[xga2]

note - I'm the project's maintainer

You're correct about the API calls & potential CloudTrail costs.

Regarding making calls to non-existent resources that doesn't tend to be an issue. Typically we start by making a call to whatever endpoint lists resources, and then fetch additional information for these resources.

As for permissions the wiki (https://github.com/nccgroup/ScoutSuite/wiki) has guidance towards the required privileges (including a minimal policy for AWS - https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Priv...)