Appearance

Cloud Discovery Pro+ ​

Cloud Discovery scans your AWS and Azure accounts to find all deployed resources, identify orphaned infrastructure not managed by Terraform, and provide cost and security insights.

Overview ​

Most organizations have resources deployed outside of Terraform — manually created, from scripts, or legacy infrastructure. Cloud Discovery finds these resources and helps you bring them under IaC management or clean them up.

How It Works ​

  1. Scan — Controlinfra uses your cloud credentials to enumerate resources across services and regions
  2. Classify — Each resource is classified as Managed (in Terraform state), Orphan (not in any state), or Ignored
  3. Analyze — AI insights highlight cost optimization, security risks, and cleanup opportunities
  4. Act — Generate Terraform code for orphaned resources or mark them as ignored

Supported Resource Types ​

Cloud Discovery supports 37 AWS resource types and 100+ Azure resource types across these services:

ServiceResource Types
EC2Instances, Security Groups, Volumes (EBS), Elastic IPs, Key Pairs, AMIs
VPCVPCs, Subnets, Internet Gateways, NAT Gateways, Route Tables
S3Buckets
RDSDB Instances, DB Clusters, Snapshots
LambdaFunctions
IAMRoles, Policies, Users
ECSClusters, Services, Task Definitions
EKSClusters
CloudFrontDistributions
Route 53Hosted Zones
SNSTopics
SQSQueues
DynamoDBTables
ElastiCacheClusters
ELBLoad Balancers (ALB, NLB, CLB), Target Groups
CloudWatchLog Groups, Alarms

Running a Discovery Scan ​

  1. Navigate to Cloud Discovery from the main navigation
  2. Click New Scan
  3. Configure the scan:
OptionDescription
Cloud AccountSelect which cloud account to scan (see Multi-Account Support)
RegionsSelect AWS regions to scan (or all)
Resource TypesFilter to specific services (or all)
  1. Click Start Scan

TIP

First scans can take several minutes depending on the number of regions and resources. Subsequent scans are faster due to incremental detection.

Multi-Account Support ​

Manage multiple AWS accounts from a single Controlinfra organization using Cloud Accounts.

Adding a Cloud Account ​

  1. Go to Settings → Cloud Accounts
  2. Click Add Cloud Account
  3. Provide:
    • Account Name — Friendly label (e.g., "Production", "Staging")
    • AWS Account ID — The 12-digit AWS account ID
    • Credentials — Access Key / Secret Key, or IAM Role ARN for AssumeRole
  4. Click Validate to test the connection
  5. Save the cloud account

Account Limits by Plan ​

PlanCloud AccountsRegions per Account
Free00
Pro11
TeamUnlimitedUnlimited
EnterpriseUnlimitedUnlimited
AssumeRole Setup (Recommended)

For cross-account access, create an IAM role in the target account:

  1. Create an IAM role with the ReadOnlyAccess managed policy
  2. Set the trust policy to allow your Controlinfra account to assume the role
  3. In Controlinfra, provide the Role ARN when adding the cloud account

This is more secure than static access keys and follows AWS best practices.

Resource Classification ​

Every discovered resource is assigned an IaC status:

StatusDescription
ManagedFound in a Terraform state file — tracked and managed
OrphanNot found in any Terraform state — unmanaged infrastructure
IgnoredManually marked as ignored by a user

Changing Status ​

  • Click on any resource to view its details
  • Use the Status dropdown to change classification
  • Marking a resource as Ignored removes it from orphan counts and alerts

Resource Boards ​

The discovery dashboard provides boards for organizing and reviewing resources:

  • All Resources — Complete list with filters and search
  • Orphans — Unmanaged resources requiring attention
  • By Service — Grouped by AWS service
  • By Account — Grouped by cloud account (multi-account)
  • By Region — Geographic distribution

Orphan Detection ​

Orphaned resources are highlighted with actionable details:

  • Resource type and ID
  • Region and account
  • Creation date (when available)
  • Estimated cost (for resources with pricing data)
  • Risk level — Security and cost risk assessment

Terraform Generation ​

For orphaned resources, Controlinfra can generate Terraform configuration:

  1. Select an orphaned resource
  2. Click Generate Terraform
  3. Review the generated HCL code
  4. Copy to clipboard or download as a .tf file

WARNING

Generated Terraform is a starting point. Always review and test the configuration before applying it. Some resource attributes may require manual adjustment.

AI Insights ​

When AI analysis is enabled, Cloud Discovery provides:

  • Cost optimization — Identify underutilized or oversized resources
  • Security findings — Flag misconfigured security groups, public access, missing encryption
  • Cleanup recommendations — Suggest resources safe to delete
  • IaC adoption score — Percentage of resources under Terraform management

Dashboard ​

The Cloud Discovery dashboard shows:

  • Total resources discovered
  • IaC coverage percentage (managed vs. orphan)
  • Resource breakdown by service and region
  • Cost estimates for orphaned resources
  • Trend data over time

Best Practices ​

  1. Scan regularly — Run weekly scans to catch new orphaned resources early
  2. Start with one region — Begin with your primary region before expanding
  3. Use AssumeRole — More secure than static access keys for cross-account access
  4. Triage orphans — Review and classify orphans promptly: generate Terraform, ignore, or delete
  5. Track IaC coverage — Use the dashboard to monitor your Terraform adoption percentage over time

Next Steps ​