Does Your CMDB Cover Kubernetes, Lambda, and Serverless? A Complete Cloud Discovery Guide
Cloud service discovery coverage refers to the range of cloud resource types a discovery tool can identify and record as configuration items in a CMDB. As of 2025, 82% of container users run Kubernetes in production, up from 66% in 2023, according to the CNCF Annual Cloud Native Survey, yet most CMDB discovery tools were designed for virtual machines and on-premises infrastructure. Virima 6.1.1 closes that gap by extending Trusted Runtime Truth to Kubernetes clusters on AWS and Azure, serverless compute functions, managed container services, and Azure PaaS.
Most CMDB discovery tools were built for a world of virtual machines and on-premises servers. This guide documents exactly what Virima 6.1.1 discovers across AWS and Azure, covering Kubernetes clusters, serverless functions, managed container services, and PaaS, so you can close the coverage gaps before they affect your next change or incident response.
| What is cloud service discovery coverage in a CMDB? Cloud service discovery coverage describes how many cloud resource types a discovery tool can identify and record as configuration items in a CMDB. Gaps in coverage for Kubernetes clusters, serverless functions, and PaaS databases leave IT operations teams with incomplete service maps and blind spots that affect change risk assessment and incident response. |
Does Virima discover AWS EKS Kubernetes clusters?
Yes. Virima’s IT Discovery platform discovers Amazon Elastic Kubernetes Service (EKS) clusters via the AWS API. Discovery captures EKS clusters as configuration items with their cluster name, ARN, Kubernetes version, API endpoint, and status. Virima also discovers EKS managed node groups, including instance type, scaling configuration, and node image version, as well as workloads (Deployments, StatefulSets, DaemonSets) running within the cluster.
All discovered EKS resources populate the Virima CMDB with parent-child relationships and are available in ViVID Service Mapping for service dependency visualization.
Does Virima support AWS ECS discovery?
Yes. Virima 6.1.1 discovers AWS Elastic Container Service (ECS) resources including ECS clusters, ECS services, and ECS task definitions via the AWS API. ECS clusters are captured as top-level CIs with their capacity provider configuration. ECS services are captured with their launch type (EC2, Fargate, or External), task definition association, desired task count, and load balancer integration. Task definition families and revisions are captured to enable change management tracking for containerized application deployments.
| Why does workload-level Kubernetes discovery produce more reliable CMDB data?Kubernetes pods have lifecycles measured in seconds during deployments and autoscaling events. CMDB systems that track individual pods accumulate stale records within minutes. Workload objects such as Deployments and StatefulSets represent stable operational intent and persist across pod churn, keeping CMDB data accurate without requiring constant reconciliation against ephemeral state. |
Can Virima discover Azure AKS?
Yes. Virima 6.1.1 discovers Azure Kubernetes Service (AKS) clusters via the Azure Resource Manager API, as part of Virima’s Azure Discovery integration. Discovery captures AKS clusters as configuration items with their Kubernetes version, DNS prefix, node resource group, provisioning state, and power state. Virima also discovers AKS node pools, including VM size, OS type, node count, autoscaling configuration, and node image version.
Workloads running within AKS clusters are discovered using the Kubernetes API, following the same workload-level CI model as EKS. AKS cluster CIs link to their Azure Virtual Network and associated Azure resources in the CMDB relationship graph.
Does Virima discover AWS Lambda functions?
The serverless computing market is projected to reach $92.22 billion by 2034, per Precedence Research. AWS Lambda remains the most widely deployed serverless function service across major cloud providers, with adoption continuing to rise according to Datadog’s State of Serverless. Virima 6.1.1 discovers AWS Lambda functions as configuration items via the AWS API. Discovery captures function name, ARN, runtime (e.g., python3.12, nodejs22.x, java21), memory allocation, timeout setting, handler, code package type, and associated layers.
Lambda function trigger relationships, including API Gateway, S3, SQS, EventBridge, and DynamoDB Streams, are captured as CMDB relationships, enabling downstream service dependency mapping through ViVID.
