# Discovery

Source: https://docs.ops0.com/docs/discovery/overview

Discover cloud resources across AWS, GCP, Azure, and Oracle Cloud, then generate Terraform code to bring them under IaC management. Turn "ClickOps" into Infrastructure as Code.

![ops0 Discovery overview showing discovered cloud resources](https://docs.ops0.com/images/discovery-overview.png)

## How It Works

### Discover
Scan your cloud accounts for resources using the Discovery Wizard.

### Organize
Group discovered resources into logical projects by environment, application, or team.

### Generate
Create production-ready Terraform code using AI-assisted or direct generation.

### Import
Import generated code into an IaC project with state backend configuration and GitHub sync.

## Platform Coverage

4. Cloud Providers

200+

Resource Types

## Cloud Providers

| Provider | Resources | Multi-Account Support |
|----------|-----------|----------------------|
| **AWS** | EC2, VPC, S3, RDS, Lambda, IAM, EKS, ALB, and more | Single account, Organization, or Selected accounts |
| **GCP** | Compute, VPC, Cloud Storage, Cloud SQL, GKE, IAM, and more | Project, Folder, or Organization scope |
| **Azure** | VMs, VNet, Blob Storage, SQL, AKS, NSG, and more | Subscription, Management Group, or Selected subscriptions |
| **Oracle Cloud** | Compute, VCN, Object Storage, Autonomous DB, OKE, and more | Compartment or Tenancy scope |

---

## Discovery Wizard

The Discovery Wizard guides you through the scanning process:

### Select Provider
Choose AWS, GCP, Azure, or Oracle Cloud.

### Choose Integration
Select the cloud integration with credentials for scanning.

### Configure Scope
Set regions, accounts/projects/subscriptions, and resource types to scan.

### Review and Start
Review the configuration and start the discovery session.

---

## Session Management

Discovery sessions track individual scan runs with full lifecycle management.

### Session Statuses

| Status | Description |
|--------|-------------|
| **Pending** | Waiting to start |
| **Scanning** | Currently scanning cloud resources |
| **Paused** | Scan paused; can be resumed |
| **Completed** | Scan finished successfully |
| **Failed** | Encountered errors during scan |

### Session Actions

| Action | Description |
|--------|-------------|
| **Open** | View discovered resources |
| **Pause** | Pause an in-progress scan |
| **Resume** | Resume a paused scan |
| **Re-scan** | Run the scan again with the same configuration |
| **Delete** | Remove the session and its data |

### Session Overview

The session overview page shows:
- Total resources discovered by type and region
- Resource list with metadata, tags, and estimated costs
- Relationship graph between resources
- Session configuration details

---

## IaC Code Generation

After discovering resources, generate Terraform code using one of two modes:

### AI-Assisted Generation

Uses AI to produce optimized Terraform code with:
- Real-time security scanning during generation
- Event streaming for progress tracking
- Intelligent module grouping and variable extraction
- Best-practice patterns applied automatically

### Direct Generation

Generate Terraform code without AI, with progress tracking from 10 to 100 percent:

| Output Mode | Description |
|-------------|-------------|
| **Single file** | All resources in one `main.tf` |
| **Modular project** | Organized into modules by resource type |
| **Flat import** | `main.tf` + `variables.tf` + `outputs.tf` for Terraform import |

---

## Session Comparison

Compare two discovery sessions to detect changes in your infrastructure over time.

Navigate to **Discovery → Compare** to:
- Select two sessions to compare (before/after)
- View added, removed, and modified resources
- See a diff summary of infrastructure changes
- Track drift between scan runs

---

## Resource Timeline

View the history of a resource across discovery sessions at **Discovery → Timeline**:
- When a resource was first discovered
- Configuration changes over time
- Cost changes between scans
- Relationship changes

---

## Cost Estimation

ops0 enriches discovered resources with estimated monthly costs based on:
- Resource type and size
- Region-specific pricing
- Current usage patterns (when available)

| Resource | Example Monthly Cost |
|----------|---------------------|
| EC2 t3.medium (us-east-1) | ~$30.37 |
| RDS db.t3.large (us-east-1) | ~$121.47 |
| NAT Gateway | ~$32.85 + data transfer |
| S3 Standard (1TB) | ~$23.00 |

---

## Supported Resources

Compute

EC2, VMs, Compute Engine, Lambda, Functions

Networking

VPC, VNet, Subnets, Security Groups, NSG, Firewalls

Storage & Database

S3, Blob Storage, Cloud Storage, RDS, Cloud SQL, Cosmos DB

Containers

EKS, AKS, GKE, OKE, ECS, Container Apps, Cloud Run

Security & IAM

IAM Roles, Service Accounts, Key Vault, KMS, Secrets Manager

Load Balancing & CDN

ALB, NLB, App Gateway, CloudFront, Front Door, Cloud CDN

[View complete resource support matrix →](https://docs.ops0.com/docs/discovery/supported-resources)

---

## Prerequisites

Before You Start

• **Cloud Integration** configured in [Settings → Integrations](https://docs.ops0.com/docs/settings/integrations)

• **AWS:** IAM Role with `Describe*` and `List*` permissions

• **GCP:** Service Account with Viewer role

• **Azure:** Service Principal with Reader role

• **Oracle Cloud:** API key with compartment-level read access

---

## Key Features

| Feature | Description |
|---------|-------------|
| **Multi-Region Scanning** | Scan resources across all regions simultaneously |
| **Organization Scanning** | Discover resources across AWS Organizations, GCP folders, Azure management groups, Oracle tenancies |
| **Relationship Extraction** | Automatically map dependencies between resources |
| **Cost Estimation** | Estimate monthly costs for discovered resources |
| **Session Comparison** | Compare sessions to detect infrastructure drift |
| **AI Code Generation** | Generate optimized Terraform with AI assistance |
| **GitHub Sync** | Push generated code directly to a GitHub repository |
| **Pause & Resume** | Pause long-running scans and resume later |
| **Security Scanning** | Automatic Nuclei vulnerability scan on scan completion — produces a risk grade (A–F) and per-resource findings |
| **Resource Timeline** | Per-resource history across all sessions — see every configuration change, cost shift, and deletion |
| **Discovery Projects** | Group resources into named projects with separate state backends before generating IaC |

---

## Related

- [Scanning Resources](https://docs.ops0.com/docs/discovery/scanning): Configure and run discovery scans across cloud providers.

- [Importing Resources](https://docs.ops0.com/docs/discovery/importing): Generate Terraform code and import into IaC projects.

- [Drift Detection](https://docs.ops0.com/docs/discovery/drift-detection): Compare cloud state against Terraform expected state.

- [Resource Timeline](https://docs.ops0.com/docs/discovery/timeline): Track per-resource configuration history across all sessions.

- [Discovery Projects](https://docs.ops0.com/docs/discovery/projects): Organise resources into projects before generating IaC.

- [Security Scanning](https://docs.ops0.com/docs/discovery/security-scanning): Automatic vulnerability scanning with risk grades.