Coverage

Cloudkeel-DD is honest about coverage: capabilities are marked Shipped or Gap, and every discovered resource type that isn’t field-diffed is tracked as inventory, clearly labelled, never silently assumed clean.

Field-level drift

The field-level diff engine covers 200 resource types: 79 Azure, 62 AWS, 59 GCP. Which of the 200 are cross-checked against your live cloud depends on where the desired state comes from, not on which cloud it is. There are two paths and they are not equal:

Desired-state source	Azure	AWS	GCP
Terraform Cloud / Enterprise, or a local plan file	68	1 (security groups only)	59
Raw .tfstate in S3, GCS, or Azure Blob	77	62	59

The gaps are specific, not approximate:

• AWS on the plan path cross-checks security groups only. All 62 AWS types are cross-checked from raw state, so if AWS is your centre of gravity, connect a state bucket rather than relying on Terraform Cloud alone. This is the single largest asymmetry on the page.
• Azure role assignments and role definitions are cross-checked on the plan path only. The raw-state path has no ARM api-version entry for them.
• No type is unreachable on both paths.

A type with no spec is never field-diffed. It is annotated live_comparison: unavailable with a reason and counted as inventory; there is deliberately no fallback raw diff.

What “verified” means

Two different bars, kept separate:

• Engine-verified: the type’s normalizer passes golden-fixture tests: a clean case plus a drifted case for every field the spec declares, over synthetic desired-vs-live payloads. All 200 types meet this bar.

• Proven against a real cloud account: exercised end-to-end against live infrastructure, with the finding confirmed in the database. This subset is smaller:

  Cloud	Proven live
  Azure	NSG rules
  AWS	Security-group rules
  GCP	Firewall rules
  Kubernetes	Drift across real AKS, EKS and GKE clusters

  Three cloud resource types, against 200 engine-verified. That ratio is wide and we publish it rather than average it: the engine bar grew sharply in 2026; the live-proof bar did not move with it. A spec passing golden fixtures is not the same as a mapping confirmed against a live API.

Unmanaged detection

A different mechanism with different coverage: unmanaged detection asks what is running that no Terraform state declares.

Cloud	Enumerated types
Azure	79
AWS	64
GCP	59
Kubernetes	sixteen kinds: Deployments, StatefulSets, DaemonSets, Services, ConfigMaps, Ingress, NetworkPolicies, Jobs, CronJobs, HorizontalPodAutoscalers, PersistentVolumeClaims, ServiceAccounts, ClusterRoles, ClusterRoleBindings, Roles, RoleBindings

Two limits worth knowing before your first scan:

• It runs across enumerated types only. A resource of a non-enumerated type is not flagged. Two enumerated types are never field-diffed: AWS EIPs and route tables. Every enumerated Azure and GCP type is field-diffed.
• On the three clouds it needs a connected Terraform state source to define what “managed” means. A cloud credential alone produces no findings. Kubernetes is the exception: ownership is read from each object’s own metadata, so it needs no state source.

Kubernetes

Kubernetes coverage does not depend on a Terraform state source at all.

• Field-level drift on sixteen kinds, comparing Helm’s stored release manifest against a live API read.
• Unmanaged workload detection on the same sixteen kinds. Ownership is read from the object’s own metadata: Helm’s app.kubernetes.io/managed-by label and meta.helm.sh/release-name annotation, or ArgoCD’s tracking-id annotation and instance labels. An object whose ownership metadata has been stripped reads as unmanaged.
• Out-of-band edit detection on already-managed objects, from metadata.managedFields.

Coverage tables

Generated at build time from the product’s own type registry.

Enumerated types: detected as unmanaged. A field-diff spec means changes to a managed one of these are also caught at field level.

