CloudAgent gives you AI agents that manage your cloud infrastructure. They handle tasks like security compliance, cost optimization, deployments, and monitoring. You remain in control as agents show you their plans, wait for your approval, then execute. Think of it as having a cloud operations team that works 24/7 without needing to hire an army of cloud experts.

How can AI agents be trusted with production cloud infrastructure?

You stay in control through approval workflows where every infrastructure change can require human approval before execution, custom security controls with granular access rules, complete audit trails of every action, self-hosted deployment options, and progressive trust models starting with read-only access.

How does it actually reduce costs?

CloudAgent agents delete unused resources, schedule non-production shutdowns, right-size infrastructure based on usage patterns, and recommend architectural optimizations. Early customers report 15-40% cost reduction within 90 days. Unlike dashboards, CloudAgent actually fixes the problems.

1. Assessment Phase

AWS Database Best Practices Assessment Execution

20 Credits

AWS Database Best Practices Report

Overview

This report assesses AWS resources against 62 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.

RDS DB Instances

RDS Auto Minor Version Upgrade Enabled
RDS Instance Default Admin Username Check
RDS IAM Authentication Enabled
RDS Enhanced Monitoring Enabled
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs
RDS for SQL Server DB instances should publish logs to CloudWatch Logs
RDS for SQL Server DB instances should be encrypted in transit
RDS for MariaDB DB instances should publish logs to CloudWatch Logs
RDS for MariaDB DB instances should be encrypted in transit
RDS DB instances should not be deployed in public subnets with routes to internet gateways
RDS DB instances backup retention period should be greater than or equal to 7

RDS DB Clusters

RDS Cluster Default Admin Username Check
RDS instances should not use a database engine default port
Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs
RDS DB clusters should have enough backup retention period set
RDS global clusters should run on a supported Aurora MySQL version

RDS Security Groups

RDS DB Uses Non-Default Security Groups
RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0

RDS Event Subscriptions

RDS Event Subscriptions: DB Parameter Group Changes
RDS Event Subscription for DB Security Group Changes
RDS Event Subscriptions: Cluster or Instance Failure Event Monitoring is Enabled
RDS Event Subscriptions: Instance Availability Event Monitoring is Enabled
RDS Event Subscriptions: Instance Low Storage Event Monitoring is Enabled

RDS DB Proxies

RDS DB proxies should require TLS encryption for connections

RDS Certificates

RDS DB instances CA certificates should not expire within next 7 days

DynamoDB Tables

DynamoDB Operations Logging with CloudTrail is Enabled
DynamoDB tables should automatically scale capacity with demand
DynamoDB Throughput Limit Check

DynamoDB Accelerator (DAX) Clusters

DAX Cluster Encryption in Transit is Enabled

DocumentDB Clusters

Deletion Protection is Enabled

DocumentDB Clusters

DocumentDB Audit logging Enabled
Amazon DocumentDB clusters should be encrypted in transit

Neptune Clusters

Neptune Audit logging Enabled
Neptune Cluster CloudWatch Log Export Check

Neptune Snapshots

Neptune Cluster Copy Tags to Snapshot Check

ElastiCache Replication Groups

ElastiCache (Redis) Multi-AZ is Enabled
Ensure ElastiCache Replication Groups Have Auto Failover Enabled

MSK Clusters

MSK Cluster Node-to-Node Encryption Enabled
MSK Enhanced Monitoring Enabled Check

OpenSearch Domains

Amazon Elasticsearch Internal User Database Enabled
Amazon Elasticsearch Software Updates are Available
Amazon Elasticsearch Domain Application/Performance Logging Enabled

OpenSearch Domains

OpenSearch Data Node Fault Tolerance Check
OpenSearch Primary Node Fault Tolerance
OpenSearch domain error logging to CloudWatch Logs should be enabled
OpenSearch domains should have fine-grained access control enabled
Connections to OpenSearch domains should be encrypted using the latest TLS security policy

Redshift Clusters

Redshift Clusters Audit Logging Enabled
AWS Redshift should have required maintenance settings
Amazon Redshift clusters should not use the default Admin username
Redshift security groups should allow ingress on the cluster port only from restricted origins
Redshift clusters should have Multi-AZ deployments enabled

DMS Endpoints

DMS Endpoints have SSL Enabled

DMS Replication Instances

DMS Replication Instances have Auto Minor Version Upgrade Enabled
DMS replication instances should be configured to use multiple Availability Zones

DMS Replication Tasks

DMS replication tasks for the target database should have logging enabled
DMS replication tasks for the source database should have logging enabled

DMS Certificates

Ensure that all the expired DMS certificates are removed

Redshift Serverless Workgroups

Connections to Redshift Serverless workgroups should be required to use SSL

Redshift Serverless Namespaces

Redshift Serverless namespaces should not use the default admin username
Redshift Serverless namespaces should export logs to CloudWatch Logs
Redshift Serverless namespaces should not use the default database name

The report includes actionable findings and remediation guidance for supported checks.