Skip to main content

Assets

The Assets page is where you view your AWS assets and manage your synchronization policies.

The page consists of two tabs — Asset Inventory and Synchronization.

Data Reference — a cumulative inventory

Asset Inventory shows the most recent record per ARN across every completed synchronization, not the result of the last synchronization alone.

  • Assets collected by different synchronization runs appear together (for example, EC2 instances from run 1 and IAM groups from run 8).
  • A resource you have already deleted in AWS stays in the list. It keeps the state it was last seen in until the same ARN is collected again and its record is replaced. Confirm deletions in the AWS console.
  • The summary metrics at the top therefore count everything collected so far, not what exists in the account right now.

The Assets page consists of the following two tabs:

  • Asset Inventory – Browse the AWS assets collected so far
  • Synchronization – Configure scan scope and manage synchronization runs

1. Asset Inventory Tab​

Asset Inventory tab

Asset Inventory shows the AWS assets discovered by your synchronizations so far, one record per ARN — the most recent one.

Each asset includes the following information:

  • Resource type (EC2, RDS, S3, etc.)
  • Region and network information
  • Exposure status (Public / Private)
  • Risk assessment results (when a Risk Assessment has been run)

1.1. Key Metric Definitions​

The summary metrics at the top of Asset Inventory are calculated as follows:

  • CRITICAL ISSUES: The number of assets classified at the highest risk level (Critical)
  • UNPROTECTED: The number of assets directly exposed to the internet
Note

Note: Indirect exposure through a NAT Gateway or Load Balancer is currently not included in the UNPROTECTED metric.

1.2. CSV export limit​

Export downloads the assets matching the current filters as CSV. A single export covers at most 1,000 rows. When more match, only the first 1,000 are included and the screen says so before the download starts. To export everything, narrow the filters (service, region, resource type) and export in several passes.

2. Synchronization Tab​

The Synchronization tab lets you define which assets to scan and manage past scan runs.

2.1. AWS Asset Sync​

AWS Asset Sync and Sync History

  • View the current sync status (most recent sync time, number of discovered resources)
  • Run an asset synchronization:
    1. Navigate to the Assets → Synchronization tab.
    2. If needed, select the services or resource types to scan under Sync Scope.
    3. Click Sync Now.
    4. Once synchronization completes, the latest asset information is reflected in the Asset Inventory tab.

2.2. Sync History​

A table of past synchronization runs.

  • Date & Time: When the sync was executed
  • Duration: How long the sync took
  • Added / Updated / Removed: Changes compared to the previous scan
  • Status: Success or failure (e.g., completed, failed)

2.3. Sync Scope​

Sync Scope settings

The configuration area where you select which assets to include in the sync.

  • Service-level selection: e.g., EC2, Lambda, ECS, S3, RDS, VPC, IAM, etc.
  • Resource type-level selection: Specify individual resource types within a selected service
    • e.g., for EC2: Instances, Volumes (EBS), Snapshots, AMIs, Elastic IPs, Network Interfaces, etc.
  • Only assets within the selected scope are collected.

2.4. Prerequisite — the Resource Explorer aggregator index​

Asset synchronization finds resources through AWS Resource Explorer. Global resources that do not belong to a region — IAM, S3, CloudFront, Route 53 — are only visible through an aggregator index, which spans all regions.

  • The onboarding CloudFormation stack creates that index. The index is created in the region the stack is deployed to, so deploy the stack in the region you set on the project.
  • An AWS account may hold only one aggregator index. If one already exists in another region, set the stack parameter CreateResourceExplorerIndex to false and use the region that already holds the index as the project's region.
  • Without the index, synchronization fails instead of quietly returning nothing. If the sync scope includes global resource types and no aggregator index exists, the run ends as failed with the reason aggregator_index_missing. If every global resource type is turned off in the scope, nothing would be missed and the run is not failed.
  • Accounts connected before this requirement need the stack redeployed, or an aggregator index created by hand in the AWS console. The console shows the index status and what to do about it on the project settings and synchronization screens.

3. Operational Tips​

  • Control sync scope at the service/resource type level to collect only the assets you need
  • Use the change counts (Added/Updated/Removed) in Sync History to track infrastructure changes
  • Keep Asset Inventory up to date to improve the accuracy of risk assessments and reports
  • If a resource you removed is still listed, run a synchronization to refresh its record