Azure: 79 enumerated types

Resource type	Field-diff spec
azurerm_api_management	✓
azurerm_app_configuration	✓
azurerm_application_gateway	✓
azurerm_application_insights	✓
azurerm_automation_account	✓
azurerm_availability_set	✓
azurerm_bastion_host	✓
azurerm_batch_account	✓
azurerm_cognitive_account	✓
azurerm_container_app	✓
azurerm_container_registry	✓
azurerm_cosmosdb_account	✓
azurerm_data_factory	✓
azurerm_databricks_workspace	✓
azurerm_disk_encryption_set	✓
azurerm_eventgrid_domain	✓
azurerm_eventgrid_topic	✓
azurerm_eventhub	✓
azurerm_eventhub_namespace	✓
azurerm_express_route_circuit	✓
azurerm_firewall	✓
azurerm_firewall_policy	✓
azurerm_healthcare_service	✓
azurerm_image	✓
azurerm_iothub	✓
azurerm_key_vault	✓
azurerm_kubernetes_cluster	✓
azurerm_lb	✓
azurerm_linux_function_app	✓
azurerm_linux_virtual_machine	✓
azurerm_linux_virtual_machine_scale_set	✓
azurerm_linux_web_app	✓
azurerm_local_network_gateway	✓
azurerm_log_analytics_workspace	✓
azurerm_logic_app_workflow	✓
azurerm_machine_learning_workspace	✓
azurerm_managed_disk	✓
azurerm_maps_account	✓
azurerm_monitor_action_group	✓
azurerm_monitor_activity_log_alert	✓
azurerm_monitor_diagnostic_setting	✓
azurerm_monitor_metric_alert	✓
azurerm_mssql_database	✓
azurerm_mssql_elasticpool	✓
azurerm_mssql_managed_instance	✓
azurerm_mssql_server	✓
azurerm_mysql_flexible_server	✓
azurerm_nat_gateway	✓
azurerm_network_interface	✓
azurerm_network_security_group	✓
azurerm_notification_hub_namespace	✓
azurerm_postgresql_flexible_server	✓
azurerm_private_endpoint	✓
azurerm_proximity_placement_group	✓
azurerm_public_ip	✓
azurerm_purview_account	✓
azurerm_recovery_services_vault	✓
azurerm_redis_cache	✓
azurerm_role_assignment	✓
azurerm_role_definition	✓
azurerm_route_table	✓
azurerm_search_service	✓
azurerm_servicebus_namespace	✓
azurerm_servicebus_queue	✓
azurerm_servicebus_topic	✓
azurerm_signalr_service	✓
azurerm_snapshot	✓
azurerm_static_web_app	✓
azurerm_storage_account	✓
azurerm_storage_container	✓
azurerm_storage_share	✓
azurerm_synapse_workspace	✓
azurerm_traffic_manager_profile	✓
azurerm_virtual_network	✓
azurerm_virtual_network_gateway	✓
azurerm_web_application_firewall_policy	✓
azurerm_windows_function_app	✓
azurerm_windows_virtual_machine	✓
azurerm_windows_web_app	✓

AWS: 64 enumerated types

Resource type	Field-diff spec
aws_accessanalyzer_analyzer	✓
aws_appsync_graphql_api	✓
aws_athena_workgroup	✓
aws_autoscaling_group	✓
aws_backup_vault	✓
aws_batch_compute_environment	✓
aws_cloudfront_distribution	✓
aws_cloudtrail	✓
aws_cloudwatch_event_bus	✓
aws_cloudwatch_event_rule	✓
aws_cloudwatch_log_group	✓
aws_cloudwatch_metric_alarm	✓
aws_codebuild_project	✓
aws_cognito_identity_pool	✓
aws_cognito_user_pool	✓
aws_config_config_rule	✓
aws_db_instance	✓
aws_dynamodb_table	✓
aws_ebs_volume	✓
aws_ec2_managed_prefix_list	✓
aws_ec2_transit_gateway	✓
aws_ecr_repository	✓
aws_ecs_cluster	✓
aws_efs_access_point	✓
aws_efs_file_system	✓
aws_eip	—
aws_eks_cluster	✓
aws_elasticache_replication_group	✓
aws_flow_log	✓
aws_globalaccelerator_accelerator	✓
aws_guardduty_detector	✓
aws_iam_openid_connect_provider	✓
aws_iam_policy	✓
aws_iam_role	✓
aws_iam_saml_provider	✓
aws_iam_user	✓
aws_instance	✓
aws_kinesis_stream	✓
aws_kms_key	✓
aws_lambda_function	✓
aws_lb	✓
aws_lb_listener	✓
aws_lb_target_group	✓
aws_memorydb_cluster	✓
aws_msk_cluster	✓
aws_nat_gateway	✓
aws_network_interface	✓
aws_networkfirewall_firewall	✓
aws_networkfirewall_firewall_policy	✓
aws_opensearch_domain	✓
aws_rds_cluster	✓
aws_redshift_cluster	✓
aws_route53_zone	✓
aws_route_table	—
aws_s3_bucket	✓
aws_security_group	✓
aws_sfn_state_machine	✓
aws_sns_topic	✓
aws_ssm_document	✓
aws_subnet	✓
aws_transfer_server	✓
aws_vpc	✓
aws_vpc_endpoint	✓
aws_vpn_connection	✓

