Our small research team recently started using AWS, and resources are being created and managed by different people without a consistent inventory or documentation process. Since our projects change frequently, we need a practical way to discover what exists in the account, understand resource relationships and configuration, and export that information in a format that can be used as context for AI-assisted troubleshooting or for writing infrastructure-as-code. We are especially interested in established tools rather than building a custom discovery system from scratch. Ideally, the solution would support read-only access, work across the services we use, and produce useful JSON, CSV, queries, or generated IaC.
4 Answers
Steampipe is a strong option if you want a flexible, exportable inventory. It exposes AWS resources through SQL, so you can query the live account and write the results to JSON or CSV for documentation, AI context, or follow-up automation. You can schedule recurring exports and use narrowly scoped read-only permissions. For a large environment, keep an eye on how many API calls the queries generate.
For a quick first pass, AWS CloudFormation IaC generator can inspect existing resources and produce a CloudFormation template. It will not perfectly capture every dependency or turn an unmanaged environment into production-ready IaC automatically, but it can provide a useful starting point. I would review the generated template carefully and import resources incrementally rather than applying everything blindly.
AWS Config is probably the best native starting point. It records the configuration of supported resources, their relationships, and how those configurations change over time. It can also support compliance checks and remediation later, so it is more useful than a one-time inventory export. If you have multiple accounts, aggregating Config data can give you an organization-wide view.
Former2 is another discovery-to-IaC option worth evaluating. It can scan an AWS environment and generate templates for many resource types, which is handy when you are trying to document an account that was built manually. For an AI-assisted workflow, a read-only AWS connection can also be used to inspect resources and generate documentation or IaC, but I would keep the output in version control and require human review before any changes are applied. AWS Resource Explorer and the Tag Editor can also help with basic discovery, although they are less comprehensive than Config or Steampipe.
That sounds closer to what we need than a tool that only generates templates. Being able to select exactly which services and fields go into the exported context would be useful.