Security
Public buckets, open security groups, root access keys, missing MFA, unencrypted data. Ranked, so you start with what an attacker would.
Read-only · nothing installed · first results in about a minute
Know what is wrong in your AWS accounts, and what it costs.
CloudPosture reviews every account against Well-Architected Security, Reliability and Cost Optimization, ranks what it finds by severity and tells you exactly how to fix it. It also shows what every service costs, this month and next.
Free for one AWS account. Upgrade when you need more.
Three pillars, one review
Every finding carries its severity, the evidence, the best practice behind it and the fix, as console steps, AWS CLI and Terraform.
Reliability
Single-AZ databases, missing backups, unprotected volumes: the gaps that turn an incident into an outage.
Cost Optimization
Idle and oversized resources, old snapshots, forgotten IPs, each with a monthly saving estimate.
What every service costs
The bill, broken down by service and by the resources behind it: last months, the current month, and where the month is heading at today's pace. Unusual spend is flagged before the invoice arrives.
- Month by month history per service
- Forecast for the current month
- Savings you can act on, with the resource and the amount
- A weekly email: what changed, what it cost
Connected in a minute
No agent, no stack, no keys handed over. You create one read-only role, and you can delete it any time.
- 1
Paste one command
In AWS CloudShell, or let the desktop connector do it with a profile you already have. It creates a read-only role that trusts only CloudPosture, with your own External ID.
- 2
CloudPosture scans
Every enabled region, on demand or on a schedule. Run it in an organization's management account and every member account connects at once.
- 3
Fix what matters
Findings ranked by severity, with the exact fix. The next scan confirms it is gone.
Your accounts in your pocket
The iPhone app has everything the web has: findings, costs, savings, scans, your AWS accounts and your team. A notification tells you when a scan finds something critical.
- Sign in by scanning a code from the web: no password, no keys on the phone
- Scan now, from anywhere
- Reports as PDF or CSV, straight to the share sheet
Coming soon to the App Store
Built to be trusted with production
Read-only, enforced
The role allows read operations only, generated from the check catalogue. The scanner refuses any other call before it is sent.
No stored credentials
CloudPosture assumes your role for sessions of at most one hour. There are no keys to leak, and every session is in your audit log.
Leave in one step
Delete the role and access ends. Delete your workspace and all its data goes with it.
Your data stays yours
Findings and costs are visible to your workspace only. No secret values, object contents or tag values are ever read. Export everything whenever you want.
Simple pricing
Start free. Prices in euros, VAT where it applies. Yearly plans get two months free.
Free
€0
No card needed
- 1 AWS account
- Scheduled scans weekly, Scan now any time
- 30 days of history
- 1 member
- This month's top 5 services by cost
- 20 questions to the AI assistant a month
Pro
€29 / month
or €290 a year, €58 less
- Up to 10 AWS accounts
- Scheduled scans daily, Scan now any time
- 1 year of history
- 3 members
- Full cost history, forecast and savings
- 300 questions to the AI assistant a month
- CSV exports
- Unusual spend alerts
Team
€99 / month
or €990 a year, €198 less
- Up to 50 AWS accounts
- Scheduled scans every 6 hours, Scan now any time
- 2 years of history
- 20 members
- Full cost history, forecast and savings
- 1,500 questions to the AI assistant a month
- CSV exports
- Unusual spend alerts
Questions
Can CloudPosture change anything in my account?
No. The role it uses allows read operations only, and the scanner checks every call against that list before it leaves. Fixing stays with you: each finding tells you how.
What do I install?
Nothing in your account except the read-only role. On your computer, the optional connector lists your AWS profiles so you can pick one; CloudShell works without it.
Does it work with AWS Organizations?
Yes. Run the command once in the management account and every member account is connected and scanned.
How do I stop?
Delete the role in your account. Deleting your workspace removes all its data for good.