For a deeper look at why serverless assets need configuration management and how Lambda, App Runner, and Batch map to CMDB CIs, see AWS Lambda, App Runner, and Batch in CMDB.
| How are AWS Lambda functions represented in a CMDB? AWS Lambda functions are represented in a CMDB as serverless function configuration items linked to their trigger sources and downstream dependencies. Each Lambda CI captures the runtime, memory, timeout, and associated layers. Trigger relationships to API Gateway, S3, SQS, and EventBridge are mapped as CMDB dependency records, enabling change impact analysis across the full serverless architecture. |
Does Virima support AWS App Runner discovery?
Yes. Virima 6.1.1 discovers AWS App Runner services as configuration items. Discovery captures the service name, ARN, source configuration (container image URI or source repository), CPU and memory allocation, auto-scaling configuration, service URL, and service status. App Runner services are linked in the CMDB to their source container registry (Amazon ECR) and, where applicable, to their VPC connector associations for private resource access.
Does Virima support AWS Batch discovery?
Yes. Virima 6.1.1 discovers AWS Batch resources including compute environments, job queues, and job definitions. Compute environments are captured with their type (EC2, Spot, Fargate), vCPU range, and network configuration. Job queues are captured with their priority and compute environment associations. Job definitions are captured with their revision history, container image, and resource requirements. The parent-child relationships between compute environments, job queues, and job definitions are preserved in the CMDB.
See how Virima builds Trusted Runtime Truth for cloud environments: Explore the Virima Trusted Runtime Truth Platform.
Does Virima discover Azure Functions?
Yes. Virima 6.1.1 discovers Azure Functions (Function Apps) as configuration items via the Azure Resource Manager API. Discovery captures the Function App name, resource ID, runtime stack and version, hosting plan type (Consumption, Premium, or Dedicated), OS type, and associated Azure Storage account. Individual functions within each Function App are captured with their trigger types (HTTP, Timer, Queue, Event Hub, Cosmos DB, Service Bus). Application settings keys (not values) are captured for configuration tracking.
Does Virima support Azure Cosmos DB discovery?
Yes. Virima 6.1.1 discovers Azure Cosmos DB accounts as configuration items via the Azure Resource Manager API. Discovery captures the account name, resource ID, API type (NoSQL, MongoDB, Cassandra, Gremlin, or Table), consistency level, replication regions, multi-region write configuration, throughput provisioning type, and backup policy. Private endpoint associations are captured as CMDB relationships. Cosmos DB CIs participate in ViVID service maps, reflecting their role as data infrastructure supporting applications and business services.
For the full guide to Azure PaaS CMDB discovery, including Key Vault, Azure Functions, and Storage Accounts, see Azure Cosmos DB, Functions, and Key Vault in CMDB: Closing the PaaS Discovery Gap.
| What Azure PaaS services are typically missing from CMDB coverage? Legacy IT discovery tools focus on Azure Virtual Machines and Virtual Networks, leaving Azure PaaS services, including Cosmos DB accounts, Key Vault instances, Function Apps, and Storage Accounts, outside CMDB coverage. These PaaS resources host application logic, secrets, and data storage. Their absence from the CMDB creates change risk blind spots in hybrid and cloud-native deployments. |
Does Virima discover Azure Key Vault?
Yes. Virima 6.1.1 discovers Azure Key Vault instances as configuration items. Discovery captures the vault name, resource ID, location, SKU (Standard or Premium), access policies, soft delete and purge protection settings, firewall rules, and private endpoint associations. Certificate metadata, including names and expiration dates, is captured to support compliance tracking and proactive certificate rotation. Secret and key names (not values) are captured to enable configuration relationship mapping without exposing sensitive data.
Does Virima discover Azure Storage Accounts?
Yes. Virima 6.1.1 discovers Azure Storage Accounts as configuration items via the Azure Resource Manager API. Discovery captures the account name, resource ID, account kind, replication type (LRS, ZRS, GRS, GZRS), access tier, minimum TLS version, public access configuration, and soft delete retention settings. Private endpoint associations are captured as CMDB relationships. Storage account CIs support data governance by providing a centralized CMDB inventory of storage infrastructure and its security configuration.
