AWS source coverage

Know exactly what we can see—and what we cannot.

Connect selected AWS accounts and regions with a temporary role. PortabilityLabs inventories supported resource shape, records evidenced relationships and keeps missing permissions or unknown dependencies visible.

Request early access →Review security & data

Supported inventory

Seventeen AWS resource families, one workload view.

Coverage is deliberately explicit. A discovered resource is evidence that configuration was observed—not proof that traffic can reach it or application behaviour still works.

Compute & API

Application entry and execution

  • AWS Lambda functions
  • Amazon EC2 instances
  • API Gateway HTTP, WebSocket and REST APIs
Data & storage

State and durable content

  • Amazon DynamoDB tables
  • Amazon S3 buckets
Events & workflow

Asynchronous flow

  • Amazon SQS queues
  • Amazon SNS topics
  • EventBridge rules
  • AWS Step Functions state machines
Network

Placement and access shape

  • VPCs and subnets
  • Security groups and route tables
  • NAT gateways and VPC endpoints
Edge & identity

Delivery and authentication shape

  • Amazon CloudFront distributions
  • Amazon Cognito user pools

Evidenced relationships

A line appears only when configuration supports it.

PortabilityLabs does not connect resources because their names look similar. Current collectors can confirm these relationship patterns while keeping payloads and secret-bearing configuration inside the short-lived collector process.

API → computeAPI Gateway routes and integrations invoking Lambda.
Identity → APICognito user pools configured as API authorisers.
Compute → dataLambda read/write authority to DynamoDB when configuration and inline IAM policy corroborate it.
Events → targetsEventBridge, SQS and SNS triggers and subscriptions.
Workflow → servicesStep Functions references to functions, queues and topics.
Edge → originsCloudFront origins backed by inventoried API Gateway or S3 resources.
Important limitation

Runtime-only calls, managed IAM policy authority, complete network reachability, application data flow and unsupported services can remain unknown. Those gaps are shown as limitations; they are never silently turned into connections.

Default data boundary

Architecture insight without copying customer data.

Inventory excludes production records, object contents, message bodies, request payloads, secrets, environment-variable values, raw IAM policies, logs and tags. Resource names and provider identifiers are optional. Application code uses a separate, explicit quarantine and approval path after a resource is selected into a workload.

Read the complete security approach →

Start with one representative AWS workload.

Connect only the accounts and regions you approve, then verify what we found before defining or running a test.

Request early access →Plan an enterprise evaluation