Mission control
for the cloud you
didn't know you owned.
CloudArq runs 171 checks across security, cost, reliability, performance, operations, and sustainability on your AWS account — in a single scan. Read-only IAM. No agents.
Your AWS bill went up. Nobody's sure why.
Forgotten EBS volumes. NAT Gateways routing cross-AZ chatter. An S3 bucket with public list permissions that someone enabled at 11 pm in 2023. The cloud doesn't hide these things — but nobody's looking.
Cost Intelligence traces where your AWS spend — including AI / Bedrock usage — actually goes, ranks the quick wins by savings, and flags spend spikes and possible LLMjacking, each with the fix. On Pro and up; the free tier shows the headline number.
Below: an illustrative scan output. Real scans return findings shaped like these against your own account — counts and resources vary.
From credentials to remediation plan in three steps.
Connect via IAM role
Read-only role with ExternalId. One CloudFormation template — copy, deploy, paste the ARN back. No agents to install. No keys to share.
171 checks · 6 pillars
Security, cost, reliability, performance, operations, sustainability. Every check maps to CIS where applicable. AWS Well-Architected vocabulary throughout.
Prioritized report
Findings sorted by severity, blast radius, and remediation cost. AI-enriched fixes when ANTHROPIC_API_KEY is set; static remediation otherwise.
Pay per account. Cancel any time.
One subscription = one AWS connection. No seat math, no “contact us” for self-serve tiers. Tiers gate scan frequency, retention, and integrations.
Starter
1 connection · 44 checks · monthly manual scan · cost headline only · 30-day retention
Pro
107 checks · weekly scans · 500 resources/connection · Cost Intelligence (AWS + AI/Bedrock spend, ranked quick wins) · Slack + email alerts
Max
171 checks · daily scans · 2000 resources/connection · real-time AI spend-spike alerts + org rollup · API + webhooks + PagerDuty
Organization
Multi-account rollups · SSO (SAML) · pooled resources · signable DPA
Every scan emits an event stream.
What you see below are the kinds of events CloudArq emits during a typical workday — redacted for tenant privacy. Same vocabulary, no customer attribution.