Hi @adamtoth,
Couple of things that come to mind: I'd try to tackle this from the very beginning. How are you actually discovering them? I'd suggest the Service Graph Connector for AWS (or Cloud Discovery!), and tags with quality that keep these CIs up to date, maintain the relationships you expect, and keep install status up to date with those syncs (or lifecycle status and stage if you are into CSDM!). If tagging is enforced upstream (SCPs, tag policies, whatever your cloud team uses), the mapping from cloud CI to application service mostly takes care of itself. If tagging is sloppy... no amount of CMDB-side certification will save the relationships.
+ If you're seeing duplicates or orphaned relationships, that's usually an identification/reconciliation problem worth fixing at the IRE level.
+ Humans should never be attesting attributes that AWS itself can report. If a value is wrong, the fix is in the integration or the IRE rules. Not saying you can't use the certification task, but if you can automate to a rather good precision... why not?
+ I'd work with certification on durable stuff like cloud accounts, application services, ownership fields, maybe VPCs (?)
Even if you never have all of your ephemeral CIs verified, that is fine. You want confidence that the pipeline catches drift within hours, with health metrics and tags that can prove it.
Hope it helps steer your research,
✅ If you found my answer helpful or correct in any way, please don't forget to mark it to help future readers! 👍
Kind regards,
Marcos Kassak
🌟 3x ServiceNow MVP
🎯 Certified Technical Architect
📓 kassak.sn
