Coverage

Cloudkeel-DD is honest about coverage: capabilities are marked Shipped or Gap, and every discovered resource type that isn’t field-diffed is tracked as inventory — clearly labelled, never silently assumed clean.

Field-level drift

The field-level diff engine covers 200 resource types — 79 Azure, 62 AWS, 59 GCP. Which of the 200 are cross-checked against your live cloud depends on where the desired state comes from, not on which cloud it is. There are two paths and they are not equal:

Desired-state source	Azure	AWS	GCP
Terraform Cloud / Enterprise, or a local plan file	68	1 — security groups only	59
Raw `.tfstate` in S3, GCS, or Azure Blob	77	62	59

The gaps are specific, not approximate:

AWS on the plan path cross-checks security groups only. All 62 AWS types are cross-checked from raw state — so if AWS is your centre of gravity, connect a state bucket rather than relying on Terraform Cloud alone. This is the single largest asymmetry on the page.
Azure role assignments and role definitions are cross-checked on the plan path only. The raw-state path has no ARM api-version entry for them.
No type is unreachable on both paths.

A type with no spec is never field-diffed. It is annotated live_comparison: unavailable with a reason and counted as inventory — there is deliberately no fallback raw diff.

What “verified” means

Two different bars, kept separate:

Engine-verified — the type’s normalizer passes golden-fixture tests: a clean case plus a drifted case for every field the spec declares, over synthetic desired-vs-live payloads. All 200 types meet this bar.
Proven against a real cloud account — exercised end-to-end against live infrastructure, with the finding confirmed in the database. This subset is smaller:

Cloud Proven live
Azure NSG rules
AWS Security-group rules
GCP Firewall rules
Kubernetes Drift across real AKS, EKS and GKE clusters

Three cloud resource types, against 200 engine-verified. That ratio is wide and we publish it rather than average it: the engine bar grew sharply in 2026; the live-proof bar did not move with it. A spec passing golden fixtures is not the same as a mapping confirmed against a live API.

Cloud	Proven live
Azure	NSG rules
AWS	Security-group rules
GCP	Firewall rules
Kubernetes	Drift across real AKS, EKS and GKE clusters

Unmanaged detection

A different mechanism with different coverage: unmanaged detection asks what is running that no Terraform state declares.

Cloud	Enumerated types
Azure	79
AWS	64
GCP	59
Kubernetes	6 kinds — Deployments, StatefulSets, DaemonSets, Services, ConfigMaps, Ingress

Two limits worth knowing before your first scan:

It runs across enumerated types only. A resource of a non-enumerated type is not flagged. Two enumerated types are never field-diffed: AWS EIPs and route tables. Every enumerated Azure and GCP type is field-diffed.
On the three clouds it needs a connected Terraform state source to define what “managed” means. A cloud credential alone produces no findings. Kubernetes is the exception — ownership is read from each object’s own metadata, so it needs no state source.

Kubernetes

Kubernetes coverage does not depend on a Terraform state source at all.

Field-level drift on 6 kinds, comparing Helm’s stored release manifest against a live API read.
Unmanaged workload detection on the same 6 kinds. Ownership is read from the object’s own metadata — Helm’s app.kubernetes.io/managed-by label and meta.helm.sh/release-name annotation, or ArgoCD’s tracking-id annotation and instance labels. An object whose ownership metadata has been stripped reads as unmanaged.
Out-of-band edit detection on already-managed objects, from metadata.managedFields.

Coverage tables

Generated at build time from the product’s own type registry.

Enumerated types — detected as unmanaged. A field-diff spec means changes to a managed one of these are also caught at field level.

