Beta
Find security, reliability and cost issues in your AWS account and IaC
Connect an AWS account with a read-only role and add your Git repositories. InfraScan Cloud scans them, grades each pillar, estimates monthly savings and tells you how to fix what it finds.
Sign in with GitHub.
What it checks
-
Security
Curated Prowler checks: public exposure, encryption, IAM hygiene, logging and detection services that are switched off.
-
Reliability
Backups, point-in-time recovery, multi-AZ setups, deletion protection and expiring certificates.
-
Cost
Idle and oversized resources, old snapshots, missed commitments, each with an estimated $ / month.
-
Repositories
Terraform, CloudFormation and other IaC with Checkov, plus known vulnerabilities in container images.
How it works
-
Connect
Launch our CloudFormation stack in your account. It creates one read-only role; the role ARN comes back to us automatically.
-
Scan
Every enabled region, on demand or on a schedule. Add public repositories next to your accounts.
-
Fix
Findings come with fix steps. Accept a risk or mark a finding as fixed; the next scan verifies it.
What we can and can't see
- Read-only role based on AWS's SecurityAudit and ViewOnlyAccess policies.
- Explicit denies on reads that return data or secrets: S3 objects, Secrets Manager, SSM parameters, Lambda and container environment variables, EC2 user data.
- No stored credentials. Each scan uses temporary credentials, kept in memory only, and an ExternalId unique to your connection.
- Visible in your CloudTrail: every scan shows up as session infrascan-<scan id>.
- Open template. Read the role's template before you launch it; delete the stack to revoke access.
Prefer the command line?
The free, open-source InfraScan CLI scans IaC repositories locally and in CI (GitHub Actions, Bitbucket Pipelines). InfraScan Cloud adds AWS accounts, history across scans, schedules and teams.
Run your first scan
Connecting an account takes about a minute.