Coverage records¶
cloudg.coverage.CollectionCoverage, one per collection unit. InventoryResult.coverage holds,
in order: the discovery records (AWS organization, Azure management groups, GCP hierarchy), then
one record per provider × account × region run.
10.1 CollectionCoverage¶
| Field | Type | Meaning |
|---|---|---|
provider |
str |
aws, azure or gcp. |
region |
str \| None |
Region of the run, "global" for discovery records, None for Azure / GCP runs. |
account_id |
str \| None |
Account, subscription, project or organization the record covers. |
started_at |
datetime |
Creation time. |
completed_at |
datetime \| None |
Not set by the inventory collectors. |
services |
list[ServiceCoverage] |
One entry per collector task / step. |
Properties: total_services, successful_services, failed_services (int) and
coverage_pct (float, successful / total × 100, one decimal). to_summary() returns
{"provider", "region", "account_id", "total_services", "successful", "failed",
"coverage_pct", "failures": [{"service", "error"}]}.
10.2 ServiceCoverage¶
| Field | Type | Meaning |
|---|---|---|
service |
str |
Collector task or step name (table below). |
status |
ServiceStatus |
SUCCESS, FAILED, PARTIAL or SKIPPED. |
asset_count |
int |
Assets the task produced (for cloud_control_skipped_types: the number of skipped types). |
error |
str \| None |
Error text, or a summary for PARTIAL. |
duration_ms |
int \| None |
Task duration. |
10.3 Service names¶
service |
Record | Meaning |
|---|---|---|
any task name (lambda, ecr, eks, guardduty, codepipeline, ...) |
AWS account × region | One entry per deep-collector task that ran; see the task table in INVENTORY_INTERNALS.md. A task that raised is FAILED with the exception text and produced no assets. |
tagging_sweep, cloud_control |
AWS account × region | The breadth sweeps. |
kubernetes:<cluster name> |
AWS account × region | In-cluster mapping of one EKS cluster: SUCCESS with the number of Kubernetes objects, or FAILED (endpoint unreachable, no access entry). |
cloud_control_skipped_types |
AWS account × region | PARTIAL: Cloud Control types that could not be listed; asset_count is the number of types, error the error codes with counts ("AccessDeniedException: 3, UnsupportedActionException: 41"). |
aws_full |
AWS account × region | Overall result. PARTIAL when any task failed or was partial, FAILED when the whole run raised. asset_count is the total. |
sts_assume_role |
AWS account × region | FAILED when the member-account role could not be assumed; nothing else is collected for that account and region. |
organizations |
AWS discovery | Organization discovery; asset_count is the number of accounts. FAILED means only the caller account was mapped. |
controltower |
AWS discovery | PARTIAL with the errors met while reading the landing zone. |
azure_full, azure_edges, azure_<service> |
Azure subscription | Overall result, edge collection, and individual SDK fallbacks / Resource Graph sub-queries that failed. |
management_groups |
Azure discovery | Management group / policy hierarchy. SKIPPED when the SDK is not installed. |
gcp_full, gcp_iam_policies |
GCP scope | Overall result, and the searchAllIamPolicies call (PARTIAL when it failed after returning some policies). |
organization_hierarchy |
GCP discovery | Organization / folder / policy hierarchy. |
GCP parity records (per GCP scope):
service |
Meaning |
|---|---|
gcp_assets_<family> |
Assets of one service family (compute, network, data, security, ...) built from the Cloud Asset Inventory listing. The status follows the listing: PARTIAL when it was truncated or fell back to summaries. Written for every selected family, also with asset_count 0. |
gcp_<source> (gcp_scc, gcp_dns_records, gcp_cloud_identity, gcp_monitoring, ...) |
One API-backed source (INVENTORY_INTERNALS.md 9.6). PARTIAL when some calls failed, FAILED when none answered or the source raised, SKIPPED when a prerequisite is missing (no credentials, no organization, no Cloud Identity customer) or the API is off everywhere it was asked. |
gcp_derived_<pass> |
FAILED when a cross-asset pass raised; absent otherwise. |
gcp_list_assets, gcp_search_resources, gcp_asset_mapping |
The listing, its SearchAllResources fallback (PARTIAL), and records that could not be mapped (PARTIAL). |
A record that is FAILED or PARTIAL makes gcp_full PARTIAL, as before. Families and
sources left out by inventory.services / exclude_services get no record, like AWS tasks.
Azure records added with the parity work. They sit in the subscription's coverage record next
to azure_full (and the Entra ones in a discovery record):
service |
Record | Meaning |
|---|---|---|
any Azure task name (resources, policy, security_assessments, apim, dns_records, virtual_wan, ...) |
Azure subscription | One entry per task of INVENTORY_INTERNALS.md 8.4. SUCCESS with the rows or assets it produced, PARTIAL when some calls were refused, FAILED when all failed, SKIPPED with the reason (not selected by inventory.services, turned off in azure.*, no token for the audience, Resource Graph unavailable on the SDK path). |
kubernetes:<cluster name> |
Azure subscription | In-cluster mapping of one AKS cluster, like EKS. SKIPPED for clusters without Entra integration. |
depth |
Azure subscription | FAILED only if the depth stage itself raised; the breadth inventory is kept. |
entra |
Azure discovery | Microsoft Graph run: PARTIAL when a listing failed, SKIPPED when not selected, FAILED when no Graph token could be obtained. |
entra_tenant, entra_users, entra_groups, entra_group_members, entra_applications, entra_application_owners, entra_federated_credentials, entra_service_principals, entra_service_principal_owners, entra_app_role_assignments, entra_oauth2_grants, entra_directory_roles, entra_pim_eligibility |
Azure discovery | One per Graph listing. FAILED with "Graph permission missing" on a 403. |
azure_full is now PARTIAL when any of these task records is FAILED or PARTIAL, as for
aws_full.
The CLI prints the failed entries after a map run ("N collectors failed").