Run and review Cloud Discovery

Cloud Discovery helps your team understand what already exists in an approved AWS or Azure scope. ScrinCloud checks access, scans supported services, reads resource metadata, maps supported relationships, and prepares results for review.

Discovery is an evidence-gathering workflow. Seeing a resource does not make it managed: discovery does not automatically adopt resources or authorize a Terraform change.

Typical time

10–30 minutes

You need

A healthy cloud connection

Next step

Review management and drift

Before you begin

Confirm that:

• the intended project and optional workspace are active;
• the selected provider account is Healthy;
• Check access succeeds;
• the selected region is approved and allowed by the connection; and
• no other user expects a different scope for this run.

If the panel does not show Ready to start, complete Set up Cloud Discovery first.

Caution

Discovery is read-only and will not create, update, or delete cloud resources. Keep provider permissions least-privilege even when a service cannot be read.

Step 1: Open the discovery entry point

From Architecture Studio:

1. Open the Discovery area.
2. Choose Quick intro if you want to review the process.
3. In Start Cloud Discovery, read the six stages:
   • check account access;
   • scan supported services;
   • discover resources and configuration;
   • build relationships;
   • show supported resources on the canvas; and
   • review and adopt only when ready.
4. Confirm the Read-only label and safety notice.
5. Return to Run read-only discovery.

You can also use Discovery Operations for project-scoped run history and operational review. This guide starts from the canvas entry point and then moves to that page.

Discovery 1 of 7 · Screenshot placeholder

Review how read-only discovery works

Show Start Cloud Discovery with the six process stages, Read-only label, and the trust statements.

Future capture briefUse the guide before selecting a real account. Ensure no account, subscription, tenant, project, or resource identifiers are visible.

Step 2: Select account and region

1. Under Account, choose the tested cloud connection.
2. Under Region, choose one of the connection’s allowed regions.
3. Confirm the account provider matches the project provider.
4. Choose Check access.
5. Wait for the access-check success notice.
6. Confirm Ready to start.

ScrinCloud only offers active, healthy connections that are eligible for the project provider. The region list is limited by the selected connection.

Discovery 2 of 7 · Screenshot placeholder

Choose the approved scan scope

Show Account, Region, Check access, and Ready to start for a synthetic connection.

Future capture briefUse a documentation-only account label and one approved example region. Hide account IDs, tenant data, and connection identity details.

Step 3: Start the discovery run

1. Recheck the project, optional workspace, account, and region.
2. Choose Start Discovery.
3. Wait for the button’s Starting discovery… state to finish.
4. Confirm the Discovery started notification.
5. Do not click the action repeatedly. Duplicate submissions are disabled while the request starts.

Each request creates a run that can be reviewed later. Starting a new run does not apply infrastructure and does not replace earlier audit evidence.

Discovery 3 of 7 · Screenshot placeholder

Start the read-only scan

Show Start Discovery in progress or the Discovery started confirmation with the selected synthetic scope.

Future capture briefCapture immediately after starting a synthetic run. Keep the read-only statement visible and remove provider-account identifiers.

Step 4: Follow the run status

The status panel can show:

• Queued: the request is waiting for a worker.
• Scanning: supported metadata is being collected.
• Completed: the run finished successfully.
• Completed with warnings: useful results exist, but part of the scope failed or could not be processed.
• Failed: the selected scope could not be discovered.
• Cancelled: the run ended before completion.

While work is active, review the region and Resources found count. Treat the count as progress information, not a final inventory total.

Discovery 4 of 7 · Screenshot placeholder

Track queued, scanning, and final status

Show a run status panel with status, selected region, resources found, and the read-only message.

Future capture briefUse a synthetic run in Scanning or Completed with warnings. Avoid capturing raw logs, request IDs, resource identifiers, or internal service details.

Step 5: Review the result summary

For a completed run, review:

• Supported: resources ScrinCloud can represent through its approved product model.
• Unsupported: resources seen by discovery but not approved for normal canvas and management workflows.
• Status: Discovery complete or Completed with warnings.

