Inventory collector schedule

How often the collector Lambda runs a full-fleet inventory pass. Accepts EventBridge expressions: rate(N hours|minutes|days) or cron(...). Minimum rate(1 hour); maximum rate(30 days).

Data sensitivity (DSPM) scans

Enable scheduled DSPM-Lite classification across every database with a saved connection profile. Connect populates schemas + db_users only — DSPM samples cell values to classify PII / PCI / PHI / secrets and is the heavy workload. Manual point-in-time scans via the per-database Run DSPM scan button are always allowed regardless of this toggle.

Unvalidated SLA thresholds

How long a data-class-gated finding can sit unvalidated (DSPM not yet run) before it auto-promotes to a real fail with kind=unvalidated_sla_breach. The evaluator picks the strictest applicable framework's threshold per finding. _default covers any framework not listed here.

Audit log

Append-only history of state-changing calls against /settings/*, /admin/*, /users/*, and /auth/login (success and failure). Entries are retained for the configured window (default 365 days) and read-only — Admin + SecurityReader can read; nobody can write or delete via the API.

Collector regions

AWS regions the inventory collector sweeps on each execution. The orchestrator state machine fans out one Lambda per region; per-region failures don't abort other regions.

DSPM scan regions

Regions where DSPM connectors may run. Requests to /connect targeting resources outside this list return 400. Running scans are unaffected when a region is removed.

Account discovery

Which sources the planner consults to enumerate member accounts. manual = only the enrolled list below. organizations = only AWS Organizations. hybrid = union (manual entries win on account-id collision). Deploying customer-templates/org-bootstrap.json provisions the role for organizations/hybrid mode.

Connector secrets

Where /connect/manual credentials are stored and which key encrypts them. central = stored in this account's Secrets Manager (default). member-local = stored in each enrolled member account. Switching modes or changing the CMK runs a migration that copies/re-encrypts every existing secret; the button below becomes enabled once a migration is pending.

Enrolled accounts

Member accounts the collector inventories via cross-account assume-role. The central account is always included implicitly. Deploy customer-templates/member-account-bootstrap.json in the member first; the role it creates is what gets assumed here.