I've been using a cloud environment for a while, and as the number of resources has grown, it's becoming difficult to see what's currently running, what's actually being used, and what is driving costs. I have compute instances, object storage, databases, and other services spread across several areas of the console. How do you usually manage this visibility? Do you rely on the provider's console, infrastructure as code, cost tools, monitoring scripts, or something else?
4 Answers
Infrastructure as code doesn’t catch every orphaned resource. Occasionally a deployment can report an error even though the provider created the instance or database in the background, leaving it outside the tool’s state. A scheduled script that inventories important resources across every region is a useful safety net. Cost reports help too, but they usually aren’t real-time.
A combination of Terraform, a secrets-management tool, and a query layer such as Steampipe can give you a searchable inventory without relying on each individual service page. For security and broader asset visibility, dedicated cloud-security platforms can also help, although their pricing may be significant.
For larger setups, separate projects into dedicated accounts when possible and use a deployment framework such as CDK to keep each project organized. I mostly use the console for checking settings or investigating an issue; normal changes go through code and the command line.
Infrastructure as code is the biggest improvement. Keep Terraform, Pulumi, CDK, or a similar setup in source control so your resources are defined in one place and unnecessary infrastructure is easier to remove. Enforcing consistent tags also makes ownership, environments, and cost allocation much clearer.
The main thing I’d compare before choosing a security platform is the annual cost versus simply maintaining an internal inventory and monitoring script.