Cloud Asset Inventory
for AWS, Azure, OCI, GCP & VMware

What is Cloud Asset Inventory?

Cloud asset inventory is the automated process of discovering, cataloging, and continuously tracking every resource deployed across your cloud infrastructure. It answers the fundamental question every engineering, security, and finance team asks: what do we actually have running?

A cloud asset includes any billable or configurable unit within a cloud provider — compute instances, databases, storage buckets, virtual networks, load balancers, IAM roles, serverless functions, Kubernetes clusters, firewall rules, and more. In a typical medium-sized organisation running multiple cloud accounts, this can easily amount to tens of thousands of individual resources.

Without automated cloud asset inventory, teams rely on manual audits, provider consoles, or spreadsheets — all of which go stale within hours. Resources are provisioned, forgotten, misconfigured, and left running at cost. Security teams miss exposed storage buckets. Compliance audits take weeks instead of hours.

A proper cloud asset inventory platform provides:

• Automated resource discovery — continuous scanning via cloud provider APIs, no agents
• Unified inventory across providers — one view across AWS, Azure, OCI, GCP, and VMware vSphere
• Real-time change tracking — know when resources are created, modified, or deleted
• Security posture assessment — flag misconfigurations, exposed endpoints, overly permissive policies
• Compliance mapping — check resources against CIS, SOC 2, PCI-DSS, HIPAA, ISO 27001, NIST
• Cost attribution — see what you're spending and where, broken down by provider, service, and category
• Dependency mapping — topology maps showing how resources connect

Why Cloud Asset Inventory Matters

Security: You Cannot Protect What You Cannot See

The most common cause of cloud security incidents is shadow IT — resources that were provisioned and forgotten. An S3 bucket left publicly accessible. An EC2 instance with an open port 22. A test database that never got deleted, still containing production data. Cloud asset inventory is the foundation of cloud security because it eliminates blind spots.

CloudVista automatically flags misconfigured resources as soon as they're discovered — open ports, public storage, weak IAM policies, unencrypted databases — and maps each finding to the relevant CIS or SOC 2 control.

Compliance: Audit in Minutes, Not Weeks

When an auditor asks "show me all your publicly accessible storage across all cloud accounts," the answer shouldn't be "we'll get back to you in two weeks." Cloud asset inventory makes compliance audits fast by maintaining a continuously updated record of every resource and its configuration state.

CloudVista runs 128 automated compliance checks mapped to CIS Benchmarks, SOC 2, HIPAA, PCI-DSS, ISO 27001, and NIST — covering every resource in your inventory, every sync cycle.

Cost: Eliminate Invisible Spend

Cloud bills grow fastest from things teams forget: idle compute instances, orphaned EBS volumes, unused load balancers, databases no longer connected to any application. Cloud asset inventory surfaces these immediately.

CloudVista also surfaces network egress costs — one of the most underestimated line items in a cloud bill. AWS NAT Gateway, for example, charges twice on the same traffic (data processing fee + transfer fee). CloudVista detects this pattern and flags it automatically.

Operational Efficiency: One Dashboard for Everything

Engineering teams managing multi-cloud environments spend significant time switching between the AWS Console, Azure Portal, OCI Cloud Console, and vSphere Client to answer basic operational questions. Cloud asset inventory consolidates all of this into a single pane of glass — searchable, filterable, and always current.

How Cloud Asset Inventory Works

CloudVista uses a read-only API polling architecture — no agents to install, no network changes, no infrastructure modifications required.

1. Credential connection — you provide read-only API credentials (AWS IAM role, Azure service principal, OCI API key, GCP service account, VMware vCenter service account). CloudVista stores these with AES-256 encryption.
2. Discovery scan — CloudVista's collectors call each provider's APIs, paginating through all resource types in parallel. A typical environment with 500–2,000 resources completes in under 2 minutes.
3. Normalisation — resources from all providers are mapped to a consistent data model. An EC2 instance and an OCI Compute instance are both represented as "compute" with provider-specific metadata preserved.
4. Change detection — on each subsequent sync, CloudVista compares hashes of resource configurations. Changed resources are logged with a timestamp, enabling full change history.
5. Analysis — security findings, compliance checks, and cost analysis run against the freshly collected inventory. Results are surfaced in the dashboard within seconds of sync completion.
6. Scheduling — syncs run on a configurable schedule (hourly, every 6 hours, daily) or on demand. Celery task queue handles concurrent collection across multiple providers.

How to Set Up Cloud Asset Inventory in 10 Minutes

Getting your first cloud inventory live with CloudVista takes less than 10 minutes. Here's the step-by-step process:

AWS: Minimum Required IAM Policy

For AWS, attach the managed ReadOnlyAccess policy to a dedicated IAM user or role. Alternatively, use this minimal custom policy covering the resource types CloudVista collects:

Azure: Service Principal Setup

Create an Azure AD service principal with the built-in Reader role scoped to your subscriptions. CloudVista uses the Azure Resource Manager API — no additional permissions needed beyond Reader.

OCI: API Key Authentication

Create an OCI IAM user with the INSPECT verb on all resource types in the compartments you want to inventory. Generate an API key pair and provide the private key, fingerprint, tenancy OCID, and user OCID to CloudVista.

