list handler requires a parent identifier.
The result is cached in memory and on disk for 7 days in $CLOUDG_CACHE_DIR
(default ~/.cache/cloudg), so a multi-region run discovers once.
Select. Skip types that need a parent identifier, types in the catalog's covered_types
(a deep collector maps them better), global types outside the primary region
(global_prefixes), and types filtered by cloud_control_types / cloud_control_exclude
(exact names or prefixes like AWS::Glue::).
List.ListResources per type with cloud_control_concurrency types in parallel, up to
5000 resources per type.
Build assets._cc_asset(): the ARN comes from the model's Arn or <Type>Arn, or the
identifier when it is an ARN, else a cloudcontrol: synthetic identifier. The asset type
comes from the catalog's asset_types, then asset_type_from_arn, then OTHER. Metadata:
discovered_via: "cloud-control", resource_type, identifier, service, and the
redacted model as properties. The identifier becomes an alias.
Redaction.redact() drops, at any depth, keys matching the secret pattern (password,
secret, token, private key, credential, API key, authorization, connection string,
certificate body, key material, environment variables, user data) and the per-type
sensitive_fields of the catalog (for example SSM parameter Value).
Coverage. Types that failed to list are counted per error code in the
cloud_control_skipped_types coverage entry.