# The machine-maintained component inventory — Config's recorder status and discovered-resource counts proving supported resources are tracked continuously and the list stays current without anyone editing a spreadsheet, plus Systems Manager Inventory's node and installed-application metadata for what runs inside them

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-asset-inventory

Recipe id: `config-asset-inventory` · cadence daily · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-PIY-GIV`
- KSI `KSI-CMT-RMV`
- KSI `KSI-SVC-ACM`
- control `cm-2.2`
- control `cm-8`
- control `cm-8.1`

## Collection

Kind: `cli`

```sh
# configuration-recorder-status
aws configservice describe-configuration-recorder-status --query 'ConfigurationRecordersStatus[].{Name:name,Recording:recording,LastStatus:lastStatus,LastStart:lastStartTime,Error:lastErrorMessage}'
# get-discovered-resource-counts
aws configservice get-discovered-resource-counts
# select-resource-config
aws configservice select-resource-config --expression "SELECT resourceId, resourceType, awsRegion WHERE resourceType = 'AWS::EC2::Instance'"
# get-inventory
aws ssm get-inventory --aggregators Expression=AWS:InstanceInformation.PlatformType
# list-inventory-entries
aws ssm list-inventory-entries --instance-id i-0123456789abcdef0 --type-name AWS:Application
```

## Expected output

A recorder status with recording true and lastStatus SUCCESS — read this first, because a stopped or failing recorder makes everything below stale — then a resourceCounts array giving a count per resourceType alongside totalDiscoveredResources, a Results list naming each recorded resource of the type you queried, an aggregation of managed nodes grouped by platform, and an Entries list of installed applications stamped with the CaptureTime they were collected.

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

AWS Config and Systems Manager Inventory are available in AWS GovCloud (US-East) and (US-West); resource and node ARNs use partition arn:aws-us-gov

## Notes

This proves the inventory is machine-maintained and current (CM-08.01, and the automated-currency half of CM-02.02) — it does not prove the inventory is complete. Config sees only supported resource types, only in the regions and accounts where a recorder runs, and only within the recording group you configured; unsupported types, an un-recorded region, on-premises hosts, SaaS components and in-container software are invisible here and need their own source. SSM Inventory covers only managed nodes with a running agent and an inventory association, collects no more often than every 30 minutes, and the console's Inventory cards hide stopped and terminated nodes even though the API still returns them. The accountability attributes CM-08 asks for — system owner, function, criticality — live in your tags or CMDB, not in a resource count, so join them before calling this an inventory. Substitute your real instance id. Detecting unauthorized components (CM-08.03) is a different question; the prohibited-software half is in the least-functionality recipe.

## References

- {"title":"AWS CLI: configservice describe-configuration-recorder-status","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-configuration-recorder-status.html"}
- {"title":"AWS CLI: configservice get-discovered-resource-counts","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/get-discovered-resource-counts.html"}
- {"title":"AWS CLI: configservice select-resource-config","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/select-resource-config.html"}
- {"title":"AWS Config advanced query: SELECT query components","url":"https://docs.aws.amazon.com/config/latest/developerguide/query-components.html"}
- {"title":"AWS Systems Manager Inventory","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-inventory.html"}
- {"title":"AWS CLI: ssm get-inventory","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/get-inventory.html"}
- {"title":"AWS CLI: ssm list-inventory-entries","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/list-inventory-entries.html"}