Cloud Discovery

Kyb can scan your Google Cloud Platform projects and automatically discover infrastructure, mapping raw cloud resources into architecture-level entities. Every discovered element goes through human review before entering your graph.

Prerequisites

To run a discovery scan, you need a GCP service account with read access to the Cloud Asset Inventory API. The service account key is uploaded to Kyb and used only for the duration of the scan.

Running a Discovery Scan

1. 1. Navigate to Settings > Discovery or use the import menu in the Explorer.
2. 2. Upload your GCP service account key (JSON format).
3. 3. Select which resource types to discover. By default all 40+ types are enabled, but you can toggle individual types on or off.
4. 4. Click Start Discovery. Kyb will scan your GCP project and propose architecture-level entities.

Supported Resource Types (40+ GCP Services)

Kyb scans the Google Cloud Asset Inventory API and directly abstracts 40+ GCP services across compute, containers, data, messaging, security, storage, and networking:

Smart Discovery Filters

Google Cloud environments often contain dozens of auto-generated default assets that add noise without architectural value. In Settings > Discovery, you can configure automatic smart filters:

• • filterDefaultNetworks: Skips the unused GCP “default” VPC network.
• • filterDefaultFirewalls: Omits standard boiler-plate firewall rules (e.g. default-allow-ssh, default-allow-icmp).
• • filterDefaultLogSinks: Ignores standard internal _Default and _Required GCP log sinks.
• • filterDefaultServiceAccounts: Excludes internal Google-managed agent identities (e.g. *@cloudservices.gserviceaccount.com).

AI Abstraction

Raw cloud resources are not architecture. A Compute Engine VM is infrastructure; what matters architecturally is the application or service running on it. Kyb's AI abstraction layer maps raw resources into ArchiMate-typed architecture entities:

• A GKE Deployment running a payments service becomes an Application Component with specialization GKE Workload.
• A Cloud SQL instance becomes a Technology Service with specialization Database.
• Relationships between resources (e.g., a service connecting to a database) are proposed as ArchiMate relationships.

You can run discovery in deterministic-only mode to skip the AI abstraction step. This is faster and has no token cost, but produces infrastructure-level entities only.

Reviewing Discovered Elements

After a scan completes, Kyb presents the proposed elements in a review panel. For each element you can:

• Accept -- Add the element to your graph as-is.
• Reject -- Skip this element. It will not appear in your graph.
• Reclassify -- Accept the element but change its type or specialization.

Resync: Detecting Changes

Run discovery again at any time to detect changes in your cloud infrastructure. Kyb produces a diff showing:

• New -- Resources that appeared since the last scan.
• Updated -- Resources whose properties changed.
• Removed -- Resources that no longer exist in your cloud project.
• Replaced -- Resources that were deleted and recreated (new ID, same purpose).