Skip to tutorial content
Rate module Not yet rated

How Cloud Discovery Works: API vs IP

4 min read
On this page

In this lesson, you will learn:

  • How Cloud Discovery differs from IP-based Discovery
  • What each one finds in AWS
  • Why SNWR uses both

🔁 Quick look back: Last time: Packaging and Promoting the Pattern Safely. You learned how the archiver pieces were packaged and promoted.

1 The Problem: You Can’t Scan a Cloud Account Like a Server Room

In AWS, many resources have no server to log in to. And the account itself isn’t an IP address. So:

  • IP scans miss databases, networks and settings.
  • Only the cloud’s APIs know the full picture.

🎯 The problem: You can’t scan a cloud account like a server room.

👉 The fix: Use Cloud Discovery for the account, and IP-based Discovery inside it for the servers.

Compare Cloud API and IP-based discovery in AWS.
Figure 1. Two ways to see SNWR’s AWS account.

2 How Cloud Discovery works

  1. A MID Server calls the cloud provider’s APIs.
  2. It uses a cloud credential with read-only rights.
  3. It returns cloud resources, like instances and networks.
  4. Results go through IRE into cloud classes in the CMDB.

Key term: Cloud Discovery

Discovery that reads a cloud account’s APIs instead of scanning IP addresses.

3 Why use both

Cloud APIs show the EC2 instance. Only a login shows what runs inside it. Together they give the full picture.

4 Project Clear View: How We Implemented It

📍 Situation: Kenji asked why Discovery can’t just scan the AWS subnets.

🧭 Decision: Explain API and IP discovery, and plan both for SNWR’s account.

🛠️ Steps we took:

  1. Showed Kenji what Cloud Discovery reads from AWS.
  2. Showed what an IP scan inside the VPC adds.
  3. Agreed both run through snwr-mid-aws-01.
  4. Confirmed this matches DD-D02.

✅ What we verified:

  • Kenji agreed the approach.
  • The plan uses both methods.

📁 Evidence: Cloud notes for the rest of this chapter.

5 Quick recap

  • Cloud Discovery reads the provider’s APIs.
  • It finds accounts, networks, instances and services.
  • IP-based Discovery inside the VPC finds what runs on servers.
  • SNWR uses both.

6 Check yourself

Think of your answer first. Then tap to check.

1 What does Cloud Discovery use instead of IP scans? Show answer

The cloud provider’s APIs.

2 What does the IP scan inside the VPC add? Show answer

The OS, software and processes on each EC2 server.

3 Which MID Server handles AWS at SNWR? Show answer

snwr-mid-aws-01.

Nice work! You know how cloud discovery works. 🎉
Next up: Cloud Account and IAM Prerequisites

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.