Add AI JSON export to all cloud scripts; AWS SSO/DryRun params - #2
Add AI JSON export to all cloud scripts; AWS SSO/DryRun params#2DYadav3214 wants to merge 1 commit into
Conversation
…DS field enrichment
| } | ||
| } | ||
| SSOScanAllAccounts = { | ||
| Write-ScriptOutput "Starting SSO multi-account scan..." -Level Info |
There was a problem hiding this comment.
During testing with 3 SSO accounts, the second account fell back to my existing/default IAM credentials and collected the first account again, resulting in duplicate/wrong account data.
Can we validate that the assumed credentials belong to $acct.accountId before calling Invoke-AWSDataCollection, and skip the account if credential switching fails?
| Region = $Region | ||
| InstanceId = $Item.InstanceId | ||
| InstanceType = $Item.InstanceType | ||
| Platform = if ($Item.Platform) { $Item.Platform } else { 'Linux' } |
There was a problem hiding this comment.
Can we normalize these EC2 values to scalar strings?
In the generated JSON, Linux is "Platform": "Linux" while Windows becomes "Platform": {"Value":"Windows"}. InstanceType and State show similar wrapper objects.
| [Parameter(ParameterSetName='CrossAccountRole')] | ||
| [ValidateNotNullOrEmpty()][string]$UserSpecifiedAccountsFile, | ||
|
|
||
| [Parameter(ParameterSetName='SSOScanAllAccounts',Mandatory=$true)] |
There was a problem hiding this comment.
Could we update the README/docs for the new AWS functionality? In particular, SSOScanAllAccounts, DryRun, SSO/IAM prerequisites/permissions, the new AI JSON outputs, and the added EC2/RDS fields should be documented.
| rds_instances = ($svcData['RDS'] | Measure-Object).Count | ||
| dynamodb_tables = ($svcData['DynamoDB'] | Measure-Object).Count | ||
| redshift_clusters = ($svcData['Redshift'] | Measure-Object).Count | ||
| eks_clusters = ($svcData['EKS'] | Measure-Object).Count |
There was a problem hiding this comment.
Can we distinguish collection failure from a genuine zero-resource result here?
During testing, services that returned AccessDenied were still exported with a count of 0, so downstream/AI consumers cannot tell "no resources" from "collection failed".
| VolumeDetails = ($ebsVolumes | ForEach-Object { "$($_.VolumeId):$($_.Size)GB:$($_.VolumeType)" }) -join ";" | ||
| } | ||
| # IsProtected: true if any tag key or value contains 'backup' | ||
| $isProtected = $instanceTags | Where-Object { $_.Key -match 'backup' -or $_.Value -match 'backup' } |
There was a problem hiding this comment.
What is the basis for using any tag key/value containing backup to determine IsProtected?
In testing, even empty tags such as Backup="" or an EC2 instance tagged with Commvault Backup Gateway resulted in IsProtected=true. Is this based on a defined AWS/Commvault tagging convention?
2 participants
All four cloud scripts (AWS, Azure, GCP, OCI) now auto-export AI-ready JSON files per account/subscription/project, included in the output ZIP — no extra parameters needed.
AWS gains -SSOScanAllAccounts (scan all SSO accounts in one run), -DryRun (preview without collecting), and auto-fallback to DefaultProfile when no auth param is given.
EC2 now captures Platform, PublicIpAddress, IsProtected; RDS now captures EngineVersion, MultiAZ, StorageEncrypted, BackupRetentionPeriod.