providers

Documentation

Overview

Package providers hosts the cloud-provider Scanner registry. Concrete scanners live in subpackages (aws, azure, gcp) and self-register via init() — see internal/providers/CLAUDE.md for the registration shape.

Index

• func Names() []string
• func Register(s Scanner)
• type CredentialConfigOverrider
• type GlobalsSkipper
• type LongDescriber
• type ProfileOverrider
• type RegionNamer
• type RegionOverrider
• type RegionScopeToggler
• type RoleOverrider
• type Scanner
  • func All() []Scanner
  • func Get(name string) (Scanner, bool)
• type ScopeColumnWidther
• type ServiceFilterExemplar
• type ServiceFilterer
• type ServiceNamer
• type ServiceQuotasIncluder
• type SourceIdentityOverrider
• type SubscriptionOverrider

Functions

func Names

func Names() []string

Names returns the names of all registered providers, sorted. Used for error messages and scan metadata.

func Register

func Register(s Scanner)

Register adds a scanner to the global registry. Providers call this from their package init() function.

Types

type CredentialConfigOverrider

type CredentialConfigOverrider interface {
	SetCredentialConfigOverride(path string)
}

CredentialConfigOverrider is an optional interface for providers that accept an external credential-configuration file via the --credential-config CLI flag, pinning authentication for a single scan. The canonical use is a GCP Workload Identity Federation cred-config (gcloud iam workload-identity-pools create-cred-config) for keyless auth without a downloaded key; a plain service-account key file is also accepted. An empty path restores the config-file / ambient-credential default.

type GlobalsSkipper

type GlobalsSkipper interface {
	SetSkipGlobals(skip bool)
}

GlobalsSkipper is an optional interface for providers that support suppressing global / cross-region service scans via --skip-globals. Globals are services whose endpoints live in a single region but whose resource scope is account-wide (IAM, Route53, CloudFront, Globalaccelerator, etc.). When set, the provider must not invoke any service registered as global; per-region services are unaffected.

type LongDescriber

type LongDescriber interface {
	LongDescription() string
}

LongDescriber is an optional interface for a provider to supply the long help text for its `disco scan <provider>` subcommand. cmd/scan.go falls back to a generic one-line blurb if not implemented.

type ProfileOverrider

type ProfileOverrider interface {
	SetProfile(profile string)
}

ProfileOverrider is an optional interface for providers that support selecting a named credential profile via the --profile CLI flag.

type RegionNamer

type RegionNamer interface {
	RegionNames() []string
}

RegionNamer surfaces every region/location the provider's static capability list covers — AWS partitions (us-east-1, ...), Azure ARM locations (eastus, ...), GCP compute regions (us-central1, ...): disco's opinion of "what could be scanned"; providers scan a subset based on config/creds at runtime. Static — refresh the per-provider list when a new cloud region launches. cmd/scan.go uses it to compute the scope column width for aligned progress output.

type RegionOverrider

type RegionOverrider interface {
	SetRegionOverride(regions []string)
}

RegionOverrider is an optional interface for providers that support overriding scan regions via the --region CLI flag.

type RegionScopeToggler

type RegionScopeToggler interface {
	SetRegionScope(enabled bool)
}

RegionScopeToggler is an optional interface for providers that can pre-scope per-service scans to the regions where the cloud actually offers each service, skipping dispatch into regions where it's unavailable. Enabled by default; the --scope-regions flag toggles it. Fail-open — providers must scan all configured regions whenever the availability source is unreachable.

type RoleOverrider

type RoleOverrider interface {
	SetRoleOverride(roleARN, externalID string)
}

RoleOverrider is an optional interface for providers that support overriding the assume-role identity via CLI flags. Used by an external orchestrator (e.g. a scan-trigger Lambda) to pin the worker to a target principal + external-id pair without writing a config file. Empty roleARN restores the default credential chain; non-empty externalID is included in the AssumeRole call only when roleARN is also set.

type Scanner

type Scanner interface {
	// Name returns the provider's canonical identifier (e.g. "aws", "azure", "gcp").
	Name() string
	// Scan discovers all resources for this provider and persists them via st.
	// scanID ties every upserted resource and relationship to this scan run.
	Scan(ctx context.Context, st *store.Store, scanID string) error
}

Scanner is the interface every cloud provider must implement. Each provider package registers itself via init() by calling Register.

func All

func All() []Scanner

All returns all registered scanners sorted by name.

func Get

func Get(name string) (Scanner, bool)

Get returns the scanner for the given provider name, if registered.

type ScopeColumnWidther

type ScopeColumnWidther interface {
	ScopeColumnWidth() int
}

ScopeColumnWidther is an optional interface for a provider to declare a minimum scope-column width in scan progress output — for scopes that aren't region names (Azure subscription UUID = 36, GCP project ID = 30). cmd/scan.go takes the max of this hint and any RegionNames.

type ServiceFilterExemplar

type ServiceFilterExemplar interface {
	ServiceFilterExample() string
}

ServiceFilterExemplar is an optional interface for a provider to supply the real service-prefix example shown in its --services flag help (e.g. "aws:ec2,aws:s3"). cmd/scan.go falls back to "<name>:<service>".

type ServiceFilterer

type ServiceFilterer interface {
	SetServiceFilter(services []string)
}

ServiceFilterer is an optional interface for providers that support scanning a subset of their registered services, via the --services flag on "disco scan <provider>".

type ServiceNamer

type ServiceNamer interface {
	ServiceNames() []string
}

ServiceNamer is an optional interface for providers to expose the service names they will report via ReportService; cmd/scan.go uses it to compute column widths for aligned output.

type ServiceQuotasIncluder

type ServiceQuotasIncluder interface {
	SetIncludeServiceQuotas(include bool)
}

ServiceQuotasIncluder is an optional interface for providers with a default-off service-quotas scan (account limit metadata — slow and distinct from resource discovery). The --include-service-quotas flag adds it to the default scan; off by default, so a normal scan skips it. It can also be selected explicitly by name via the --services filter.

type SourceIdentityOverrider

type SourceIdentityOverrider interface {
	SetSourceIdentity(sourceIdentity string)
}

SourceIdentityOverrider is an optional interface for providers that can stamp an audit identity onto assumed-role sessions (AWS STS SourceIdentity, surfaced in CloudTrail). The reserved value "auto" resolves to the scan ID; any other value is used verbatim. Off when empty — requires the target role's trust policy to permit setting a source identity, so it is never on by default.

type SubscriptionOverrider

type SubscriptionOverrider interface {
	SetSubscriptionOverride(subscriptionIDs []string)
}

SubscriptionOverrider is an optional interface for providers that support pinning the scan to an explicit subscription set via the --subscriptions CLI flag. Used by an external orchestrator to constrain the shared worker identity to one tenant's subscriptions without writing a config file — the Azure analogue of RoleOverrider. A non-nil override pins the scan and disables auto-enumeration (fail-closed): an override that resolves to zero subscriptions is an error, never a fall-through to enumeration. A nil override is never set and preserves the config-then-enumerate default.