Skip to main content
Inventory and security tools often call dozens or hundreds of APIs. Endpoint support for one service does not make an entire scanner compatible. An unsupported, denied, or silently skipped API can appear as an empty inventory or a false compliant result.

​
Start with a call inventory

For the exact tool and version you intend to run:
  1. Enable operation- and service-level logging in an isolated environment. Do not enable wire or debug logging that records authorization headers, signed URLs, or resource bodies.
  2. Record every origin service and operation it calls.
  3. Compare those calls with the Cloud Adapter service catalog.
  4. Mark each call as supported, intentionally excluded, denied, or unknown.
  5. Do not run the assessment until unknown calls have an owner and interpretation.
This exercise is required separately for Prowler, ScoutSuite, CloudQuery, Steampipe, Cloud Custodian, or any other product. Their collectors and call graphs differ.

​
Use a read-only origin identity

Create a dedicated origin-side identity for the assessment. Start with read-only API permissions and no remediation capability. The target runtime identity used by Cloud Adapter is separate. Disable action or remediation modes. Cloud Custodian policies, for example, can mutate or delete resources; do not assume a file named as a policy is read-only.

​
Reconcile counts with native target state

Choose a small known inventory and compare three views: Every target resource in scope should have an explained origin representation or an explicit exclusion. Every origin finding should map to a real target resource and supported field.

​
Fail closed

Configure the assessment pipeline to fail when:
  • a required collector calls an unsupported operation;
  • access is denied;
  • a region or account scope cannot be enumerated;
  • pagination stops early;
  • the tool suppresses an API error;
  • the origin count differs from the native target count without an approved explanation.
Do not convert these conditions into warnings merely to obtain a report. An incomplete report is not evidence of a secure environment.

​
Validate findings, not only inventory

A tool may inventory a resource successfully but evaluate a control using a second unsupported API. For every control you plan to rely on, identify the fields and calls that produce the finding. Compare a small set of known pass and known fail resources with native target state.

​
Preserve safe evidence

Keep the tool version, collector set, service-operation matrix, adapter version, redacted endpoint, request IDs, native reconciliation counts, and excluded controls. Do not retain credentials, signed requests, or resource data beyond what the assessment policy allows.

​
When a result looks empty

An empty table can mean no resources, wrong scope, access denied, unsupported pagination, rejected operations, or a tool that swallowed an error. Inspect diagnostic response headers, the tool’s raw API failures, and native target state before accepting it. Use the relevant service catalog entry for a supported mapping and Testing Your Adapters to build a known-resource fixture.