What AWS services does Virima support for CMDB import?
Virima supports CMDB discovery for a broad range of AWS services across compute, container, serverless, networking, and database categories. Core AWS coverage includes EC2 instances, VPCs, security groups, ELB/ALB load balancers, RDS databases, S3 buckets, and IAM roles. Virima 6.1.1 expands this to include EKS clusters and node groups, ECS clusters, services and task definitions, Lambda functions, App Runner services, and AWS Batch compute environments, job queues, and job definitions. For the complete current AWS service list, the coverage table below provides a structured reference.
What Azure services does Virima support for CMDB discovery?
Virima supports CMDB discovery for Azure infrastructure across IaaS and PaaS service categories. Core Azure coverage includes Azure Virtual Machines, Virtual Networks, Network Security Groups, Azure Load Balancers, Azure SQL databases, and Azure resource groups. Virima 6.1.1 expands this to include AKS clusters and node pools, Azure Functions (Function Apps), Azure Cosmos DB accounts, Azure Key Vault instances, Azure Storage Accounts, and Azure Database for PostgreSQL Flexible Server. All Azure PaaS CIs are available in ViVID Service Mapping alongside IaaS resources.
How does Virima handle ephemeral Kubernetes workloads in CMDB?
Virima’s Kubernetes discovery operates at the workload level, not the individual pod level. Pods are too ephemeral for CMDB management; they are created and destroyed constantly during deployments, autoscaling, and node recompaction. Instead, Virima discovers stable workload objects (Deployments, StatefulSets, DaemonSets, CronJobs) as CIs, capturing the current container image, replica count, namespace, and labels. This approach keeps the CMDB current and meaningful without generating noise from pod churn.
For stateful workloads (StatefulSets), individual pod replicas with persistent storage can be captured as child CIs of the parent workload.
For a comprehensive technical guide to Kubernetes CMDB discovery, including CI modeling best practices, change impact analysis, and service mapping, see the Kubernetes CMDB Discovery guide.
| What configuration attributes does Virima capture for cloud resources? Virima captures resource identifiers (ARN or resource ID), operational state, configuration settings (runtime, instance type, scaling parameters), network associations (VPCs, subnets, private endpoints), and parent-child relationships between cloud resources. For security-sensitive services such as Key Vault and Azure Functions, configuration keys are captured while secret values are excluded, preserving both CMDB completeness and data security. |
Cloud Service Coverage Table
AWS Services — Virima 6.1.1 CMDB Discovery Coverage
| AWS Service | CI Type | Discovery Method | Virima Coverage |
|---|---|---|---|
| EC2 Instances | Compute Server | AWS EC2 API | Yes |
| EKS Clusters | Kubernetes Cluster | AWS EKS API | Yes (6.1.1) |
| EKS Managed Node Groups | Node Group | AWS EKS API | Yes (6.1.1) |
| Kubernetes Workloads (EKS) | Workload CI | Kubernetes API | Yes (6.1.1) |
| ECS Clusters | Container Cluster | AWS ECS API | Yes (6.1.1) |
| ECS Services | Container Service | AWS ECS API | Yes (6.1.1) |
| ECS Task Definitions | Task Definition | AWS ECS API | Yes (6.1.1) |
| AWS Lambda Functions | Serverless Function | AWS Lambda API | Yes (6.1.1) |
| AWS App Runner Services | Managed Container Service | AWS App Runner API | Yes (6.1.1) |
| AWS Batch Compute Environments | Batch Compute | AWS Batch API | Yes (6.1.1) |
| AWS Batch Job Queues | Batch Queue | AWS Batch API | Yes (6.1.1) |
| AWS Batch Job Definitions | Batch Job Definition | AWS Batch API | Yes (6.1.1) |
| VPCs | Network | AWS EC2/VPC API | Yes |
| Security Groups | Network Security | AWS EC2 API | Yes |
| Elastic Load Balancers (ALB/NLB) | Load Balancer | AWS ELB API | Yes |
| RDS Database Instances | Database | AWS RDS API | Yes |