Azure — 79 enumerated types

Resource type	Field-diff spec
`azurerm_api_management`	✓
`azurerm_app_configuration`	✓
`azurerm_application_gateway`	✓
`azurerm_application_insights`	✓
`azurerm_automation_account`	✓
`azurerm_availability_set`	✓
`azurerm_bastion_host`	✓
`azurerm_batch_account`	✓
`azurerm_cognitive_account`	✓
`azurerm_container_app`	✓
`azurerm_container_registry`	✓
`azurerm_cosmosdb_account`	✓
`azurerm_data_factory`	✓
`azurerm_databricks_workspace`	✓
`azurerm_disk_encryption_set`	✓
`azurerm_eventgrid_domain`	✓
`azurerm_eventgrid_topic`	✓
`azurerm_eventhub`	✓
`azurerm_eventhub_namespace`	✓
`azurerm_express_route_circuit`	✓
`azurerm_firewall`	✓
`azurerm_firewall_policy`	✓
`azurerm_healthcare_service`	✓
`azurerm_image`	✓
`azurerm_iothub`	✓
`azurerm_key_vault`	✓
`azurerm_kubernetes_cluster`	✓
`azurerm_lb`	✓
`azurerm_linux_function_app`	✓
`azurerm_linux_virtual_machine`	✓
`azurerm_linux_virtual_machine_scale_set`	✓
`azurerm_linux_web_app`	✓
`azurerm_local_network_gateway`	✓
`azurerm_log_analytics_workspace`	✓
`azurerm_logic_app_workflow`	✓
`azurerm_machine_learning_workspace`	✓
`azurerm_managed_disk`	✓
`azurerm_maps_account`	✓
`azurerm_monitor_action_group`	✓
`azurerm_monitor_activity_log_alert`	✓
`azurerm_monitor_diagnostic_setting`	✓
`azurerm_monitor_metric_alert`	✓
`azurerm_mssql_database`	✓
`azurerm_mssql_elasticpool`	✓
`azurerm_mssql_managed_instance`	✓
`azurerm_mssql_server`	✓
`azurerm_mysql_flexible_server`	✓
`azurerm_nat_gateway`	✓
`azurerm_network_interface`	✓
`azurerm_network_security_group`	✓
`azurerm_notification_hub_namespace`	✓
`azurerm_postgresql_flexible_server`	✓
`azurerm_private_endpoint`	✓
`azurerm_proximity_placement_group`	✓
`azurerm_public_ip`	✓
`azurerm_purview_account`	✓
`azurerm_recovery_services_vault`	✓
`azurerm_redis_cache`	✓
`azurerm_role_assignment`	✓
`azurerm_role_definition`	✓
`azurerm_route_table`	✓
`azurerm_search_service`	✓
`azurerm_servicebus_namespace`	✓
`azurerm_servicebus_queue`	✓
`azurerm_servicebus_topic`	✓
`azurerm_signalr_service`	✓
`azurerm_snapshot`	✓
`azurerm_static_web_app`	✓
`azurerm_storage_account`	✓
`azurerm_storage_container`	✓
`azurerm_storage_share`	✓
`azurerm_synapse_workspace`	✓
`azurerm_traffic_manager_profile`	✓
`azurerm_virtual_network`	✓
`azurerm_virtual_network_gateway`	✓
`azurerm_web_application_firewall_policy`	✓
`azurerm_windows_function_app`	✓
`azurerm_windows_virtual_machine`	✓
`azurerm_windows_web_app`	✓

