Onam Estate
Onam Estate is the cloud estate of record. It discovers every resource across your connected accounts, records the relationships between them, and keeps that picture current run after run — so the inventory is a live system rather than a spreadsheet somebody exported once.
It is a separate product, not a feature of Onam Security. It is granted per organisation and is never bundled into a security plan tier.
What it answers
| Question | Where |
|---|---|
| What do we run, where, and in which account? | Inventory |
| How is it wired together, and what reaches outside? | Architecture |
| Is the picture current, and did the last run finish? | Pipeline |
| Why can't I see any of this? | Access & entitlement |
Why an estate product exists at all
Ask how many production databases you run and you will get three answers: one from the CMDB, one from Terraform state, one from the billing export. The CMDB was last reconciled by hand. The state file only covers what was provisioned through the pipeline. The billing export knows cost but not what a resource connects to.
The gap between those three is where forgotten infrastructure lives — and it is the same gap that produces both the security surprise and the cost surprise. Estate closes it by making discovery the source, not reconciliation.
How discovery works
- A discovery pipeline enumerates resources across your connected accounts and regions using the same read-only credentials as the rest of the platform. Nothing is installed and nothing is modified.
- Each resource is written as an asset with provider, region, account, state, last-seen time and monthly cost.
- Relationships are written as edges — containment edges describe what lives inside what, external edges describe what crosses the account boundary.
- Every pass is recorded as a run with its trigger, status, start and completion, so the inventory carries its own provenance.
Estate and Onam Security share one discovery pass. An organisation entitled to both does not connect its cloud accounts twice, and does not get two inventories that disagree.
What it is not
Estate does not evaluate posture rules, score risk, or raise security findings — that is Onam Security. Estate answers what exists and how it is connected. The two products read the same discovery output and answer different questions from it.