Skip to main content

Plugin System

Infracast uses a plugin-based architecture for all discovery and output operations. Plugins are isolated subprocesses that communicate with the API server over gRPC — crashes or hangs in a plugin cannot affect the core platform.

How Plugins Work

When a discovery job runs, Infracast launches the relevant plugin, passes it tenant-scoped credentials, and streams the resulting nodes and edges back into the asset graph. Plugins are isolated — a crash in one plugin does not affect the platform or other jobs.

Process Isolation

Each plugin runs in an isolated process. If a plugin crashes, only that discovery job is affected — the API server and other jobs continue normally.

Config Field Types

Plugin configuration fields are typed and validated before execution:

TypeDescriptionExample
stringPlain text valueRegion, account ID
numberNumeric valueTimeout seconds, port
boolBoolean flagEnable MFA scan
secretCredential ID referenceAWS access key, password
listComma-separated valuesRegions list, IP ranges

Secrets are never passed in plaintext to plugins. The config contains a credential ID; the plugin host resolves the credential from the encrypted store at execution time.

Plugin Kinds

KindDescription
discoveryProduces asset graph nodes and edges from external systems
outputConsumes the asset graph to produce compliance reports, exports
transformModifies or enriches the asset graph in-place

Available Discovery Plugins

Infracast ships with 20 discovery plugins covering major infrastructure platforms:

Cloud Providers

Plugin IDProviderDiscovered Resources
awsAmazon Web ServicesEC2, VPC, S3, IAM, RDS, ECS, Lambda
azureMicrosoft AzureVMs, VNets, Storage, AD, AKS
gcpGoogle Cloud PlatformCompute, GKE, Cloud Storage, IAM
m365Microsoft 365Users, Groups, Policies, SharePoint

On-Premises Network

Plugin IDProviderDiscovered Resources
cisco-iosCisco IOS/NX-OSRouters, switches, interfaces, ACLs
juniper-junosJuniper JunOSRouting/switching fabric
fortinet-fortigateFortinet FortiGateFirewalls, VPN policies
palo-altoPalo Alto NetworksNext-gen firewalls, security zones
f5-bigipF5 BIG-IPLoad balancers, virtual servers
merakiCisco MerakiCloud-managed network devices
ubiquiti-unifiUbiquiti UniFiWi-Fi APs, switches
ubiquiti-edgemaxUbiquiti EdgeMAXEdge routers

Compute and Virtualization

Plugin IDProviderDiscovered Resources
vmware-vsphereVMware vSphereVMs, ESXi hosts, clusters, vCenter
windows-serverWindows / Active DirectoryAD domain, computers, users, GPOs
kubernetes-nativeKubernetesPods, nodes, namespaces, RBAC
active-directoryActive DirectoryDomain controller enumeration

Storage and Secrets

Plugin IDProviderDiscovered Resources
hashicorp-vaultHashiCorp VaultSecrets engines, policies, leases
netapp-ontapNetApp ONTAPVolumes, SVMs, SnapMirror
dell-powerstoreDell PowerStoreArrays, volumes, protection policies
pure-storage-flasharrayPure StorageArrays, volumes, protection groups

Available Output Plugins

Output plugins run after discovery to generate compliance mappings and reports:

Plugin IDFrameworkDescription
audit-cis-awsCIS AWS FoundationsCIS Benchmark Level 1 & 2
audit-cis-kubernetesCIS KubernetesK8s cluster hardening
audit-nist80053NIST SP 800-53 Rev 51,000+ controls mapped
audit-fedramp-moderateFedRAMP Moderate325 controls
audit-cmmc-l2CMMC Level 2110 practices
audit-pci-dssPCI-DSS v4.0300+ requirements
audit-soc2SOC 2 Type IITrust service criteria
audit-stig-awsDISA STIG (AWS)DoD hardening benchmarks
diagrams-drawioExport graph as draw.io diagram
terraform-hclGenerate Terraform from discovered infra

Plugin Configuration

Plugins are configured per-tenant via Credentials in the UI:

  1. Navigate to Settings → Credentials
  2. Click Add Credential
  3. Select the provider type
  4. Enter required fields (key IDs, secrets, URLs)
  5. The credential ID can then be referenced when creating discovery jobs

Example: AWS Plugin Config

{
"access_key_id": "cred:aws-production",
"secret_access_key": "cred:aws-production",
"regions": "us-east-1,us-west-2",
"account_id": "123456789012"
}

The cred:aws-production references a stored credential by name — the actual secret is never written to job configs.

Requesting New Plugins

If you need a plugin for a provider not listed above:

  1. Enterprise customers — open a support ticket at support.infracast.io with the provider name and use case
  2. Community — open a feature request on GitHub
Plugin Development

If you need to extend Infracast with a custom integration, contact us at support.infracast.io to discuss your requirements.