Azure
Everything is read per subscription, except Users, which come from Microsoft Graph and exist once per tenant.
AWS
Everything is read per region, except S3 buckets and the identity types, which are account-wide.
Secrets and KMS keys are inventory only. Cymph records that they exist and their metadata — it never reads a secret value or key material.

