Coverage

This page lists everything vpcatlas reads from an AWS account: the collectors, the boto3 client and the API calls each one makes, and what it produces. It is generated from the collectors in src/vpcatlas/collectors/, and a call that is not listed here is not made. vpcatlas only calls list, describe, get and search operations. It never creates, changes or deletes anything.

The matching permissions are in IAM permissions and in the policy printed by vpcatlas iam-policy.

How to read the tables

• Collector is the class in collectors/ and the name it reports in the graph (meta.collectors).
• Calls are boto3 method names on the client in the section header. A call that has a paginator is paged to the end; the others are looped on their own token. A call that fails (access denied, throttled, an operation the region lacks) is recorded as a gap, shown in the inventory as an issue, and the scan carries on.
• Scope says where the collector runs. Most collectors run once for each region scanned. Some read account-wide data and run once, in the home region (the bootstrap region of the partition, us-east-1 in the standard one, or the first region scanned when that one is not scanned), and their nodes carry the region global.
• Produces is the resource type ids written to the graph.

A collector never raises out of its own boundary. Where the data cannot be read, the node is left out or its number is written as not read, never as zero.

Before the collectors

These calls identify the credentials and find what to scan.

Step	Client	Calls	Notes
Identity	sts	get_caller_identity	Account id, ARN and partition of the credentials.
Assumed role	sts	assume_role	Only with --role-arn. Uses --external-id and, with --mfa-serial and --mfa-token, the MFA code. The credentials refresh before they expire, except with an MFA code.
Regions	ec2	describe_regions (enabled regions only)	Used when --regions is not given. If the call is denied, the regions known to botocore are used.
Account name	iam	list_account_aliases	Optional. Names the account in the inventory.
Organization names	organizations	list_accounts	Optional, and only works from the organization's management account.

Calls are made through the standard credential chain, so every method AWS tools support works: environment variables, shared credentials and config files, SSO profiles, EC2 instance roles, ECS task roles and EKS pod roles. Access keys are never command-line options.

Network

Collector	Client	Calls	Scope	Produces
RegionCollector (regions)	ec2	describe_regions, describe_availability_zones	each region	region
Ec2VpcCollector (ec2_vpc)	ec2	describe_vpcs, describe_subnets, describe_route_tables, describe_internet_gateways, describe_egress_only_internet_gateways, describe_nat_gateways, describe_network_interfaces, describe_security_groups, describe_network_acls	each region	vpc, subnet, route_table, igw, eigw, nat, eni, sg, nacl
PrefixListCollector (prefix_lists)	ec2	describe_managed_prefix_lists, get_managed_prefix_list_entries	each region	prefix_list
Ec2PeeringCollector (ec2_peering)	ec2	describe_vpc_peering_connections	each region	peering
TgwCollector (ec2_tgw)	ec2	describe_transit_gateways, describe_transit_gateway_attachments, describe_transit_gateway_vpc_attachments, describe_transit_gateway_peering_attachments, describe_transit_gateway_route_tables, get_transit_gateway_route_table_associations, get_transit_gateway_route_table_propagations, search_transit_gateway_routes	each region	tgw, tgw_attachment, tgw_route_table
VpnCollector (vpn)	ec2	describe_customer_gateways, describe_vpn_gateways, describe_vpn_connections	each region	cgw, vgw, vpn
DirectConnectCollector (direct_connect)	directconnect	describe_connections, describe_virtual_interfaces, describe_direct_connect_gateways, describe_direct_connect_gateway_associations, describe_direct_connect_gateway_attachments	connections and virtual interfaces: each region; gateways: home region	dx_connection, dx_vif, dx_gateway
EndpointsCollector (endpoints)	ec2	describe_vpc_endpoints, describe_vpc_endpoint_services, describe_vpc_endpoint_service_configurations, describe_vpc_endpoint_connections	each region	endpoint, endpoint_service
ElbCollector (elb)	elbv2, elb	describe_load_balancers, describe_tags on both clients (Application, Network and Gateway Load Balancers on elbv2; Classic on elb)	each region	lb
NetworkFirewallCollector (network_firewall)	network-firewall	list_firewalls, describe_firewall, list_firewall_policies, describe_firewall_policy	each region	nfw, nfw_policy
ResolverCollector (route53_resolver)	route53resolver	list_resolver_endpoints, list_resolver_endpoint_ip_addresses, list_resolver_rules, list_resolver_rule_associations	each region	resolver_endpoint, resolver_rule
RamCollector (ram)	ram	get_resource_shares (for SELF and OTHER-ACCOUNTS), list_resources, list_principals, get_resource_share_invitations	each region	ram_share

Notes:

• Network Firewall rule bodies are never read, only firewalls, their endpoints and policies.
• Resources that belong to another account (a shared subnet, a shared Transit Gateway, a shared prefix list or resolver rule) are kept and marked owned_elsewhere in the inventory. The account ids found in these fields are how external accounts are detected.
• Pending RAM invitations are reported, so a share that was not accepted does not look like a missing one.