GCP: 59 enumerated types

Resource type	Field-diff spec
google_apigee_organization	✓
google_artifact_registry_repository	✓
google_bigquery_dataset	✓
google_bigquery_table	✓
google_certificate_manager_certificate	✓
google_cloud_run_v2_service	✓
google_cloudfunctions2_function	✓
google_compute_address	✓
google_compute_backend_service	✓
google_compute_disk	✓
google_compute_firewall	✓
google_compute_forwarding_rule	✓
google_compute_global_address	✓
google_compute_global_forwarding_rule	✓
google_compute_health_check	✓
google_compute_image	✓
google_compute_instance	✓
google_compute_instance_group_manager	✓
google_compute_network	✓
google_compute_network_endpoint_group	✓
google_compute_packet_mirroring	✓
google_compute_region_backend_service	✓
google_compute_region_health_check	✓
google_compute_route	✓
google_compute_router	✓
google_compute_security_policy	✓
google_compute_snapshot	✓
google_compute_ssl_certificate	✓
google_compute_ssl_policy	✓
google_compute_subnetwork	✓
google_compute_target_http_proxy	✓
google_compute_target_https_proxy	✓
google_compute_url_map	✓
google_compute_vpn_tunnel	✓
google_container_cluster	✓
google_container_node_pool	✓
google_dataproc_cluster	✓
google_dns_managed_zone	✓
google_dns_policy	✓
google_dns_response_policy	✓
google_filestore_instance	✓
google_kms_crypto_key	✓
google_logging_metric	✓
google_memcache_instance	✓
google_monitoring_alert_policy	✓
google_monitoring_notification_channel	✓
google_monitoring_uptime_check_config	✓
google_notebooks_instance	✓
google_project_iam_custom_role	✓
google_pubsub_subscription	✓
google_pubsub_topic	✓
google_redis_instance	✓
google_secret_manager_secret	✓
google_service_account	✓
google_spanner_instance	✓
google_sql_database_instance	✓
google_storage_bucket	✓
google_vpc_access_connector	✓
google_workflows_workflow	✓

