AWS Storage Inventory: Setup and Assessment

Overview

AWS Storage Inventory in Spotto assesses an existing Amazon S3 Inventory report for one bucket. It shows storage-class and object-age evidence without opening your application objects or walking every object version during account sync.

The normal 12-hour AWS sync refreshes bucket configuration. Storage Inventory is a separate, explicit Assessments action with its own progress and results. Running it does not enable an automatic assessment schedule. AWS continues to generate reports on the daily or weekly schedule you configure in AWS.

Before you start

You need:

• A connected AWS account and its bucket visible in Spotto Resources.
• Permission to view assessments and reports, plus manage permission to run one.
• An existing S3 Inventory configuration, its configuration ID and source bucket Region. An AWS administrator creates or changes that configuration.
• Read access for Spotto's account role to the exact inventory configuration and report destination described below.

AWS Inventory generation, report storage and read requests can incur AWS charges; see Amazon S3 pricing. This guide does not estimate those charges or promise a savings amount.

Prepare an S3 Inventory report

1. In the AWS S3 console, open the source bucket's Management tab and find its Inventory configurations.
2. Open an existing configuration, or ask your AWS administrator to create one.
3. Choose CSV or Parquet output. Spotto does not support ORC assessment.
4. Include Size, Storage class and Last modified date in the report.
5. Choose Current versions or All versions for the evidence you need. All-version reports also identify versions and delete markers. A prefix filter limits the report's coverage to that prefix.
6. Choose Daily or Weekly, and confirm the report destination bucket and prefix. AWS requires the destination bucket to be in the source bucket's Region and to allow S3 to deliver the report.
7. Record the configuration ID and source bucket Region for Spotto.

AWS can take up to 48 hours to deliver the first report. Subsequent reports follow the selected frequency. Creating the configuration does not make a report immediately available. See AWS's S3 Inventory configuration instructions.

Grant report-only read access

The AWS administrator should scope access to the selected configuration and its report destination. Spotto reads inventory metadata files; it does not need permission to read the source bucket's application-object contents.

Permission	Scope	Purpose
s3:GetInventoryConfiguration	The source bucket	Read the selected Inventory configuration.
s3:ListBucket	The destination bucket, with s3:prefix limited to this report's subtree	Find dated report manifests.
s3:GetObject	Only manifest and data files beneath this report's destination subtree	Read the delivered report.
kms:Decrypt, when needed	The customer-managed KMS key that encrypts the report	Read SSE-KMS-encrypted report files.

The report subtree normally contains the destination prefix, source bucket name and configuration ID, including its dated manifests and data files. Keep object reads limited to that subtree, even when the source and destination are the same bucket. See AWS's S3 operation permissions.

Existing explicit denies still apply

The standard Spotto role deliberately denies object reads outside the configured billing export. Adding an Inventory Allow alone does not override that deny. Have the administrator maintain a narrowly scoped exception for the exact report subtree in the policy that owns the role, preserving billing access and denies for other objects. Do not replace this with unrestricted s3:GetObject access. See AWS permissions and guardrails.

For customer-managed SSE-KMS encryption, both the role's permissions and the KMS key policy must permit the required decrypt access. A destination bucket in another account must also permit the role through its bucket policy. The separate permission for Amazon S3 to deliver reports does not grant Spotto permission to read them. See AWS SSE-KMS download permissions and AWS Inventory delivery permissions.

Run an assessment in Spotto

1. Select the owning company and AWS account in Spotto.
2. Open Resources and locate the AWS bucket.
3. Select Assessments on its resource row, or on its resource details when available.
4. Open Storage Inventory and enter the Region and Inventory configuration ID from AWS.
5. Select Run assessment.
6. Follow the separate assessment status until it completes or explains why it is blocked.

Use Load report to view a stored assessment without starting a new run. After changing the Region or configuration ID, load or run that configuration; results from the earlier selection do not describe the new selection.

Spotto does not create the AWS Inventory configuration, change AWS permissions, or fall back to a direct object scan when the report is missing. Your existing Azure Storage Inventory Analyze workflow is unchanged; see the Azure Storage Inventory guide.

Read report dates and coverage

Check the Report date alongside Requested. Report date is the provider report's date; Requested records when the assessment was requested, not when it finished. Reassessing an old report does not make its source evidence current.

Waiting for results means the request was accepted and is awaiting an outcome. It may be waiting to run or already running; this label does not identify a precise processing phase.

• Current versions covers the versions included by AWS's current-version report. It does not describe retained older versions.
• All versions counts analyzed object versions, not distinct object keys. Valid delete-marker rows remain part of the report's row counts but are excluded from analyzed version, byte, storage-class and age totals. Missing marker size is not treated as zero-byte object evidence.
• Filtered report means only the configured prefix is covered.
• Complete describes processing of that report. It does not mean every possible version, prefix or current bucket change was covered.
• Partial, missing fields or blocked status means the report cannot support the full assessment. Unavailable evidence is not zero usage or zero savings.

The aggregate storage-class and age results support review. They do not establish that an object is safe to delete or promise a monetary saving.

Large CSV and Parquet reports

CSV is processed incrementally; there is no total-row limit or silent truncation. A single CSV record above 1 MiB is blocked.

Parquet reports can contain many bounded row groups. The current limits are 32 GiB per report file, 4 MiB of footer metadata, and 100,000 rows or 16 MiB of declared uncompressed data per row group. A file or group beyond these limits is blocked rather than partly assessed and marked complete. The reader still materializes one row group, so Parquet memory use depends on that group's contents.

If a valid Parquet report exceeds a limit, select CSV in the AWS Inventory configuration and wait for the new CSV report before running another assessment. Native AWS Inventory does not expose a row-group-size control. Changing report frequency alone does not guarantee smaller groups.

Troubleshooting

What you see	Likely cause	What to do
Assessments is missing	Company, account or Portal access is wrong, or the resource has no supported assessment	Check the selected scope and ask your administrator to review assessment and report permissions.
Inventory report is not configured or no recent report is found	Configuration ID or Region is wrong, delivery is pending, or a report is no longer available	Check the existing AWS configuration and delivery destination. Allow up to 48 hours for the first report, then run again.
Report access fails	Missing report-prefix permission, an explicit deny, destination bucket policy or KMS key access	Have the AWS administrator review the narrowly scoped access above; avoid granting source-object reads.
Missing report fields or Blocked	Required columns are absent, data is malformed, integrity checks failed, or a processing limit was reached	Include the required fields, check the delivered report, and use CSV Inventory when a Parquet report exceeds a limit. Run after a valid replacement arrives.
Stale	The stored result uses an old or undated report	Confirm a new AWS report has arrived, then run a new assessment.
Superseded	A newer assessment replaced the requested run	Load the current report or follow the newer run; the older request is not reported as completed.

Get help

If the issue persists, contact Spotto support with the company, AWS account, bucket, Region, Inventory configuration ID and displayed status. Do not send access keys, credentials or application-object contents.

Optimize Your Azure Environment

Looking to enhance your cloud setup for cost efficiency, performance, reliability, or security?

Talk to a cloud specialist. Email us or schedule a 30-minute consultation and let's optimize your cloud environment together.

Book a Free Consultation