Edge and DNS

Collector	Client	Calls	Scope	Produces
Route53Collector (route53)	route53	list_hosted_zones, get_hosted_zone, list_resource_record_sets, list_tags_for_resources	home region	hosted_zone
CloudFrontCollector (cloudfront)	cloudfront	list_distributions, list_tags_for_resource	home region	cloudfront
WafV2Collector (wafv2)	wafv2	list_web_acls, get_web_acl, list_resources_for_web_acl, get_logging_configuration	CLOUDFRONT scope: home region, through the us-east-1 endpoint; REGIONAL scope: each region	web_acl
AcmCollector (acm)	acm	list_certificates, describe_certificate, list_tags_for_certificate	each region	certificate
ShieldCollector (shield)	shield	get_subscription_state, list_protections	home region, through us-east-1, standard partition only	shield

Notes:

• Route 53 keeps only the records that make a line on a diagram: aliases (to CloudFront, a load balancer, an API, an S3 website) and CNAMEs to a known endpoint or to another name in the same zone, at most 300 per zone. The true count is in record_count.
• CloudFront reads only list_distributions, which already carries origins, aliases, certificate and web ACL. The link from a distribution to its web ACL is drawn from the distribution.
• Shield Standard is on for every account, so a node is written only when the subscription state could be read. A denied call leaves a gap and no node.

Compute

Collector	Client	Calls	Scope	Produces
TargetGroupCollector (target_groups)	elbv2	describe_target_groups, describe_target_health, describe_tags, describe_listeners, describe_rules	each region	target_group
EcsCollector (ecs)	ecs, ec2	list_clusters, describe_clusters, list_services, describe_services; ec2 describe_subnets to find the VPC of a service	each region	ecs_cluster, ecs_service
EksCollector (eks)	eks	list_clusters, describe_cluster, list_nodegroups, describe_nodegroup, list_fargate_profiles	each region	eks_cluster
InstanceCollector (ec2_instances)	ec2, autoscaling	ec2 describe_instances, describe_subnets; autoscaling describe_auto_scaling_groups	each region	instance_group
LambdaCollector (lambda)	lambda	list_functions, get_policy	each region	lambda
ApiGatewayCollector (apigw)	apigateway, apigatewayv2, elbv2, ec2	REST (v1): get_domain_names, get_base_path_mappings, get_rest_apis, get_stages, get_resources, get_vpc_links. HTTP and WebSocket (v2): get_domain_names, get_api_mappings, get_apis, get_stages, get_integrations, get_routes, get_vpc_links. elbv2 describe_load_balancers for the target of a VPC link; ec2 describe_subnets for its VPC	each region	api_gateway, api_vpc_link

Notes:

• EC2 instances are read as groups, not one by one: one node per Auto Scaling group, per Name tag or per subnet, with the instance count and types.
• Lambda keeps the functions that run in a VPC and those that API Gateway or a load balancer can invoke, found by reading the function policy (at most 500 policies per region). The other functions are not written to the graph.
• API Gateway is read for at most 200 APIs per region and keeps at most 50 integrations per API. API keys and client certificates are never read.
• Target groups list at most 200 targets each; the healthy and unhealthy counts still cover all of them. Listener rules are read for Application Load Balancers only.

Data

Collector	Client	Calls	Scope	Produces
RdsCollector (rds)	rds	describe_db_instances, describe_db_clusters, describe_db_subnet_groups	each region	rds
ElastiCacheCollector (elasticache)	elasticache	describe_replication_groups, describe_cache_clusters, describe_cache_subnet_groups	each region	elasticache
EfsCollector (efs)	efs	describe_file_systems, describe_mount_targets, describe_mount_target_security_groups	each region	efs
S3Collector (s3)	s3	list_buckets; for a bucket that is drawn: get_bucket_location, get_bucket_website, get_public_access_block	home region	s3 (the count), s3_bucket
ReferencedBucketsCollector (s3_referenced)	s3	the per-bucket calls above, for the buckets named by CloudFront origins, Route 53 website aliases and gateway endpoints	home region, after all other collectors	s3_bucket
DynamoDbCollector (dynamodb)	dynamodb	list_tables	each region	dynamodb

Notes:

• A bucket is drawn when it hosts a website or when another collector refers to it. The others are only counted.
• DynamoDB writes one summary node per region with the number of tables and up to 50 names. Table contents and table descriptions are never read.
• Master user names and secret references of databases are dropped from the stored item.

