Wallarm Infrastructure Discovery: AWS Inventory and Drift Detection

Wallarm Infrastructure Discovery is a continuous AWS inventory, change detection, and API discovery service delivered as a per-customer tenant in the Wallarm cloud. Connect AWS accounts with a read-only IAM role and external ID (or AWS SSO profile, or static access key) and the first scan produces a live inventory of every EC2 instance, VPC and its networking, EKS cluster and node group, Lambda function, load balancer, and API Gateway deployment across the regions you ask Wallarm to scan. There is no agent for your team to install, host, or operate.

WHAT YOU GET ON THE FIRST SCAN A searchable asset inventory across every connected AWS account and region, filterable by service, region, account, and resource type. A live relationship graph derived from the AWS APIs themselves, not from a diagram someone drew last quarter. CloudTrail creator attribution on every resource, so "who created this and when" is answered without spelunking through audit logs. Built-in detection rules for the common exposure patterns (public IPs, wide-open security groups, sensitive ports open to the internet, missing HTTPS redirects, public EKS endpoints) and a policy engine that lets your team write detection and triage rules in Common Expression Language without filing a feature request.

DRIFT DETECTION AND CHANGE ATTRIBUTION Every scan compares against the prior state and records created, updated, and deleted resources with the specific fields that changed. Filter drift events by account, region, service, severity, and time to scope an incident, assemble an audit timeline, or answer the audit committee's "what changed in our cloud last week." Drift records are persistent, so you can hand auditors the same view your on-call team uses.

API DISCOVERY AND AUTOMATED TRAFFIC MIRRORING Discovering an API is only useful if you can protect it. Infrastructure Discovery automatically detects HTTP endpoints behind EC2 instances (standalone and Auto Scaling Group), EKS pods, and ALB and NLB load balancers. From the same console, provision VPC Traffic Mirroring or Gateway Load Balancer inspection paths to route real traffic into Wallarm API security in minutes. No application code changes, no DevOps ticket, no inline production risk. AWS service activation runs on AWS Systems Manager with credentials stored in AWS Secrets Manager, and a single API call tears the pipeline down cleanly when you remove it.

MULTI-ACCOUNT, MULTI-REGION, MULTI-AUTH Each AWS account is registered once with whichever credential method that account supports: cross-account IAM role with external ID (the default), AWS SSO profile, or static access keys. Multiple regions per account. The inventory, graph, drift events, and findings unify across every connected account into a single view with per-account filtering. Designed for production AWS estates: thousand-account scale is a configuration question, not a different tool.

READ-ONLY BY DESIGN The Wallarm-published IAM policy template grants Describe, List, and Get permissions only. The cross-account role trust policy uses an external ID to prevent confused-deputy attacks. Customer credentials never appear in API responses or log lines, and an optional separate write role is used only for traffic mirroring when the customer opts in.

ON-RAMP TO THE WALLARM AI CONTROL PLATFORM The same scan that inventories your AWS estate surfaces the AI workloads running on it: EKS clusters labeled with AI frameworks, Lambda functions hitting model providers, agent frameworks, and MCP servers. Customers extending Wallarm coverage into AI Hypervisor (Wallarm's runtime AI governance platform on Amazon EKS, separately licensed) use Infrastructure Discovery to scope deployment before installation.

WHO IT IS FOR Security leaders who need a defensible answer to "what do we have in AWS, what is exposed, and what changed?" without trusting a vendor with write access to production. Platform and SRE leaders running large multi-account AWS estates. Compliance and audit owners producing evidence of inventory, change control, and posture against SOC 2, ISO 27001, and internal review boards. Wallarm Infrastructure Discovery is the territory map that makes the rest of Wallarm's AWS-native platform deployable, and stands on its own for any team that needs an accurate, current picture of the AWS cloud they are responsible for.