Scans
Scans are how Escher learns your cloud. There are two types — Profile Scan (local) and Estate Scan (cloud) — and three modes for running them: one-off, scheduled, and multi-select.
The two types of scan
| Type | Reads | When it runs |
|---|---|---|
| Profile Scan (local) | Your local AWS / Azure CLI configuration — which profiles exist, which are signed in, which regions they cover | At app launch, when you add a profile, and whenever you toggle a profile in Settings → Profiles |
| Estate Scan (cloud) | Cloud-side metadata for the active profiles — resources, configurations, IAM, costs, recent events | When you trigger it from the Cloud Estate surface, or on a schedule |
A Profile Scan is fast (seconds) and free — it just looks at your local config. An Estate Scan hits cloud APIs and takes 3–8 minutes per account.
Everything below is about Estate Scans unless noted.
What an Estate Scan does
An Estate Scan reads metadata from one or more connected profiles (resources, configurations, IAM, costs, recent events) and updates Escher's local map of your estate. Every answer Escher gives is grounded in the most recent scan — so a fresh scan means fresher answers.
An Estate Scan does not:
- Modify any cloud resource
- Read application data inside your databases or storage
- Pull traffic-level metrics or live telemetry
Where to find scan controls
Estate Scans are triggered from the Cloud Estate surface in the app. The Learning Center also surfaces scan prompts as part of guided walkthroughs. The exact UI for choosing between one-off, scheduled, and multi-select modes is evolving; what's stable is the three modes themselves and what they're for:
| Mode | Use when |
|---|---|
| One-off scan | You want a single refresh of the currently-active profile(s) right now |
| Scheduled scan | You want recurring scans on a cadence |
| Multi-select scan | You want to scan a subset of profiles in one pass |
INFO
The specific panel layout, button labels, and where the modes live in the app may differ across builds. The functional behaviour is what's described below — if you can't find a mode in your build, ping your Tessell contact.
One-off scan
Trigger an estate scan from the app — Escher scans every currently-active profile.
Use one-off scans when:
- You just connected a new profile
- A teammate told you something changed and you want fresh data before asking
- You want a sanity-check after a deploy
A one-off scan typically completes in 3–8 minutes per account. You can keep working in the app while it runs — questions answered before the scan finishes use the previous snapshot, which Escher will tell you about explicitly.
Scheduled scans
Set Escher to refresh on a cadence. From the app's scan controls, choose the Schedule mode and pick the cadence:
| Cadence | Typical use |
|---|---|
| Hourly | Active production environments where things change fast |
| Every 4 hours | Standard production monitoring |
| Daily | Lower-velocity accounts (sandbox, archive, dev) |
| Weekly | Reference accounts you barely touch |
Scheduled scans run in the background. The Cloud Estate surface shows an In Progress indicator while a scheduled scan is running — it never blocks you from asking questions, and any answers produced mid-scan use the previous snapshot until the new one is committed.
TIP
Pick the lowest cadence that gives you fresh-enough answers. Hourly scans across 20 accounts is a lot of read traffic against your cloud APIs. Most teams settle on every-4-hours for prod and daily for everything else.
You can set a different schedule per profile from Settings → Profiles.
One-off vs scheduled: when to use which
| You want… | Use |
|---|---|
| Confidence that the next answer is current | One-off |
| To stop thinking about scan freshness | Scheduled |
| Both | Set a daily schedule, run one-off before high-stakes questions |
Multi-select scans
If you have many profiles connected but only want to scan a subset, open the scan controls in Multi-select mode, tick the profiles you want included, and trigger the scan. Use this when:
- You only care about a particular environment right now (e.g. just prod)
- You want to keep dev/staging out of the next batch of answers
- A specific profile failed its last scheduled scan and you want to retry it without disrupting others
The multi-select state is sticky — Escher remembers which profiles you ticked last and pre-fills the panel next time.
What you'll see during a scan
Estate refresh started
prod-aws (AWS 123456789012)
⏳ EC2 — scanning...
✓ S3 — 22 buckets
✓ RDS — 6 instances
⏳ IAM — scanning...
staging-aws (AWS 234567890123)
⏳ EC2 — scanning...Each service domain reports independently. If one service throttles or errors, the others continue. A failed service shows ⚠ with a short reason — usually a permission gap that you can fix and re-scan.
What happens after a scan
- The local estate snapshot is updated
- A small change summary appears at the top of Estate Overview:
+8 resources, -1, ~6 modified vs last snapshot - Subsequent questions use the new snapshot
- Past Canvases are not retroactively updated — they stay pinned to the snapshot they were generated against