AWS — 64 enumerated types

Resource type	Field-diff spec
`aws_accessanalyzer_analyzer`	✓
`aws_appsync_graphql_api`	✓
`aws_athena_workgroup`	✓
`aws_autoscaling_group`	✓
`aws_backup_vault`	✓
`aws_batch_compute_environment`	✓
`aws_cloudfront_distribution`	✓
`aws_cloudtrail`	✓
`aws_cloudwatch_event_bus`	✓
`aws_cloudwatch_event_rule`	✓
`aws_cloudwatch_log_group`	✓
`aws_cloudwatch_metric_alarm`	✓
`aws_codebuild_project`	✓
`aws_cognito_identity_pool`	✓
`aws_cognito_user_pool`	✓
`aws_config_config_rule`	✓
`aws_db_instance`	✓
`aws_dynamodb_table`	✓
`aws_ebs_volume`	✓
`aws_ec2_managed_prefix_list`	✓
`aws_ec2_transit_gateway`	✓
`aws_ecr_repository`	✓
`aws_ecs_cluster`	✓
`aws_efs_access_point`	✓
`aws_efs_file_system`	✓
`aws_eip`	—
`aws_eks_cluster`	✓
`aws_elasticache_replication_group`	✓
`aws_flow_log`	✓
`aws_globalaccelerator_accelerator`	✓
`aws_guardduty_detector`	✓
`aws_iam_openid_connect_provider`	✓
`aws_iam_policy`	✓
`aws_iam_role`	✓
`aws_iam_saml_provider`	✓
`aws_iam_user`	✓
`aws_instance`	✓
`aws_kinesis_stream`	✓
`aws_kms_key`	✓
`aws_lambda_function`	✓
`aws_lb`	✓
`aws_lb_listener`	✓
`aws_lb_target_group`	✓
`aws_memorydb_cluster`	✓
`aws_msk_cluster`	✓
`aws_nat_gateway`	✓
`aws_network_interface`	✓
`aws_networkfirewall_firewall`	✓
`aws_networkfirewall_firewall_policy`	✓
`aws_opensearch_domain`	✓
`aws_rds_cluster`	✓
`aws_redshift_cluster`	✓
`aws_route53_zone`	✓
`aws_route_table`	—
`aws_s3_bucket`	✓
`aws_security_group`	✓
`aws_sfn_state_machine`	✓
`aws_sns_topic`	✓
`aws_ssm_document`	✓
`aws_subnet`	✓
`aws_transfer_server`	✓
`aws_vpc`	✓
`aws_vpc_endpoint`	✓
`aws_vpn_connection`	✓

GCP — 59 enumerated types

Resource type	Field-diff spec
`google_apigee_organization`	✓
`google_artifact_registry_repository`	✓
`google_bigquery_dataset`	✓
`google_bigquery_table`	✓
`google_certificate_manager_certificate`	✓
`google_cloud_run_v2_service`	✓
`google_cloudfunctions2_function`	✓
`google_compute_address`	✓
`google_compute_backend_service`	✓
`google_compute_disk`	✓
`google_compute_firewall`	✓
`google_compute_forwarding_rule`	✓
`google_compute_global_address`	✓
`google_compute_global_forwarding_rule`	✓
`google_compute_health_check`	✓
`google_compute_image`	✓
`google_compute_instance`	✓
`google_compute_instance_group_manager`	✓
`google_compute_network`	✓
`google_compute_network_endpoint_group`	✓
`google_compute_packet_mirroring`	✓
`google_compute_region_backend_service`	✓
`google_compute_region_health_check`	✓
`google_compute_route`	✓
`google_compute_router`	✓
`google_compute_security_policy`	✓
`google_compute_snapshot`	✓
`google_compute_ssl_certificate`	✓
`google_compute_ssl_policy`	✓
`google_compute_subnetwork`	✓
`google_compute_target_http_proxy`	✓
`google_compute_target_https_proxy`	✓
`google_compute_url_map`	✓
`google_compute_vpn_tunnel`	✓
`google_container_cluster`	✓
`google_container_node_pool`	✓
`google_dataproc_cluster`	✓
`google_dns_managed_zone`	✓
`google_dns_policy`	✓
`google_dns_response_policy`	✓
`google_filestore_instance`	✓
`google_kms_crypto_key`	✓
`google_logging_metric`	✓
`google_memcache_instance`	✓
`google_monitoring_alert_policy`	✓
`google_monitoring_notification_channel`	✓
`google_monitoring_uptime_check_config`	✓
`google_notebooks_instance`	✓
`google_project_iam_custom_role`	✓
`google_pubsub_subscription`	✓
`google_pubsub_topic`	✓
`google_redis_instance`	✓
`google_secret_manager_secret`	✓
`google_service_account`	✓
`google_spanner_instance`	✓
`google_sql_database_instance`	✓
`google_storage_bucket`	✓
`google_vpc_access_connector`	✓
`google_workflows_workflow`	✓

