Know what runs in AWS, and show what changed.
Keep a current inventory of supported AWS resources, map ownership and dependencies, and retrieve evidence for audits and release reviews. Add software context from your SBOMs and recorded license entitlements. First inventory in under an hour, no agents to install.
History kept for 1 year, or up to 7 years with the retention add-on.
Huge upside. New blind spots.
AWS Config and the console show one account and one region at a time. An auditor or an incident commander needs every account and region in one place: who owns each thing, what depends on what, and what it looked like before.
- Sprawl →
Agentless discovery
Resources pile up across many accounts and regions, often with no owner. Omnitam discovers the supported resource types across your connected accounts and regions, read-only, and flags what nobody owns.
ITAM & CMDB → - Constant change →
Time Machine
Cloud resources are rebuilt rather than repaired, and history is scattered across accounts, regions and tools. Omnitam keeps one retained, searchable record of it.
Time Machine → - Drift →
Environment Parity
Staging (often called UAT) and production slowly stop matching. Omnitam catches it before a release does.
Environment Parity → - Hidden software →
Licenses + SBOM
Licenses you record and open-source libraries from the SBOMs you ingest sit beside what discovery finds. Omnitam puts all three in one view.
SBOM → - Shared responsibility →
Write-protected evidence
AWS secures the infrastructure; you answer for what runs on it, and for proving it to auditors. Omnitam keeps write-protected evidence for up to 7 years.
Security →
Three letters no executive wants to open cold.
Every one of them starts with the same question: what exactly are you running? It gets expensive when the answer is a stale spreadsheet.
The vendor audit notice
A software vendor's audit clause gives you 30 days to reconstruct years of deployments. Every unaccounted install is negotiated at list price. Plus back-maintenance.
Omnitam keeps your entitlements, seat assignments, and renewals in one governed record beside your discovered estate. The position you present is one you maintain all year, not a reconstruction under deadline.
The evidence request
SOX, ISO 27001, SOC 2, PCI DSS: every framework opens with an asset inventory and who owns it. Assembling it by hand costs weeks, every single cycle.
Evidence becomes a scheduled report: inventory, ownership, and a full audit trail, exported on demand or emailed to your auditor on a cadence.
What the EU Cyber Resilience Act (CRA) means for your SBOMs →
The incident review
The release passed UAT and failed in production. Root cause: environment drift nobody could see. Now it's an outage and an audit finding against your change policy.
Omnitam continuously diffs your environments and turns every deviation into an owned, dated remediation. Before release, not after the postmortem.
For platform leads · audit and security leads · ITAM and procurement leads
One system of record. Four obligations, retired.
Purpose-built for the cloud, not a datacenter CMDB with a connector bolted on. Every capability below runs on live, discovered data.
Agentless discovery, audit-ready by default
Grant one read-only role: CloudFormation or Terraform, under an hour end to end. Omnitam inventories assets, configuration items, and artifacts continuously, with near-real-time change capture available on demand.
- 84 resource types · 30 services
- read-only IAM · external-ID protected
- near real-time scans
- nothing installed on hosts
Software, licenses & certificates under control
A profile of each license you record: seats vs. assignments, renewal forecasts, contract terms, and a software catalog from the SBOMs you ingest (SPDX & CycloneDX). Certificates tracked to the day they expire.
- 8 license models
- seat utilization & reclaim
- SBOM / software composition
- certificate lifecycle
Know whether each environment meets your release baseline
DEV, UAT, and PROD compared resource-by-resource with pass/fail gates, severity-ranked findings, and a pending-remediations tracker. Drift stops being folklore and becomes a managed queue.
- baseline ↔ target parity
- pass / fail verdict before you release
- remediations with owners & due dates
- differences tracker
Evidence on demand, for up to seven years
Every change written to a tamper-evident audit trail you can search and export in-app; SIEM streaming is rolling out on Enterprise. Reports (inventory, license compliance, certificate health, audit export) generated on demand or on schedule, in CSV, JSON, PDF, or XLSX.
- write-protected, tamper-evident evidence
- 8 report types · 4 formats
- scheduled delivery to auditors
- dependency map & ownership
First inventory in under 60 minutes.
Then it keeps checking: hourly or near real-time, plus change events as they happen.
1 · Connect
One read-only role from a ready-made template: CloudFormation or Terraform.
2 · Discover
Inventories, classifies and maps what depends on what.
3 · Prove
Owners, licenses, alerts and scheduled reports go live. Evidence builds from day one.
Typically for one AWS account, once someone with IAM permissions can launch the CloudFormation stack or apply the Terraform module. Time grows with the number of accounts and with permission approvals.
Why security teams say yes
Read-only · no agents · no secret or data reads by default · revocable at any time · every session in your own CloudTrail
Answers you can rewind, trace and prove.
Time Machine
Rewind any resource to any date and see exactly what changed. Explore Time Machine →
Blast radius
Before a change, see what it would break, upstream and downstream. Explore the CMDB →
SBOM trace
Answer “where does that library run?” in minutes. Explore SBOM →
Environment Parity
Omnitam compares your environments with an agreed baseline, gives a pass/fail verdict, and gives every deviation a due date and a status, or an accepted exception with a reason. Explore Environment Parity →
Licenses and software
Over-assignment surfaces before the vendor finds it; unassigned seats surface before finance renews them. Explore License Management →
The next audit is already scheduled.
Be the one with the answer.
Connect one AWS account (read-only, nothing installed) and see your AWS estate discovered, with owners and evidence building from day one, before the hour is out.