Skip to content
AletheiaAletheiaAletheia docs

Discovery and scans

A scan is one discovery run across a connection. It is how the inventory gets populated and how it stays current.

What a scan does

Section titled “What a scan does”

Aletheia assumes your read-only role and walks the supported resource types across the accounts and regions in scope. For each resource it finds, it records the resource’s identity and its configuration.

A scan is composed of tasks, roughly one per account, region, and resource type combination. Tasks run independently, which has two consequences worth knowing:

  • A scan reports progress per task, so you can see what is still running rather than watching an opaque spinner.
  • One failing task — a throttled API, a region you do not have enabled — does not fail the whole scan. You can retry that single task without rerunning everything.

Scans run in the background. You do not need to keep the page open.

Revisions, not snapshots

Section titled “Revisions, not snapshots”

Each scan writes a revision for a resource when something about it changed. The inventory is therefore a history, not a current-state dump.

This is what makes the rest of the product possible. Because Aletheia keeps prior revisions, it can show you what a resource’s configuration was last week, and a resource that disappears is marked as no longer present rather than quietly vanishing from the list.

How resources are identified

Section titled “How resources are identified”

Aletheia identifies a resource by its ARN where AWS provides one, and by its native identifier otherwise. This identity is stable across scans, which is what lets revisions accumulate against the same resource rather than creating a new entry each time.

Identity is also what mapping matches on — see resource-to-code mapping.

When to rescan

Section titled “When to rescan”

Discovery is not continuous. Run a scan when you want the inventory refreshed: after a large deployment, after adding an account or region, or on whatever cadence suits you.

Note that the change timeline does not depend on scans. Changes made in AWS are ingested from your account’s own change records, so a change that happened between scans still appears.

Where to go next

Section titled “Where to go next”