VMware vSphere: Read-Only Service Account

Create a vCenter service account with the built-in Read Only role at the vCenter root level. This gives CloudVista visibility into all datacenters, clusters, hosts, datastores, and VMs without any write access.

Coverage by Cloud Provider

CloudVista provides native inventory collection for all five supported platforms. Each collector is maintained against the latest provider SDK and API versions.

Resource Types Discovered (60+)

CloudVista catalogues a comprehensive set of resource types across all supported providers. Below is the full breakdown by category:

Compliance & Security Posture

Cloud asset inventory is only half the picture. The other half is knowing whether your assets are secure and compliant. CloudVista runs 128 automated security checks against your inventory, mapped to the most widely-used compliance frameworks:

Attack Surface Analysis

Beyond compliance frameworks, CloudVista performs attack surface analysis — identifying resources exposed to the public internet, ports open to 0.0.0.0/0, storage buckets with public access enabled, IAM policies with wildcard permissions, and databases accessible without authentication.

Cost Visibility & Network Egress Analysis

Cloud asset inventory extends naturally into cost governance. CloudVista collects billing data from each provider's cost API, linking spend directly to the resources in your inventory.

What CloudVista Surfaces

• Spend by provider and service — see your top cost drivers across all accounts in one view
• 12-month spend forecast — per-category projections (compute, storage, network, database) using your actual historical growth rates, with conservative / base / aggressive scenarios
• Network egress breakdown — costs split by direction: inbound, outbound, cross-AZ, inter-region
• AWS NAT Gateway double-charge detection — flags when data processing fee + transfer fee are both appearing on the same traffic
• OCI free egress tier meter — tracks your usage against OCI's 10 TB/month free egress allowance
• Cross-provider egress comparison — shows per-GB egress rate across AWS, Azure, and OCI side by side

See the full compliance and cost governance guide for more detail on cost optimisation using cloud asset inventory.

VMware vSphere & On-Premises Inventory

Most cloud asset inventory tools stop at the public cloud boundary. CloudVista includes native VMware vSphere support, giving hybrid teams a single inventory view across both cloud and on-premises infrastructure.

Connect CloudVista to your vCenter server using a read-only service account — no agent installation, no network changes. CloudVista syncs your full vSphere inventory on the same schedule as your cloud providers:

• Virtual Machines — power state, CPU, memory, guest OS, IP address, VMware Tools status, snapshot count, disk size, host and cluster placement
• ESXi Hosts — connection state, CPU model and core count, memory, ESXi version and build, VM count, cluster membership
• Compute Clusters — HA enabled/disabled, DRS mode, total CPU and memory capacity, host and VM count
• Datastores — type (VMFS, NFS, vSAN), capacity, free space percentage, accessibility status, connected hosts and VMs
• Distributed Virtual Switches & Port Groups — full topology of your virtual network
• Datacenters, Resource Pools & VM Templates

Health checks run automatically across vSphere resources: powered-off VMs are flagged as degraded, datastores below 10% free space trigger critical alerts, disconnected hosts are immediately surfaced.

Learn more on the dedicated VMware vSphere inventory page.

Best Practices for Cloud Asset Inventory

1. Establish Tagging Standards Before Discovery

Consistent tagging (environment, team, cost-centre, application) makes inventory data far more useful. Define your tagging policy first, then use CloudVista's inventory to identify untagged resources and enforce the policy progressively.

2. Use Read-Only Credentials

Cloud asset inventory requires only read access. Never grant write or admin permissions to your inventory tool. CloudVista operates on the principle of least privilege — the IAM policies listed in the setup section above are the minimum required.

3. Sync Frequently for High-Value Environments

Production environments change constantly. Set CloudVista to sync every hour for production accounts. Dev/test accounts can sync less frequently (every 6 hours or daily) to reduce API calls and costs.

4. Treat Your Inventory as Your Security Control Plane

Every new finding (exposed port, public bucket, unencrypted database) should trigger a ticket. Integrate CloudVista alerts with your ticketing system and treat unresolved findings with the same urgency as uptime incidents.

5. Review Stale Resources Monthly

CloudVista surfaces resources that haven't changed state in 30+ days. Review these monthly — many will be idle instances, orphaned volumes, or unused load balancers generating cost with no business value.

6. Use the Topology Map for Architecture Reviews

Before deploying changes, use CloudVista's topology map to understand what connects to what. It surfaces dependencies that aren't documented anywhere, preventing accidental outages.

7. Centralise Multi-Cloud Inventory at the Platform Level

Don't rely on each team managing their own cloud console access. A centralised cloud asset inventory platform with RBAC (role-based access control) lets security, FinOps, and engineering teams each access the data relevant to them without sharing credentials.

CloudVista vs Alternatives

The cloud asset inventory market includes a mix of native tools (AWS Config, Azure Resource Graph), cost-focused platforms (CloudHealth, Apptio), and security-focused tools (Wiz, Orca, Lacework). Here's how CloudVista compares:

CloudVista is purpose-built for teams that need a single platform covering inventory, security posture, compliance, and cost — without the cost and complexity of enterprise-only alternatives. The free tier lets you evaluate against real data with no commitment.

Frequently Asked Questions