Cloud Inventory: Knowing Every Resource You Pay For
You cannot allocate, schedule, secure, or delete what you have not found. Inventory comes first.
A cloud inventory is a current, queryable list of every resource an organization runs in the cloud, with enough attributes on each one to decide what to do with it: type, location, account, state, owner, configuration, and cost. It is the base layer for cost allocation, security review, and cleanup, and it is harder to keep complete than it looks, because resources are spread across accounts, regions, and providers, and change continuously.
What each provider offers natively
- AWS Resource Explorer searches resources using indexes. It stores what it finds about each Region in a local index in that Region; to search across all Regions in an account, you promote one Region’s index to be the account’s aggregator index.
- AWS Config records resource configurations and keeps history, so you can see, for example, the IAM policy a user had at any time Config was recording. You choose which resource types it records.
- Google Cloud Cloud Asset Inventory lists assets across projects, folders, and organizations, and keeps create, update, and delete history for up to 35 days. Assets that have not changed in that time return their latest state.
- Azure Resource Graph runs queries with filtering, grouping, and sorting across a set of subscriptions, and can query changes to resource properties. Its data is indexed with a short latency and is not strongly consistent.
Each is scoped to one provider, and each has its own coverage of resource types. A multi-cloud inventory is either stitched together from all three or built by a tool that reads them.
What a useful inventory records
| Attribute | Why it matters |
|---|---|
| Provider, account, region | Where to act, and who pays |
| Type and size | What it costs per hour and what can be done to it |
| State | Running, stopped, detached, deleted |
| Parent and children | A cluster’s node pools, a registry’s repositories, a VM’s disks |
| Tags and owner | Who to ask before changing it |
| Cost | Which items deserve attention first |
| Permission to act | Whether your tooling can change it, or only see it |
The last row is easy to overlook. An inventory that shows a resource but not whether your credentials can stop, resize, or delete it will produce plans that fail at execution.
Keeping it complete
- Cover every account, project, and subscription, including ones created outside your landing zone process.
- Re-scan on a schedule and on demand, so new resources appear and deleted ones drop out.
- Record discovery failures, such as access denied on a service, rather than silently reporting fewer resources.
- Reconcile totals against the bill: spend with no matching inventory item means something is missing.
ZopNight’s inventory
ZopNight discovers resources through AWS Resource Explorer plus per-service providers, Google Cloud Asset Inventory, and Azure Resource Graph, and also connects Databricks, Snowflake, and OpenShift clusters. It keeps parent-child relationships up to three levels, re-syncs periodically, and supports a manual refresh. Permission errors found during discovery are recorded per permission and shown as Granted, Denied, or Unknown, so a gap in coverage is visible rather than silent. Each resource carries a rack-rate cost from pricing APIs and, when billing sync is configured, its billed cost. A read-only connection is enough for discovery and recommendations; start, stop, and remediation need read and write access.
Related: cloud sprawl, resource lifecycle, and cost allocation.
Questions we get a lot.
If yours isn't here, email us and we'll answer directly.
How far back does Google Cloud Asset Inventory keep history?
Create, update, and delete history is kept for up to 35 days. Assets unchanged in that period return their latest status.
Does ZopNight need write access to build an inventory?
No. A read-only connection supports discovery, cost, and recommendations. Starting, stopping, and remediation require a read and write connection.