← Back to Overview

STACKIT Resource Explorer: Inventory for the Sovereign Cloud

stackit-resource-explorer catalogs every resource in a STACKIT organization — virtual machines, disks, buckets, networks, load balancers, IAM identities, and current spend — and makes them visible in one searchable dashboard. The tool is open source, self-hosted, and touches your cloud read-only.

As a German hyperscaler, STACKIT is a serious option for organizations with digital sovereignty requirements.

Why an Inventory for STACKIT?

The STACKIT console shows resources project by project. As long as a team works with two or three projects, that is enough. Once an organization grows across folder hierarchies, the questions change fundamentally: how many virtual machines are running in total? Which volumes are no longer attached to any server? Which project is driving this month's spend?

You cannot answer those by clicking through the console — not reliably, and not repeatably. Yet auditors, cost owners, and security teams ask them regularly. A central inventory turns a multi-hour manual investigation into a search query.

What the Explorer Catalogs

The starting point is the STACKIT Resource Manager API: the Explorer identifies the parent organization and recursively walks the entire folder hierarchy to find every accessible project. Dedicated scrapers then catalog the individual resource types:

• Virtual machines: availability zone, power state (RUNNING, SHUTOFF), machine type, boot and attached volumes, security groups, SSH keypairs, plus private and public IP addresses.
• Block storage: persistent volumes with size, performance class, encryption state, and the server they are attached to.
• Object storage: S3-compatible buckets including region and configuration.
• Networking: VPCs with prefixes, gateway routing, and labels, plus load balancers with their listeners and target pools.
• IAM: project-level role bindings for users, groups, and service accounts, alongside the service accounts defined within each project.
• Cost: current-calendar-month spend from the STACKIT Cost API v3 — per project and as an organization total, automatically converted from cents to EUR.

Each scraper runs on its own schedule and writes results to a PostgreSQL database. If a service is not enabled in a project, or the service account lacks permission, the Explorer logs a warning and continues with the remaining projects — a single inaccessible project never stalls the crawl.

Full-Text Search Across All Metadata

An inventory is only as useful as its search. The Explorer builds on PostgreSQL full-text search: a generated tsvector column with a GIN index covers resource names, types, regions, tags, and the complete JSON metadata. Queries run through websearch_to_tsquery and are ranked with ts_rank.

In practice this means you can paste an IP address and find the virtual machine using it, or search a volume ID and immediately see which server it is attached to. The result list is capped at 100 items to keep the UI fast — but the aggregations by type, region, and state are computed exactly across the full dataset and shown next to the results.

Spotting Deprecated Credentials

The most security-relevant part of the Explorer is how it classifies authentication schemes. For every identity it distinguishes modern asymmetric keypairs (Key Flow (RSA_2048)), human sign-in via OIDC / Enterprise SSO, and the deprecated Token Flow — the legacy model in which a long-lived, static API secret acts directly as a bearer token.

Legacy credentials like these are rarely documented and usually surface only when they expire or leak. The Explorer flags affected resources with a prominent warning chip and offers quick filters below the search bar: one click on Token Flow lists every identity still using static secrets, one click on Key Flow lists those on RSA keypairs. An open question becomes a work list.

Running and Configuring It

Getting started takes a Docker Compose file and a service account key. Prebuilt container images live in the GitHub Container Registry, so a single docker compose up -d brings up backend, frontend, and database. The dashboard is then available on port 8081, the REST API on port 8080.

The key is mounted as scraper.json. Importantly, the associated service account only ever needs read permissions. A role such as project.auditor at organization or folder level is sufficient; if you prefer granular access, assign the individual viewer roles per service. Scraper intervals are controlled through environment variables like STACKIT_COMPUTE_SCHEDULE or STACKIT_BILLING_SCHEDULE — as an interval (1h), a cron expression, or off to disable a scraper entirely.

Conclusion

Cloud sovereignty starts with visibility: what you cannot see, you can neither secure nor run economically. The STACKIT Resource Explorer delivers that visibility at modest cost — one container stack, one read-only service account, and the question of what is actually running in your cloud is answered.

← Back to Overview