Assets and Architecture Graph
Overview
Section titled “Overview”The Assets page gives you a visual map of your entire cloud and application infrastructure. It automatically discovers resources from your connected integrations—across AWS, Azure, GCP, Cloudflare, Heroku, Render, and more—and renders them as an interactive graph so you can understand how your systems relate to each other and where vulnerabilities exist.
The page has two tabs:
- Architecture — the interactive graph of resources and their relationships.
- Inventory — a searchable, filterable table of every discovered resource.
This is especially useful for understanding your attack surface at a glance, identifying orphaned or misconfigured resources, and quickly navigating to associated vulnerabilities.
Prerequisites
Section titled “Prerequisites”- At least one cloud or infrastructure integration must be connected (e.g., AWS, Azure, GCP, Cloudflare, DigitalOcean, Heroku, Render, Railway, Vercel, Supabase).
- An architecture scan must have completed at least once to populate the graph.
- Triggering a manual scan requires a valid subscription and a role that can run scans. Editing the diagram is also unavailable while the subscription is read-only.
How it works
Section titled “How it works”When you connect a cloud integration, Fencer periodically scans your accounts and discovers asset resources—individual infrastructure components such as EC2 instances, S3 buckets, Lambda functions, VPCs, databases, Kubernetes clusters, and many more. Each resource is classified by provider (e.g., AWS, Azure) and kind (e.g., RDS Instance, Storage Bucket), and assigned to a category for color-coded grouping on the graph.
Resources can have relationships to each other, forming a directed graph. For example, an ECS service may depend on an RDS database, or a load balancer may route to a set of EC2 instances. This relationship data is captured in the asset graph and visualized as edges between nodes. Resources also have a criticality score (0–100) that can be used to prioritize vulnerability remediation.
Every scan produces a new snapshot of the graph, so you can look back at an earlier run or compare two runs to see what changed.
Usage / Configuration
Section titled “Usage / Configuration”Viewing the architecture graph
Section titled “Viewing the architecture graph”- Navigate to Main > Assets. The Architecture tab opens by default.
- If an architecture scan has completed, the interactive graph loads automatically with your discovered resources and their relationships.
- Click on any node in the graph to open its details panel, which shows the node’s type (group or resource), provider, and number of resources.
- For nodes that represent a group of resources, the panel lists the individual resources within the group (up to 50 items). Click a resource to open its full details, including its region, owner, criticality, connections, and associated vulnerabilities.
If the latest scan could not reach every account, a Some assets are missing notice appears above the graph. Click Details to see which provider was affected and how to fix it.
Filtering and grouping the graph
Section titled “Filtering and grouping the graph”- Click Filter to narrow down which resources appear on the graph. You can filter by Account, Asset Category, Asset Kind, Asset Provider, Region, and Asset Description.
- With two or more filters applied, click the operator button to switch between Match All and Match Any logic.
- Open Display and choose how Resources are drawn:
- Grouped — Resources of the same type are collapsed into group nodes for a cleaner view. This is the default.
- Individual — Each resource is rendered as its own node.
- Under Group by in the same menu, organize resources by Region, AWS VPC, or AWS Subnet. Only the options that apply to your connected providers are shown.
Viewing earlier snapshots
Section titled “Viewing earlier snapshots”When more than one scan has completed, a timeline of snapshots appears above the toolbar.
- Pick a snapshot on the timeline to view the graph as it was at that point. Partial runs are marked Partial.
- Turn on Compare and pick a Base and a Target snapshot to see which resources were added, removed, or modified between the two runs.
Editing and exporting the diagram
Section titled “Editing and exporting the diagram”- Use the View / Edit toggle in the top corner of the graph to switch to edit mode, where you can add, edit, and delete resources, groups, and connections to model parts of your architecture that Fencer does not discover.
- In edit mode, the graph menu lets you Save State and Load State to keep named versions of your diagram (saved in your browser), or return to the Latest Scan.
- From the graph menu, choose Save as PNG, Save as SVG, Save as Mermaid File, or Save as Excalidraw File to export the diagram.
Triggering a manual scan
Section titled “Triggering a manual scan”- From the Assets page, click Discover in the page header to trigger a fresh architecture discovery. While it runs, the button shows the current scan phase.
- Manual scans are throttled—if you have recently triggered one, the button is disabled and its tooltip shows how many minutes you must wait before the next scan.
Using the asset inventory
Section titled “Using the asset inventory”- Switch to the Inventory tab on the Assets page.
- This provides a searchable, sortable table of all discovered resources.
- Use the search box to find resources by description, slug, parent resource, or region.
- Click on any resource to see its full details, including metadata, parent resource information, and up to 20 active open vulnerabilities. Click View full asset details to open the resource’s own page.
- The inventory supports the same filters and filter operator as the graph view, plus a Scope filter.
- Select rows and click Set In Scope or Set Out of Scope to change the scope of several resources at once.
- Right-click a row and choose View in architecture graph to jump to that resource on the graph.
Resource categories
Section titled “Resource categories”Resources are automatically categorized for visual clarity on the graph. Categories include:
- Application — Cloud accounts and tenants, apps, workers, and the public user node
- Compute — EC2 instances, virtual machines, droplets
- Containers & Orchestration — ECS, EKS, AKS, Kubernetes clusters
- Data Stores — RDS, DynamoDB, Cosmos DB, Redis
- Networking — VPCs, subnets, firewalls, load balancers
- Storage & Backup — S3 buckets, GCP storage, Render disks
- Security, Identity & Secrets — Key vaults, security groups, IAM roles
- Domains & DNS — Route53, DNS records, SSL certificates
- Edge & CDN — CloudFront, Azure Front Door, CDN profiles
- Ingress & APIs — API gateways, load balancers, ingress controllers
- Messaging & Streaming — SQS, SNS, Event Hub, Service Bus
- Observability & Audit — CloudTrail, CloudWatch, monitoring services
- Analytics & Lake — BigQuery, Athena, Redshift, Synapse
- Developer & Delivery — Amplify, Elastic Beanstalk, build pipelines
- Zero Trust — Cloudflare Zero Trust tunnels, access policies, gateways
- Third Party Service — External services your resources connect to
Viewing vulnerabilities for a resource
Section titled “Viewing vulnerabilities for a resource”- From a resource’s details (opened from a graph node or from the inventory), you can see active open vulnerabilities associated with that resource.
- Click the Filter for N vulnerabilities link to navigate directly to the vulnerabilities list, pre-filtered for that specific resource.
Examples
Section titled “Examples”Exploring an AWS deployment:
- Connect your AWS integration and wait for the initial architecture scan to complete.
- Open Main > Assets. You will see your AWS account as a root node, with child resources like VPCs, EC2 instances, RDS databases, and Lambda functions branching out.
- Open Display and check Group by > Region to organize the graph by AWS region.
- Click on an RDS instance node to view its details and check for associated vulnerabilities.
- Switch to the Inventory tab and search for “s3” to quickly find all S3 buckets across your account.
Troubleshooting
Section titled “Troubleshooting”- No resources appear on the graph — Ensure at least one cloud integration is connected and that an architecture scan has completed. If filters are active, click Clear filters on the empty graph.
- Discover button is disabled — Manual scans are rate-limited. Hover over the button to see the remaining cooldown before trying again.
- Discover button is missing — The button only appears when an integration is connected, the subscription is active, and your role can run scans.
- Missing resources from a specific provider — Check the Some assets are missing notice above the graph, then verify that the integration credentials have sufficient permissions to discover resources. Check the integration settings page for any errors.
- Graph is slow to load with many resources — Use the Grouped display mode and apply filters to reduce the number of visible nodes.