Field-level spec coverage — 200 types

Resource type	Cloud	Engine-verified	Cross-check: plan source	Cross-check: raw state
`azurerm_api_management`	azure	✓	✓	✓
`azurerm_app_configuration`	azure	✓	✓	✓
`azurerm_application_gateway`	azure	✓	✓	✓
`azurerm_application_insights`	azure	✓	✓	✓
`azurerm_automation_account`	azure	✓	✓	✓
`azurerm_availability_set`	azure	✓	✓	✓
`azurerm_bastion_host`	azure	✓	✓	✓
`azurerm_batch_account`	azure	✓	✓	✓
`azurerm_cognitive_account`	azure	✓	✓	✓
`azurerm_container_app`	azure	✓	✓	✓
`azurerm_container_registry`	azure	✓	✓	✓
`azurerm_cosmosdb_account`	azure	✓	✓	✓
`azurerm_data_factory`	azure	✓	✓	✓
`azurerm_databricks_workspace`	azure	✓	✓	✓
`azurerm_disk_encryption_set`	azure	✓	✓	✓
`azurerm_eventgrid_domain`	azure	✓	✓	✓
`azurerm_eventgrid_topic`	azure	✓	✓	✓
`azurerm_eventhub`	azure	✓	—	✓
`azurerm_eventhub_namespace`	azure	✓	✓	✓
`azurerm_express_route_circuit`	azure	✓	✓	✓
`azurerm_firewall`	azure	✓	✓	✓
`azurerm_firewall_policy`	azure	✓	✓	✓
`azurerm_healthcare_service`	azure	✓	✓	✓
`azurerm_image`	azure	✓	✓	✓
`azurerm_iothub`	azure	✓	✓	✓
`azurerm_key_vault`	azure	✓	✓	✓
`azurerm_kubernetes_cluster`	azure	✓	✓	✓
`azurerm_lb`	azure	✓	✓	✓
`azurerm_linux_function_app`	azure	✓	—	✓
`azurerm_linux_virtual_machine`	azure	✓	✓	✓
`azurerm_linux_virtual_machine_scale_set`	azure	✓	✓	✓
`azurerm_linux_web_app`	azure	✓	✓	✓
`azurerm_local_network_gateway`	azure	✓	✓	✓
`azurerm_log_analytics_workspace`	azure	✓	✓	✓
`azurerm_logic_app_workflow`	azure	✓	✓	✓
`azurerm_machine_learning_workspace`	azure	✓	✓	✓
`azurerm_managed_disk`	azure	✓	✓	✓
`azurerm_maps_account`	azure	✓	✓	✓
`azurerm_monitor_action_group`	azure	✓	✓	✓
`azurerm_monitor_activity_log_alert`	azure	✓	✓	✓
`azurerm_monitor_diagnostic_setting`	azure	✓	✓	✓
`azurerm_monitor_metric_alert`	azure	✓	✓	✓
`azurerm_mssql_database`	azure	✓	—	✓
`azurerm_mssql_elasticpool`	azure	✓	—	✓
`azurerm_mssql_managed_instance`	azure	✓	✓	✓
`azurerm_mssql_server`	azure	✓	✓	✓
`azurerm_mysql_flexible_server`	azure	✓	✓	✓
`azurerm_nat_gateway`	azure	✓	✓	✓
`azurerm_network_interface`	azure	✓	✓	✓
`azurerm_network_security_group`	azure	✓	✓	✓
`azurerm_notification_hub_namespace`	azure	✓	✓	✓
`azurerm_postgresql_flexible_server`	azure	✓	✓	✓
`azurerm_private_endpoint`	azure	✓	✓	✓
`azurerm_proximity_placement_group`	azure	✓	✓	✓
`azurerm_public_ip`	azure	✓	✓	✓
`azurerm_purview_account`	azure	✓	✓	✓
`azurerm_recovery_services_vault`	azure	✓	✓	✓
`azurerm_redis_cache`	azure	✓	✓	✓
`azurerm_role_assignment`	azure	✓	✓	—
`azurerm_role_definition`	azure	✓	✓	—
`azurerm_route_table`	azure	✓	✓	✓
`azurerm_search_service`	azure	✓	✓	✓