Unsupported does not necessarily mean the cloud resource is invalid. It means the current ScrinCloud resource type, property model, Terraform mapping, validation support, or entitlement is not ready for normal adoption.

Do not substitute an inaccurate supported resource merely to remove something from the unsupported count.

Discovery 5 of 7 · Screenshot placeholder

Separate supported and unsupported results

Show the completed result summary with Supported, Unsupported, and Status.

Future capture briefUse small synthetic counts and no resource names. A Completed with warnings example should include only a safe user-facing reason.

Step 6: Open Discovery Operations

Use Discovery Operations to review durable project-scoped evidence:

1. Select the intended project.
2. Select the cloud account.
3. Select the region.
4. Choose a workspace or leave Project-level scope when appropriate.
5. Open Discovery Runs.
6. Use search, status, account, region, workspace, or date filters to locate the run.
7. Select the run ID to open its details.
8. Review status, scope, supported count, unsupported count, failed collection items, coverage statement, known limits, and safe timeline.

The run drawer may offer governed actions such as Cancel, Retry failed only, Archive run, Delete discovery run, or Run full discovery again, depending on the current status.

Deleting a run removes visible run history and associated discovery results from this page. It does not delete cloud resources or modify Terraform, canvas state, adoption, drift, or reconciliation records.

Discovery 6 of 7 · Screenshot placeholder

Review a discovery run in Operations

Show Discovery Operations scope controls, Discovery Runs, and a run drawer with safe status, counts, coverage, and timeline.

Future capture briefUse synthetic scope labels and sanitized evidence. Exclude raw provider payloads, role identifiers, queue or bucket details, stack traces, and customer resources.

Step 7: Review incomplete and unsupported scope

For Completed with warnings or Failed:

1. Open the run.
2. Review Failed discovery scope.
3. Separate retryable failures from unsupported resources.
4. Use Retry failed only only when the recorded failed scope is still approved.
5. Use a full rerun when the complete approved inventory must be refreshed.

Then open Unsupported Resources:

1. Review provider, service, display name, region, and safe support reason.
2. Open details when you need the current product-support explanation.
3. Use Request support if the resource is important to your design.
4. Do not treat unsupported resources as normal canvas nodes.

Discovery 7 of 7 · Screenshot placeholder

Review failed and unsupported scope

Show a safe failed-scope table beside or followed by the Unsupported Resources tab and its support reason.

Future capture briefUse synthetic resource types and masked IDs. Show a safe error code or user-facing reason, never a stack trace, credential, ARN, or raw provider response.

Check your result

The run is ready for management review when:

• the final status is understood;
• account, region, project, and workspace scope are correct;
• supported and unsupported results are reviewed separately;
• failed scope has been retried or recorded as a known limitation;
• the coverage statement and known limits are understood; and
• no discovered item has been mistaken for an automatically managed resource.

Common blockers

Start Discovery is disabled

Choose an eligible account and allowed region. Run Check access and resolve connection health problems first.

Discovery remains Queued

Keep the run page open or return through Discovery Operations later. Do not start repeated runs simply because a worker has not begun yet.

The run completes with warnings

Review failed scope and unsupported resources separately. Retry only approved, retryable failures; record the remaining limitation.

The run fails

Read the safe failure reason, test the cloud connection, confirm the allowed region and permission probes, then retry. Never paste raw credentials or provider payloads into a support request.

The result count is lower than expected

Check the selected account, region, coverage statement, known limits, failed scope, and unsupported list. Do not broaden permissions until the missing read capability is identified and approved.

A discovered resource is absent from the canvas

It may be unsupported, filtered, outside the selected region, or not adopted. Review the run and unsupported results before adding a manual replacement.

Continue

Discovery evidence is now ready for deliberate management, drift, and reconciliation decisions.

Continue with Manage resources and drift.