Skip to content
Start free

Map every cloud account you run

Cloud discovery inventories your AWS accounts, Azure subscriptions and Google Cloud projects with read-only credentials, every five minutes. Each account becomes an environment with a diagram, a resource list, its security groups and its container clusters, linked to the hosts and clusters you already monitor.

Start freeBook a demoRead the cloud docs
  • AWS · Azure · Google Cloud
  • Agentless by default
  • Read-only credentials

How it works

From a read-only role to a map of every account

Discovery runs agentless by default, with credentials you create and can revoke at any time.

  1. 01Create credentialsA cross-account role with an external ID for AWS, a Reader service principal for Azure, a Viewer service account for Google Cloud.
  2. 02Turn on discoveryAdd the discovery integration for each provider. By default it runs agentless, in your workspace's gateway.
  3. 03ScanEvery region the account has enabled, every five minutes by default, for the services you choose.
  4. 04MapEach account becomes an environment with a diagram, a resource list, security groups and container clusters.
  5. 05MatchInstances and Kubernetes clusters link to the hosts, pods and services your collectors already monitor.
  6. 06Add telemetryOptionally add CloudWatch metrics and logs, Azure Monitor metrics and Event Hub logs, or Google Cloud data through Pub/Sub.

Security groups

See what each account exposes to the internet

The security view lists every security group, network security group and firewall rule with its inbound and outbound rules and what it is attached to. Groups open to the internet and groups attached to nothing are one click away.

  • Rules from AWS, Azure and Google Cloud are read into one shape
  • Filter by exposure, attachment, region or network
  • Export any view of an environment as a PDF

Discovery

Read-only discovery, with no agent in your accounts

By default, discovery runs agentless in your workspace's gateway, with credentials you create and can revoke. It uses your identity, never Tracix's, and AWS roles trust your workspace through an external ID that is unique to it.

  • AWS

    EC2, RDS, load balancers, S3, Lambda, ECS, EKS, CloudFront and Route 53, plus Cloud Control for more types.

  • Azure

    Virtual machines, networks, SQL, load balancers, storage, Functions, AKS, CDN and DNS.

  • Google Cloud

    Compute Engine, Cloud SQL, load balancing, storage, Cloud Functions, Cloud Run, GKE, CDN and DNS.

  • AWS Organizations

    Scan every active account in the organization through a role you name in each one.

Containers and matching

Cloud clusters, matched to what you already watch

The containers view shows ECS clusters with their services and tasks, and EKS, AKS and GKE clusters with their node groups. When a collector already monitors a cluster, its live nodes, pods and namespaces appear beside it.

  • Instances link to the monitored host by instance ID, ARN or host name
  • A matched host lists the pods and services that ran on it in the last 24 hours
  • The list view filters every resource by category, type, region, status and whether it is monitored

Better together

Cloud resources, next to the telemetry they produce

Discovered accounts share a workspace with your hosts, clusters and posture checks, so an instance on the map is one click from its metrics and logs.

Supported providers

What Tracix reads from each cloud

Discovery and cloud telemetry run agentless in your workspace's gateway by default, or on your own collectors when credentials only work inside your cloud.

ProviderCredentialsDiscoveredMetrics and logs
AWSCross-account role with an external ID, or an access keyEC2, RDS, load balancers, S3, Lambda, ECS, EKS, CloudFront, Route 53, and Cloud Control typesCloudWatch metrics by namespace and CloudWatch Logs
AzureService principal with ReaderVirtual machines, networks, SQL, load balancers, storage, Functions, AKS, CDN, DNSAzure Monitor metrics, and logs you stream to an Event Hub
Google CloudService account with ViewerCompute Engine, Cloud SQL, load balancing, storage, Cloud Functions, Cloud Run, GKE, CDN, DNSMetrics, logs and traces you export to Pub/Sub

Discovery scans every region the account has enabled, every five minutes by default; you can limit it to some regions or services.

FAQ

Questions cloud teams ask first

Talk to an engineer
Do I install anything in my cloud accounts?
No. By default, discovery runs agentless in your workspace's gateway with read-only credentials you create: a cross-account role with an external ID, or an access key, for AWS; a service principal with Reader for Azure; and a service account with Viewer for Google Cloud. You can run it on your own collectors instead.
Can Tracix read Google Cloud metrics and logs directly?
Not today. Google Cloud projects are inventoried through their APIs, but metrics, logs and traces arrive only through a Pub/Sub subscription you export them to.
Does Tracix read VPC flow logs?
No. Connections between hosts and pods come from collectors running on them, not from cloud flow logs.
Is this cloud security posture management?
No. The security view shows security groups and firewall rules and what they expose. Posture checks with Prowler are a separate product that connects to the same accounts.

Connect your first cloud account

Create a read-only role, add the discovery integration, and the first environment appears after its first scan.

Start freeRead the cloud integration docs