`azurerm_servicebus_namespace`	azure	✓	✓	✓
`azurerm_servicebus_queue`	azure	✓	—	✓
`azurerm_servicebus_topic`	azure	✓	—	✓
`azurerm_signalr_service`	azure	✓	✓	✓
`azurerm_snapshot`	azure	✓	✓	✓
`azurerm_static_web_app`	azure	✓	✓	✓
`azurerm_storage_account`	azure	✓	✓	✓
`azurerm_storage_container`	azure	✓	—	✓
`azurerm_storage_share`	azure	✓	—	✓
`azurerm_synapse_workspace`	azure	✓	✓	✓
`azurerm_traffic_manager_profile`	azure	✓	✓	✓
`azurerm_virtual_network`	azure	✓	✓	✓
`azurerm_virtual_network_gateway`	azure	✓	✓	✓
`azurerm_web_application_firewall_policy`	azure	✓	✓	✓
`azurerm_windows_function_app`	azure	✓	—	✓
`azurerm_windows_virtual_machine`	azure	✓	—	✓
`azurerm_windows_web_app`	azure	✓	—	✓
`aws_accessanalyzer_analyzer`	aws	✓	—	✓
`aws_appsync_graphql_api`	aws	✓	—	✓
`aws_athena_workgroup`	aws	✓	—	✓
`aws_autoscaling_group`	aws	✓	—	✓
`aws_backup_vault`	aws	✓	—	✓
`aws_batch_compute_environment`	aws	✓	—	✓
`aws_cloudfront_distribution`	aws	✓	—	✓
`aws_cloudtrail`	aws	✓	—	✓
`aws_cloudwatch_event_bus`	aws	✓	—	✓
`aws_cloudwatch_event_rule`	aws	✓	—	✓
`aws_cloudwatch_log_group`	aws	✓	—	✓
`aws_cloudwatch_metric_alarm`	aws	✓	—	✓
`aws_codebuild_project`	aws	✓	—	✓
`aws_cognito_identity_pool`	aws	✓	—	✓
`aws_cognito_user_pool`	aws	✓	—	✓
`aws_config_config_rule`	aws	✓	—	✓
`aws_db_instance`	aws	✓	—	✓
`aws_dynamodb_table`	aws	✓	—	✓
`aws_ebs_volume`	aws	✓	—	✓
`aws_ec2_managed_prefix_list`	aws	✓	—	✓
`aws_ec2_transit_gateway`	aws	✓	—	✓
`aws_ecr_repository`	aws	✓	—	✓
`aws_ecs_cluster`	aws	✓	—	✓
`aws_efs_access_point`	aws	✓	—	✓
`aws_efs_file_system`	aws	✓	—	✓
`aws_eks_cluster`	aws	✓	—	✓
`aws_elasticache_replication_group`	aws	✓	—	✓
`aws_flow_log`	aws	✓	—	✓
`aws_globalaccelerator_accelerator`	aws	✓	—	✓
`aws_guardduty_detector`	aws	✓	—	✓
`aws_iam_openid_connect_provider`	aws	✓	—	✓
`aws_iam_policy`	aws	✓	—	✓
`aws_iam_role`	aws	✓	—	✓
`aws_iam_saml_provider`	aws	✓	—	✓
`aws_iam_user`	aws	✓	—	✓
`aws_instance`	aws	✓	—	✓
`aws_kinesis_stream`	aws	✓	—	✓
`aws_kms_key`	aws	✓	—	✓
`aws_lambda_function`	aws	✓	—	✓
`aws_lb`	aws	✓	—	✓
`aws_lb_listener`	aws	✓	—	✓
`aws_lb_target_group`	aws	✓	—	✓
`aws_memorydb_cluster`	aws	✓	—	✓
`aws_msk_cluster`	aws	✓	—	✓
`aws_nat_gateway`	aws	✓	—	✓
`aws_network_interface`	aws	✓	—	✓
`aws_networkfirewall_firewall`	aws	✓	—	✓
`aws_networkfirewall_firewall_policy`	aws	✓	—	✓
`aws_opensearch_domain`	aws	✓	—	✓
`aws_rds_cluster`	aws	✓	—	✓
`aws_redshift_cluster`	aws	✓	—	✓
`aws_route53_zone`	aws	✓	—	✓
`aws_s3_bucket`	aws	✓	—	✓
`aws_security_group`	aws	✓	✓	✓
`aws_sfn_state_machine`	aws	✓	—	✓
`aws_sns_topic`	aws	✓	—	✓
`aws_ssm_document`	aws	✓	—	✓
`aws_subnet`	aws	✓	—	✓
`aws_transfer_server`	aws	✓	—	✓
