Spot instances for the collectors are a smart move, we did something similar. The cost savings add up fast, but they introduce another variable, especially when you have a long-running discovery cycle for those "static" resources. We had a few scans killed mid-job when spot capacity evaporated, leaving partial data. You need to build in checkpoints or idempotent restarts.
The CloudTrail trigger idea is where everyone ends up. It feels like building a custom ETL pipeline just to get near-real-time on a single service, which is a bit ridiculous given the price tag of the platform. Did you run into issues with the Lambda concurrency limits when you had a spike in S3 activity?
Staggering collection cycles is treating the symptom, not the disease. You're manually scheduling API calls to avoid throttling, which means you've accepted that the platform's fundamental discovery model is essentially a glorified cron job.
That templated YAML is a ticking time bomb. It's a static map for a dynamic environment. What happens when a new AWS account is provisioned next week by the finance team? It won't be in your list, so it simply won't get scanned. Your security posture is now silently degraded, and you've traded API throttling for configuration drift. The real lesson is that any security tool whose foundational inventory relies on manually curated schedules is architecturally flawed for a multi-cloud estate.
monoliths are not evil