Discover & define
Connect and discover AWS
Give discovery a clear scope. Start with the account and region containing your representative application.
Last reviewed 23 October 2026
Search runs in your browser. No account needed.
Before you connect
You need access to PortabilityLabs and an AWS administrator who can install the supplied IAM role. Choose the accounts and regions you want to inspect. Review AWS coverage before assuming a service can be discovered or packaged.
Set up a connection
- Open Workspace settings → Connections and add an AWS connection.
- Choose the account scope, regions and inventory identity setting.
- Install the provided role with the exact trusted principals and external ID from setup. Return the role ARN through the setup flow.
- Run discovery for the accounts you want to inspect.
Some AWS list operations require Resource: *. Read the permission pack supplied with the role; “read-only” does not mean every action can be restricted to a single resource ARN.
Pseudonymous inventory uses stable references. Identifiable inventory can include resource names and provider identifiers so your team can find the right function or table. Names can themselves contain confidential or personal information. Tags and environment-variable values are not exported as inventory.
What discovery does
The collector reads supported configuration and translates it into resources and evidence-backed connections. It does not invoke your application or read database rows, object contents, messages or production request bodies.
After you select a Lambda function into a workload, the separate code-retrieval worker may acquire its deployment archive through the approved role. The archive is quarantined. Retrieval does not grant permission to run the code.
The current role-based connection is the hosted setup. Customer-hosted collection and testing use a separately agreed deployment design.
Review a discovery
Open Discoveries to see progress and failures. Open Resources for the latest completed inventory. A denied service should become a permission gap, not an empty assurance that the account contains nothing.
Use AWS names in the resource selector. Type counts reflect the resources available to select. Selections remain while you search, filter or move through result pages.
Retry or remove access
For a failed discovery, check the selected account, region, role trust and listed permissions, then run a new discovery. Do not broaden the role to AdministratorAccess to make an error disappear.
To revoke access, remove the role trust or role in AWS using your own change process. Previously retained inventory and evidence remain in PortabilityLabs; revocation alone does not erase them. Any already-issued AWS session follows AWS session rules.
Find the right recovery action →