`aws_vpc`	aws	✓	—	✓
`aws_vpc_endpoint`	aws	✓	—	✓
`aws_vpn_connection`	aws	✓	—	✓
`google_apigee_organization`	gcp	✓	✓	✓
`google_artifact_registry_repository`	gcp	✓	✓	✓
`google_bigquery_dataset`	gcp	✓	✓	✓
`google_bigquery_table`	gcp	✓	✓	✓
`google_certificate_manager_certificate`	gcp	✓	✓	✓
`google_cloud_run_v2_service`	gcp	✓	✓	✓
`google_cloudfunctions2_function`	gcp	✓	✓	✓
`google_compute_address`	gcp	✓	✓	✓
`google_compute_backend_service`	gcp	✓	✓	✓
`google_compute_disk`	gcp	✓	✓	✓
`google_compute_firewall`	gcp	✓	✓	✓
`google_compute_forwarding_rule`	gcp	✓	✓	✓
`google_compute_global_address`	gcp	✓	✓	✓
`google_compute_global_forwarding_rule`	gcp	✓	✓	✓
`google_compute_health_check`	gcp	✓	✓	✓
`google_compute_image`	gcp	✓	✓	✓
`google_compute_instance`	gcp	✓	✓	✓
`google_compute_instance_group_manager`	gcp	✓	✓	✓
`google_compute_network`	gcp	✓	✓	✓
`google_compute_network_endpoint_group`	gcp	✓	✓	✓
`google_compute_packet_mirroring`	gcp	✓	✓	✓
`google_compute_region_backend_service`	gcp	✓	✓	✓
`google_compute_region_health_check`	gcp	✓	✓	✓
`google_compute_route`	gcp	✓	✓	✓
`google_compute_router`	gcp	✓	✓	✓
`google_compute_security_policy`	gcp	✓	✓	✓
`google_compute_snapshot`	gcp	✓	✓	✓
`google_compute_ssl_certificate`	gcp	✓	✓	✓
`google_compute_ssl_policy`	gcp	✓	✓	✓
`google_compute_subnetwork`	gcp	✓	✓	✓
`google_compute_target_http_proxy`	gcp	✓	✓	✓
`google_compute_target_https_proxy`	gcp	✓	✓	✓
`google_compute_url_map`	gcp	✓	✓	✓
`google_compute_vpn_tunnel`	gcp	✓	✓	✓
`google_container_cluster`	gcp	✓	✓	✓
`google_container_node_pool`	gcp	✓	✓	✓
`google_dataproc_cluster`	gcp	✓	✓	✓
`google_dns_managed_zone`	gcp	✓	✓	✓
`google_dns_policy`	gcp	✓	✓	✓
`google_dns_response_policy`	gcp	✓	✓	✓
`google_filestore_instance`	gcp	✓	✓	✓
`google_kms_crypto_key`	gcp	✓	✓	✓
`google_logging_metric`	gcp	✓	✓	✓
`google_memcache_instance`	gcp	✓	✓	✓
`google_monitoring_alert_policy`	gcp	✓	✓	✓
`google_monitoring_notification_channel`	gcp	✓	✓	✓
`google_monitoring_uptime_check_config`	gcp	✓	✓	✓
`google_notebooks_instance`	gcp	✓	✓	✓
`google_project_iam_custom_role`	gcp	✓	✓	✓
`google_pubsub_subscription`	gcp	✓	✓	✓
`google_pubsub_topic`	gcp	✓	✓	✓
`google_redis_instance`	gcp	✓	✓	✓
`google_secret_manager_secret`	gcp	✓	✓	✓
`google_service_account`	gcp	✓	✓	✓
`google_spanner_instance`	gcp	✓	✓	✓
`google_sql_database_instance`	gcp	✓	✓	✓
`google_storage_bucket`	gcp	✓	✓	✓
`google_vpc_access_connector`	gcp	✓	✓	✓
`google_workflows_workflow`	gcp	✓	✓	✓

Generated from the backend's coverage registry — the same data module the scan gates execute against, CI-bound to their behaviour — at backend commit de583d6.