Skip to main content
CloudArq
cloudarq · EU-hosted · read-only

See every misconfiguration, wasted dollar, and AI-workload risk in your AWS — with the exact fix.

Agentless AWS CSPM for your whole account — from IAM and S3 to your Bedrock agents’ blast radius. Read-only, no agents, specific down to the resource ARN.

192
checks
6
pillars
0
agents
§ 01 · the problem

Your AWS bill went up. Nobody's sure why.

The console has 300+ services and no single answer. Spreadsheets go stale the moment you close them. The risk and the waste are both real — just scattered across regions, accounts, and tabs.

findingsillustrative example
Public S3 bucket (read)
arn:aws:s3:::example-org-assets
Critical
Bedrock agent can act without confirmation
order-support-agent · create_refund
High
Unattached EBS volume, billing monthly
vol-0example · 500 GB gp3 · —/mo
High
IAM key, no MFA, 400+ days old
AKIA… · admin
Medium
§ 02 · see a fix

Not just “you have a problem.” The exact way to fix it.

Pick a finding. Get the fix in your tool of choice — copy, paste, done.

CriticalSecurityillustrative example

S3 bucket allows public read

arn:aws:s3:::example-org-assets

The bucket policy grants s3:GetObject to Principal "*". Any anonymous user on the internet can list and download every object.

1. S3 → example-org-assets → Permissions
2. Block public access (bucket settings) → Edit
3. Enable "Block all public access" → Save
4. Remove the "Principal": "*" statement from the
   bucket policy.
§ 03 · how it works

Three steps. No agents to install.

  1. 01

    Connect a read-only role

    Launch one CloudFormation stack. We assume a read-only IAM role with an ExternalId — no keys, no agents, no write access.

  2. 02

    192 checks across 6 pillars

    The orbital scan runs every pillar against your account in parallel — security, cost, reliability, performance, operations, sustainability.

  3. 03

    Prioritized report with fixes

    Findings ranked by severity and dollar impact, each with a copy-paste fix for Console, CLI, Terraform or CloudFormation.

§ 04 · six pillars

One scan, six lenses on the same account.

Because they run together, cross-cutting issues surface that a single-purpose tool misses — e.g. exposed Bedrock keys show up as both a cost anomaly and a security breach (LLMjacking).

Security
Public S3 buckets & ACLs
IAM keys without MFA
Security groups open to 0.0.0.0/0
CIEM over-privileged roles
Cost
Idle EC2 / RDS instances
Unattached EBS & idle EIPs
gp2 → gp3 migration
Savings Plan coverage
Reliability
Backups configured
Multi-AZ databases
Deletion protection
Cross-AZ failover
Performance
Throttled APIs
Undersized instances
Missing caching
Hot partitions
Operations
CloudTrail enabled
Tagging coverage
Config drift
Log retention
Sustainability
Idle resource waste
Oversized volumes
Region efficiency
Graviton candidates

192 checks across 6 pillars — the total is exact; the example checks per pillar are a sample, not the full enumeration.

§ 05 · trust & security

Read-only by design. Nothing leaves without you.

Verify the exact role policy yourself →
AES-256-GCM
All stored findings encrypted at rest.
Read-only IAM
The role grants describe/list only — never write.
ExternalId
Every role assumption is scoped with your unique ExternalId.
EU-hosted
Findings stored in Helsinki (Finland), in the EU.
GDPR export
Export or delete your data on demand.

CloudArq the product scans against 8 compliance frameworks. The business holds no certifications — those are two separate facts and we never blur them.

§ 06 · pricing

Start free. Scale when it pays for itself.

Starter
$0/mo
44 checks · 50 resources
✓1 AWS connection
✓2 scans / month · on-demand
✓Severity-ranked report
✓Email summary
Start free scan
Recommended
Pro
$79/mo
4 frameworks · 108 checks
✓Scheduled scans
✓Copy-paste fixes (all formats)
✓Cost + reliability pillars
✓Slack alerts
Start with Pro
Max
$199/mo
8 frameworks · all 192 checks
✓All six pillars
✓Sustainability + CIEM
✓AI remediation
✓Trend history
Start with Max
Organization
Custom
8 frameworks · pooled accounts
✓SSO / SAML
✓Pooled multi-account
✓Audit log & RBAC
✓Dedicated support
Talk to us

Every account starts on the free Starter plan — 1 AWS connection, up to 50 resources, 2 scans a month. No card until you upgrade to Pro or Max. Frameworks tier-gated: Pro = 4, Max / Org = 8. The shipped pricing page is the source of truth.

§ 07 · inside the app

Every workspace you sign in to.

A preview of the client workspace — score, waste, posture trend and severity-ranked findings at a glance. The shipped app wires it to your account's live scan.

Search…🔔
Dashboard
last scan · just now · eu-north-1
product preview · illustrative
Security score
82/100
▲ 6 vs last scan
Open findings
37
3 critical · 9 high
Monthly waste
$1,240/mo
across 14 resources
Connections
3
all healthy
Posture trend12 scans
Trending up as fixes land.
Top findingsseverity-ranked
Public S3 bucket (read)Critical
IAM key, no MFA, 400+ daysHigh
RDS without Multi-AZHigh
Unattached EBS volumeMedium
gp2 volume — migrate to gp3Low

Representative layout — the shipped app wires every tile, chart, and finding to your account's live scan data.

Run your first scan today.

Free, no card. Read-only access, results in minutes.

Start free scan