Concepts and glossary
The terms below have precise meanings in Aletheia. Where a term is also a general industry word, the definition here is the one these docs use.
Inventory
Section titled “Inventory”Resource : A single live AWS object Aletheia discovered — an instance, a bucket, a database, a security group. Identified by its ARN where AWS provides one.
Resource type : A supported class of resource. Aletheia discovers a fixed registry of types; a type not in the registry is not scanned.
Revision : A recorded state of one resource at one point in time. Each scan writes a revision when something changed, which is what lets the timeline show configuration history rather than only the current value.
Scan : One discovery run across an AWS connection. A scan is made of tasks, roughly one per region and resource type, and an individual failed task can be retried without rerunning the whole scan.
Accounts and access
Section titled “Accounts and access”Connection : The link between your organization and one AWS organization or standalone account. It holds the role Aletheia assumes and the external ID that scopes it to you.
AWS account : A single account within a connection. One connection can cover many accounts.
External ID : A secret unique to your organization, required by the trust policy on the role you create. It prevents any other party from assuming your role even if they learn its ARN.
Code and mapping
Section titled “Code and mapping”Repository : A source control repository Aletheia has access to, through a GitHub App installation or a GitLab connection.
Infrastructure-as-code project : A directory within a repository that Aletheia treats as one Terraform root — the unit that has its own state.
State source : A location Aletheia reads Terraform state from. You designate these explicitly; Aletheia reads only the state objects you point it at.
Mapping : The join between a live resource and the code that declares it.
Management state
: What mapping concluded about a resource. One of managed_synchronized, unmanaged,
conflicting, managed_missing, or unknown. See
How it works.
Deployment unit
: One Terraform root and its state — the unit that claims resources. A resource claimed by
two deployment units is conflicting.
Confidence
: How certain a mapping is, on a four-tier scale: confirmed, high, medium, low.
A confirmed match rests on an identifier both sides agree on; weaker tiers rest on
weaker signals and are presented as proposals rather than facts.
Evidence : The specific facts behind a mapping — which state source, which address, which identifier matched. Every mapping shows its evidence so you can judge it yourself.
Correction : A mapping you overrode by hand. Corrections persist across rescans and are recorded as their own audit trail.
Organization model
Section titled “Organization model”Application : A deployable unit that groups resources across accounts and environments.
Environment : A deployment stage such as production or staging. AWS accounts can carry a default environment.
Team : A group of users, used to express accountability for applications.
Membership : The link between a resource and an application. Either declared by a person or inferred by a rule.
Inference rule : A rule that proposes memberships from resource tags. Its results are marked inferred until someone confirms them, so a guess never silently becomes a fact.
Change
Section titled “Change”Change : A recorded modification to a resource, ingested from your AWS account’s own change records. Includes changes made outside any pipeline.
Plan : A Terraform plan your CI generated and sent to Aletheia. Describes intended changes.
Execution : A Terraform apply your CI ran and reported. Describes what actually happened.
Ingest token : An organization-scoped bearer token your CI uses to send plans and executions. It is not a user token and cannot read your data.
Access control
Section titled “Access control”Organization : The tenant boundary. All data belongs to exactly one organization, and no query crosses that boundary.
Role : A named set of permissions assigned to a member. Determines what a user can read and change.
Audit log : The record of who did what, written in the same transaction as the change it describes.
The assistant
Section titled “The assistant”Aletheia : Also the name of the AI assistant. It is read-only, reads the same data you can see, and cites the records behind every answer. Referred to in the third person throughout these docs: “Aletheia found”, never “I found”.
Citation : A reference from a sentence in an answer to the specific record that supports it.