Field-level spec coverage: 200 types

Resource type	Cloud	Engine-verified	Cross-check: plan source	Cross-check: raw state
azurerm_api_management	azure	✓	✓	✓
azurerm_app_configuration	azure	✓	✓	✓
azurerm_application_gateway	azure	✓	✓	✓
azurerm_application_insights	azure	✓	✓	✓
azurerm_automation_account	azure	✓	✓	✓
azurerm_availability_set	azure	✓	✓	✓
azurerm_bastion_host	azure	✓	✓	✓
azurerm_batch_account	azure	✓	✓	✓
azurerm_cognitive_account	azure	✓	✓	✓
azurerm_container_app	azure	✓	✓	✓
azurerm_container_registry	azure	✓	✓	✓
azurerm_cosmosdb_account	azure	✓	✓	✓
azurerm_data_factory	azure	✓	✓	✓
azurerm_databricks_workspace	azure	✓	✓	✓
azurerm_disk_encryption_set	azure	✓	✓	✓
azurerm_eventgrid_domain	azure	✓	✓	✓
azurerm_eventgrid_topic	azure	✓	✓	✓
azurerm_eventhub	azure	✓	—	✓
azurerm_eventhub_namespace	azure	✓	✓	✓
azurerm_express_route_circuit	azure	✓	✓	✓
azurerm_firewall	azure	✓	✓	✓
azurerm_firewall_policy	azure	✓	✓	✓
azurerm_healthcare_service	azure	✓	✓	✓
azurerm_image	azure	✓	✓	✓
azurerm_iothub	azure	✓	✓	✓
azurerm_key_vault	azure	✓	✓	✓
azurerm_kubernetes_cluster	azure	✓	✓	✓
azurerm_lb	azure	✓	✓	✓
azurerm_linux_function_app	azure	✓	—	✓
azurerm_linux_virtual_machine	azure	✓	✓	✓
azurerm_linux_virtual_machine_scale_set	azure	✓	✓	✓
azurerm_linux_web_app	azure	✓	✓	✓
azurerm_local_network_gateway	azure	✓	✓	✓
azurerm_log_analytics_workspace	azure	✓	✓	✓
azurerm_logic_app_workflow	azure	✓	✓	✓
azurerm_machine_learning_workspace	azure	✓	✓	✓
azurerm_managed_disk	azure	✓	✓	✓
azurerm_maps_account	azure	✓	✓	✓
azurerm_monitor_action_group	azure	✓	✓	✓
azurerm_monitor_activity_log_alert	azure	✓	✓	✓
azurerm_monitor_diagnostic_setting	azure	✓	✓	✓
azurerm_monitor_metric_alert	azure	✓	✓	✓
azurerm_mssql_database	azure	✓	—	✓
azurerm_mssql_elasticpool	azure	✓	—	✓
azurerm_mssql_managed_instance	azure	✓	✓	✓
azurerm_mssql_server	azure	✓	✓	✓
azurerm_mysql_flexible_server	azure	✓	✓	✓
azurerm_nat_gateway	azure	✓	✓	✓
azurerm_network_interface	azure	✓	✓	✓
azurerm_network_security_group	azure	✓	✓	✓
azurerm_notification_hub_namespace	azure	✓	✓	✓
azurerm_postgresql_flexible_server	azure	✓	✓	✓
azurerm_private_endpoint	azure	✓	✓	✓
azurerm_proximity_placement_group	azure	✓	✓	✓
azurerm_public_ip	azure	✓	✓	✓
azurerm_purview_account	azure	✓	✓	✓
azurerm_recovery_services_vault	azure	✓	✓	✓
azurerm_redis_cache	azure	✓	✓	✓
azurerm_role_assignment	azure	✓	✓	—
azurerm_role_definition	azure	✓	✓	—
azurerm_route_table	azure	✓	✓	✓
azurerm_search_service	azure	✓	✓	✓
azurerm_servicebus_namespace	azure	✓	✓	✓
azurerm_servicebus_queue	azure	✓	—	✓
azurerm_servicebus_topic	azure	✓	—	✓
azurerm_signalr_service	azure	✓	✓	✓
azurerm_snapshot	azure	✓	✓	✓
azurerm_static_web_app	azure	✓	✓	✓
azurerm_storage_account	azure	✓	✓	✓
azurerm_storage_container	azure	✓	—	✓
azurerm_storage_share	azure	✓	—	✓
azurerm_synapse_workspace	azure	✓	✓	✓
azurerm_traffic_manager_profile	azure	✓	✓	✓
azurerm_virtual_network	azure	✓	✓	✓
azurerm_virtual_network_gateway	azure	✓	✓	✓
azurerm_web_application_firewall_policy	azure	✓	✓	✓
azurerm_windows_function_app	azure	✓	—	✓
azurerm_windows_virtual_machine	azure	✓	—	✓
azurerm_windows_web_app	azure	✓	—	✓
aws_accessanalyzer_analyzer	aws	✓	—	✓
aws_appsync_graphql_api	aws	✓	—	✓
aws_athena_workgroup	aws	✓	—	✓
aws_autoscaling_group	aws	✓	—	✓
aws_backup_vault	aws	✓	—	✓
aws_batch_compute_environment	aws	✓	—	✓
aws_cloudfront_distribution	aws	✓	—	✓
aws_cloudtrail	aws	✓	—	✓
aws_cloudwatch_event_bus	aws	✓	—	✓
aws_cloudwatch_event_rule	aws	✓	—	✓
aws_cloudwatch_log_group	aws	✓	—	✓
aws_cloudwatch_metric_alarm	aws	✓	—	✓
aws_codebuild_project	aws	✓	—	✓
aws_cognito_identity_pool	aws	✓	—	✓
aws_cognito_user_pool	aws	✓	—	✓
aws_config_config_rule	aws	✓	—	✓
aws_db_instance	aws	✓	—	✓
