Audit your AWS account without giving anyone access to it
Run a read-only aws command, paste the JSON, get findings. The rules engine ships inside this page and runs on your machine — there is no upload and no API call, and you can prove it by disconnecting from the network before you press Analyse.
Run any of these
aws ec2 describe-security-groupsSecurity groups — What is reachable from the internetaws ec2 describe-volumesEBS volumes — Detached volumes, and gp2 that should be gp3aws ec2 describe-addressesElastic IPs — Addresses billing with nothing behind themaws ec2 describe-snapshots --owner-ids selfSnapshots — Old snapshots, minus your backup policyaws bedrock get-model-invocation-logging-configurationBedrock logging — Whether your prompts are recorded anywhereaws bedrock list-guardrailsBedrock guardrails — What is configured, and what that does not proveWhat this tool cannot tell you
A paste is a snapshot of configuration, and some of the most important questions are not in it. Whether a security group is actually attached to anything. Whether that log bucket is readable by the internet. Whether your application passes the guardrail it has configured. Whether an instance is over-provisioned, which needs metrics no describe-command returns.
Where the answer needs a call this tool cannot make, it says so and gives you the command. It never fills the gap with a guess — which is also the reason some findings here carry no severity at all.
The full CloudArq audit makes those calls. It connects through a read-only IAM role with an ExternalId, runs 192 checks instead of a handful, maps what it finds to compliance-framework controls, and runs on a schedule rather than when you remember to. See what that looks like or check the pricing.
Questions
Does anything I paste leave my browser?
No. The rules engine ships inside this page and runs on your machine. There is no upload, no API call, and no analytics event carrying your input. You do not have to take our word for that — turn off your network after the page loads and press Analyse. It still works, which it could not if it were sending anything anywhere. The engine is MIT-licensed and the source is on GitHub, so you can read exactly what runs.
Which commands can I paste?
aws ec2 describe-security-groups, describe-volumes, describe-addresses, describe-snapshots --owner-ids self, aws bedrock get-model-invocation-logging-configuration, and aws bedrock list-guardrails. Paste one or all of them, in any order, into the same box — the tool works out which is which from the JSON. All six are read-only commands.
Why do some findings have no severity?
Because a paste cannot support one. Whether SSH open to the world is critical or irrelevant depends on whether the security group is attached to a running instance, and that is a separate API call this input does not contain. Rather than guess, the tool reports the rule-level risk and names exactly what it could not check. The full CloudArq audit makes that second call and grades it properly.
How is this different from the paid product?
The rules here are the same judgment, re-expressed for input that arrives as a paste — a parity test pins them against the production scanners. What the paid audit adds is everything a paste cannot carry: it makes the follow-up API calls this tool can only tell you to run, covers 192 checks instead of a handful, maps findings to compliance-framework controls, and runs on a schedule rather than when you remember to.
Do you store the results?
There is nothing to store. The results exist in the page you are looking at and are gone when you close the tab. Nothing is written to a server, and nothing is written to local storage.