Wallarm Infrastructure Discovery: AWS Inventory and Drift Detection

Wallarm Infrastructure Discovery is part of the Wallarm AI Control Platform, the only platform that integrates AI security and API security into one closed loop. Infrastructure Discovery is where that loop starts: mapping the AWS estate so security teams know what is running, changed, and exposed before anything else can happen.

KNOW WHAT YOU ARE RUNNING: Within minutes of connecting an AWS account, you have a live, searchable inventory of EC2 instances, VPCs, EKS clusters, Lambda functions, load balancers, and API Gateway deployments across every region you scan. A live relationship graph shows how everything connects. CloudTrail creator attribution tells you who stood each resource up, and when. Built-in detection rules surface the exposures that matter: public IPs, overly permissive security groups, sensitive ports open to the internet, public EKS endpoints. Your team can also write their own detection and triage rules in Common Expression Language, without a feature request and without forking the platform.

KNOW WHAT CHANGED: Every scan compares against the prior state and records exactly what was created, updated, or deleted. Filter drift events by account, region, service, severity, and time to scope an incident or assemble an audit timeline. The same data your on-call team uses is what you hand your auditors. SOC 2 and ISO 27001 evidence does not get built the week before the review.

KNOW WHAT IS EXPOSED: Infrastructure Discovery automatically detects HTTP endpoints behind EC2 instances, EKS pods, and load balancers on every scan, giving security teams a clear picture of what is reachable from the internet before attackers find it first. It also inventories Bedrock resources, so AI adoption happening account-by-account doesn not stay invisible to security. That makes Infrastructure Discovery the natural on-ramp to AI Hypervisor, which is the Wallarm runtime AI governance product that observes what those AI workloads are actually doing, enforces policy in real time, and generates continuous compliance evidence for EU AI Act and SOC 2. Together, Infrastructure Discovery and AI Hypervisor run the Wallarm AI Control Loop: Discover, Observe, Enforce, Govern.

BUILT FOR MULTI-ACCOUNT AWS AT SCALE: Each AWS account connects once with whichever credential method works for that account. Inventory, relationship graph, drift events, and findings unify across every connected account into a single view with per-account filtering. Designed for production AWS estates. Multi-account scale is a configuration question, not a different tool.

READ-ONLY BY DESIGN: The Wallarm IAM policy grants Describe, List, and Get permissions only. The cross-account role trust policy uses an external ID to prevent confused-deputy attacks. Customer credentials never appear in API responses or log lines.