aws_dynamodb_table	aws	✓	—	✓
aws_ebs_volume	aws	✓	—	✓
aws_ec2_managed_prefix_list	aws	✓	—	✓
aws_ec2_transit_gateway	aws	✓	—	✓
aws_ecr_repository	aws	✓	—	✓
aws_ecs_cluster	aws	✓	—	✓
aws_efs_access_point	aws	✓	—	✓
aws_efs_file_system	aws	✓	—	✓
aws_eks_cluster	aws	✓	—	✓
aws_elasticache_replication_group	aws	✓	—	✓
aws_flow_log	aws	✓	—	✓
aws_globalaccelerator_accelerator	aws	✓	—	✓
aws_guardduty_detector	aws	✓	—	✓
aws_iam_openid_connect_provider	aws	✓	—	✓
aws_iam_policy	aws	✓	—	✓
aws_iam_role	aws	✓	—	✓
aws_iam_saml_provider	aws	✓	—	✓
aws_iam_user	aws	✓	—	✓
aws_instance	aws	✓	—	✓
aws_kinesis_stream	aws	✓	—	✓
aws_kms_key	aws	✓	—	✓
aws_lambda_function	aws	✓	—	✓
aws_lb	aws	✓	—	✓
aws_lb_listener	aws	✓	—	✓
aws_lb_target_group	aws	✓	—	✓
aws_memorydb_cluster	aws	✓	—	✓
aws_msk_cluster	aws	✓	—	✓
aws_nat_gateway	aws	✓	—	✓
aws_network_interface	aws	✓	—	✓
aws_networkfirewall_firewall	aws	✓	—	✓
aws_networkfirewall_firewall_policy	aws	✓	—	✓
aws_opensearch_domain	aws	✓	—	✓
aws_rds_cluster	aws	✓	—	✓
aws_redshift_cluster	aws	✓	—	✓
aws_route53_zone	aws	✓	—	✓
aws_s3_bucket	aws	✓	—	✓
aws_security_group	aws	✓	✓	✓
aws_sfn_state_machine	aws	✓	—	✓
aws_sns_topic	aws	✓	—	✓
aws_ssm_document	aws	✓	—	✓
aws_subnet	aws	✓	—	✓
aws_transfer_server	aws	✓	—	✓
aws_vpc	aws	✓	—	✓
aws_vpc_endpoint	aws	✓	—	✓
aws_vpn_connection	aws	✓	—	✓
google_apigee_organization	gcp	✓	✓	✓
google_artifact_registry_repository	gcp	✓	✓	✓
google_bigquery_dataset	gcp	✓	✓	✓
google_bigquery_table	gcp	✓	✓	✓
google_certificate_manager_certificate	gcp	✓	✓	✓
google_cloud_run_v2_service	gcp	✓	✓	✓
google_cloudfunctions2_function	gcp	✓	✓	✓
google_compute_address	gcp	✓	✓	✓
google_compute_backend_service	gcp	✓	✓	✓
google_compute_disk	gcp	✓	✓	✓
google_compute_firewall	gcp	✓	✓	✓
google_compute_forwarding_rule	gcp	✓	✓	✓
google_compute_global_address	gcp	✓	✓	✓
google_compute_global_forwarding_rule	gcp	✓	✓	✓
google_compute_health_check	gcp	✓	✓	✓
google_compute_image	gcp	✓	✓	✓
google_compute_instance	gcp	✓	✓	✓
google_compute_instance_group_manager	gcp	✓	✓	✓
google_compute_network	gcp	✓	✓	✓
google_compute_network_endpoint_group	gcp	✓	✓	✓
google_compute_packet_mirroring	gcp	✓	✓	✓
google_compute_region_backend_service	gcp	✓	✓	✓
google_compute_region_health_check	gcp	✓	✓	✓
google_compute_route	gcp	✓	✓	✓
google_compute_router	gcp	✓	✓	✓
google_compute_security_policy	gcp	✓	✓	✓
google_compute_snapshot	gcp	✓	✓	✓
google_compute_ssl_certificate	gcp	✓	✓	✓
google_compute_ssl_policy	gcp	✓	✓	✓
google_compute_subnetwork	gcp	✓	✓	✓
google_compute_target_http_proxy	gcp	✓	✓	✓
google_compute_target_https_proxy	gcp	✓	✓	✓
google_compute_url_map	gcp	✓	✓	✓
google_compute_vpn_tunnel	gcp	✓	✓	✓
google_container_cluster	gcp	✓	✓	✓
google_container_node_pool	gcp	✓	✓	✓
google_dataproc_cluster	gcp	✓	✓	✓
google_dns_managed_zone	gcp	✓	✓	✓
google_dns_policy	gcp	✓	✓	✓
google_dns_response_policy	gcp	✓	✓	✓
google_filestore_instance	gcp	✓	✓	✓
google_kms_crypto_key	gcp	✓	✓	✓
google_logging_metric	gcp	✓	✓	✓
google_memcache_instance	gcp	✓	✓	✓
google_monitoring_alert_policy	gcp	✓	✓	✓
google_monitoring_notification_channel	gcp	✓	✓	✓
google_monitoring_uptime_check_config	gcp	✓	✓	✓
google_notebooks_instance	gcp	✓	✓	✓
google_project_iam_custom_role	gcp	✓	✓	✓
google_pubsub_subscription	gcp	✓	✓	✓
google_pubsub_topic	gcp	✓	✓	✓
google_redis_instance	gcp	✓	✓	✓
google_secret_manager_secret	gcp	✓	✓	✓
google_service_account	gcp	✓	✓	✓
google_spanner_instance	gcp	✓	✓	✓
google_sql_database_instance	gcp	✓	✓	✓
google_storage_bucket	gcp	✓	✓	✓
google_vpc_access_connector	gcp	✓	✓	✓
google_workflows_workflow	gcp	✓	✓	✓

Generated from the backend's coverage registry, the same data module the scan gates execute against, CI-bound to their behaviour, at backend commit aeee10a.