Exactly where our depth ends.
Most tools sell you the word “complete.” We’d rather show you the edge of our coverage so you know precisely what you’re getting, and what you’re not.
Field-level cross-check
200 resource types get a true field-level diff: desired state against live reality, property by property, naming the exact field that moved. How many of the 200 you get depends on where your Terraform state lives, not on which cloud you run.
also Terraform Enterprise, or a local plan file
68 Azure types and all 59 GCP types, field-level. On AWS, security groups only.
Two Azure types (role assignments and role definitions) are reachable only on this path. The AWS limit is the one to know before you evaluate: from a plan we field-diff security groups and nothing else.
S3, GCS, or Azure Blob
All 62 AWS types, all 59 GCP types, and 77 of 79 Azure types, field-level.
This is the path that unlocks AWS depth: every AWS spec runs here, against one on the plan path. Azure loses only role assignments and role definitions.
Helm release records, no GitOps tool needed
Deployments, StatefulSets, DaemonSets, Services, ConfigMaps, Ingress, NetworkPolicies, Jobs, CronJobs, HorizontalPodAutoscalers, PersistentVolumeClaims, ServiceAccounts, ClusterRoles, ClusterRoleBindings, Roles, RoleBindings.
Helm’s own stored release manifest is the desired state and a live API read is the actual, so no Argo or Flux is required. Secret values are never read or diffed.
Unmanaged-resource detection
A different question, and a different list: what is running that no Terraform state declares? This is the half terraform plan structurally cannot answer, so the coverage is broader than the field-level set above.
79 types
Every Azure type above. Across the subscriptions your credential can see.
64 types
The 62 above, plus 2 enumerated-only types. One account per credential.
59 types
The 59 above, plus 0 enumerated-only types. One project per credential.
Managed-state sources
Where Cloudkeel-DD learns what’s supposed to be running.
Reads the workspace’s plan JSON over the API, including the resources Terraform’s own refresh already found drifted.
Same as Terraform Cloud, against your own hostname.
Reads a terraform show -json plan file, no Terraform Cloud account needed.
Reads raw .tfstate straight from your bucket or container. This is the path that unlocks field-level AWS coverage.
Helm’s own release records, read from the cluster.
Managed-resource state via the ArgoCD API.
HelmRelease / Kustomization drift via the Kubernetes API.
Where the depth ends
The honest edges. Everything below is either by design or on the roadmap, and stated up front rather than discovered in week three.
- Field-level coverage is path-dependent, and the two paths are not equal. AWS is the sharpest asymmetry: on the Terraform Cloud path you get security groups only, while raw state gets all 62 AWS types. If AWS depth is what you need, point us at your state bucket.
- Two Azure types are plan-path only: role assignments and role definitions. Raw state cannot cross-check them today. (GCP service accounts and IAM custom roles used to sit on this list; both are raw-state cross-checked now.)
- 2 types are enumerated for unmanaged detection but never field-diffed: aws_eip, aws_route_table. We will tell you they exist and that nothing declares them. We will not tell you which field changed.
- Unmanaged detection needs a connected Terraform state source to define what “managed” means. A cloud credential on its own produces no findings; it is the cross-check, never the scan target.
- There is no filter for service-created resources yet, so your first scan will flag things your cloud provider made: default VPC security groups, service-linked roles, GCP
default-allow-*firewall rules. Expect noise on scan one, and tell us which patterns to baseline. - One AWS account or GCP project per connected credential. No AssumeRole, no Organizations-wide discovery. Azure is the exception: one credential covers every subscription it can read.
- SSO / SAML is on the roadmap, not shipped. Today it is email and password with per-tenant roles: owner, admin, viewer.
- Reports export to CSV as aggregate metrics. There is no per-finding export and no PDF.