Account services

These do not sit in a VPC. Each collector writes one summary node per account or per region, with counts and flags only, never the objects. A denied call leaves the number as not read and a gap, so a missing permission cannot be mistaken for an empty account.

Collector	Client	Calls	Scope	Produces
CloudTrailCollector (cloudtrail)	cloudtrail	describe_trails (with shadow trails), get_trail_status	home region	cloudtrail
GuardDutyCollector (guardduty)	guardduty	list_detectors, get_detector	each region	guardduty
ConfigCollector (config)	config	describe_configuration_recorders, describe_configuration_recorder_status, describe_delivery_channels	each region	config_recorder
CloudWatchCollector (cloudwatch)	logs, cloudwatch	logs describe_log_groups; cloudwatch describe_alarms (metric alarms, then composite alarms)	each region	cloudwatch
KmsCollector (kms)	kms	list_keys, list_aliases, describe_key	each region	kms
EcrCollector (ecr)	ecr	describe_repositories	each region	ecr

Notes:

• Regions where a service is plainly empty (no repositories, no keys, no log groups or alarms) are left out, to avoid one empty box per region. GuardDuty and AWS Config are always written, because "off in this region" is the finding.
• KMS counts customer managed keys. list_keys also returns AWS managed keys, which a single list_aliases removes; the rest are described (at most 1,000), to skip keys scheduled for deletion. Over that limit the count is not read.
• CloudTrail is read in the home region only. Multi-region and organization trails show up there, but a trail that logs a single other region does not, so a multi-region scan adds a gap (code partial) saying so. That way the trail count is not read as complete.

Cross-account detection

Links to other accounts are found in the fields that name an owner. There is no extra call for them. Each shows in the inventory with the call that revealed it (detected_by).

Link	Where the other account shows
VPC peering	describe_vpc_peering_connections: the owner of the requester and accepter VPCs
Transit Gateway	describe_transit_gateways (owner), describe_transit_gateway_attachments (owner of the resource and of the gateway), describe_transit_gateway_route_tables
Shared VPC, subnet, interface	describe_vpcs, describe_subnets, describe_network_interfaces (owner id)
PrivateLink	describe_vpc_endpoints (service name), describe_vpc_endpoint_connections (endpoint owner)
Prefix list, security group reference	describe_managed_prefix_lists (owner), describe_security_groups (group pairs in rules)
Resolver rule, RAM share	list_resolver_rules (owner and share status), get_resource_shares (owning account)
Direct Connect	describe_direct_connect_gateway_associations, describe_virtual_interfaces (owner account)
Network Firewall	describe_firewall (Transit Gateway owner)

Members that are never stored

Some members of an API answer are removed before anything is kept, in the graph, the inventory, the diagrams or the dashboard:

Member	Where it comes from
CustomerGatewayConfiguration	Site-to-Site VPN connections: it holds the pre-shared keys and the device configuration.
PreSharedKey, authKey	VPN tunnel options and Direct Connect BGP peers.
customerRouterConfig, macSecKeys	Direct Connect virtual interfaces and connections.
ResponseMetadata	Every answer.

Tags are read for naming (the Name tag) and are kept on the node's tags, but are removed from its raw item.

Deliberately out of scope

These are not read, on purpose.

• Anything that changes state. No create, update, delete, tag or attach call is made.
• Contents. No S3 objects, DynamoDB items, secrets, parameters, log events, metric data, KMS key policies, API keys, client certificates or database credentials.
• Rule and policy bodies. Network Firewall rules, WAF rule statements, IAM policies and bucket policies are not read; WAF is reduced to its default action, rule names and the managed rule groups it uses.
• Traffic. No flow logs, reachability analysis or route simulation. The numbered flows on a diagram are derived from the kind of an edge, not from observed traffic.
• Network services without a collector. Global Accelerator (a Route 53 alias to an accelerator is recognised, but the accelerator is not read), VPC Lattice, IPAM, Network Manager and Cloud WAN, Client VPN, traffic mirroring, Verified Access, Outposts local gateways, carrier gateways and VPC route servers.
• Services that attach to subnets but have no collector. MSK, OpenSearch, App Runner, Route 53 Profiles and Cloud Map. Their network interfaces are seen through the network collector and counted as workloads in the subnet.
• Other clouds. AWS only.