| S3 Buckets | Storage | AWS S3 API | Yes |
Azure Services — Virima 6.1.1 CMDB Discovery Coverage
| Azure Service | CI Type | Discovery Method | Virima Coverage |
|---|---|---|---|
| Azure Virtual Machines | Compute Server | Azure ARM API | Yes |
| Azure AKS Clusters | Kubernetes Cluster | Azure ARM API | Yes (6.1.1) |
| Azure AKS Node Pools | Node Pool | Azure ARM API | Yes (6.1.1) |
| Kubernetes Workloads (AKS) | Workload CI | Kubernetes API | Yes (6.1.1) |
| Azure Functions (Function Apps) | Serverless Function | Azure ARM API | Yes (6.1.1) |
| Azure Cosmos DB Accounts | PaaS Database | Azure ARM API | Yes (6.1.1) |
| Azure Key Vault | Security Infrastructure | Azure ARM API | Yes (6.1.1) |
| Azure Storage Accounts | Storage | Azure ARM API | Yes (6.1.1) |
| Azure Database for PostgreSQL | PaaS Database | Azure ARM API | Yes (6.1.1) |
| Azure Virtual Networks | Network | Azure ARM API | Yes |
| Network Security Groups | Network Security | Azure ARM API | Yes |
| Azure Load Balancers | Load Balancer | Azure ARM API | Yes |
| Azure SQL Database | PaaS Database | Azure ARM API | Yes |
| Azure Resource Groups | Organizational | Azure ARM API | Yes |
See Virima’s Cloud Discovery in Action
Virima 6.1.1 brings Trusted Runtime Truth to Kubernetes, serverless, and PaaS services, giving IT operations and platform engineering teams the configuration visibility they need across modern cloud environments.
See how ViVID maps your Kubernetes and Lambda dependencies across AWS and Azure. Schedule a demo at virima.com.
Frequently Asked Questions
Why don’t traditional discovery tools find Kubernetes and serverless resources?
Traditional discovery tools use agent-based or network scan methods designed for persistent IP-addressed assets such as virtual machines and physical servers. Kubernetes workloads and serverless functions operate without fixed IP addresses and are created or destroyed programmatically via cloud APIs. Discovering these resources requires API-native integrations with AWS and Azure service endpoints, not network scanning.
How do CMDB coverage gaps affect cloud incident response?
When Kubernetes clusters, Lambda functions, or Azure PaaS services are absent from the CMDB, incident responders cannot identify what services depend on an affected resource or assess blast radius. Change approvals are made without full context, which increases the risk of unintended outages. Accurate cloud coverage in the CMDB connects incident records to the actual services and dependencies affected.
What happens when Lambda functions and Azure Functions are missing from the CMDB?
Serverless functions often act as critical integration points between services, handling event routing, data transformation, and API orchestration. When they are absent from the CMDB, their upstream and downstream relationships are invisible to change management and incident analysis tools. Updates to a trigger source such as an S3 bucket or Event Hub can cause unexpected function failures with no dependency record to guide the investigation.
Does Virima discover both AWS and Azure cloud services in the same CMDB?
Yes. Virima 6.1.1 discovers AWS and Azure cloud resources through separate API integrations and populates them into a unified CMDB. Both AWS and Azure CIs are available in the same CMDB relationship graph and ViVID service maps, enabling cross-cloud dependency analysis for organizations running workloads across both platforms.
How does Virima handle Kubernetes workloads that change frequently?
Virima’s Kubernetes discovery tracks stable workload objects such as Deployments and StatefulSets, not individual pods. Each high-frequency discovery cycle updates the workload CI with the current container image, replica count, and namespace state. This keeps CMDB records accurate without generating noise from pod creation and termination events, which occur continuously during normal cluster operation.
