CloudAgent gives you AI agents that manage your cloud infrastructure. They handle tasks like security compliance, cost optimization, deployments, and monitoring. You remain in control as agents show you their plans, wait for your approval, then execute. Think of it as having a cloud operations team that works 24/7 without needing to hire an army of cloud experts.

How can AI agents be trusted with production cloud infrastructure?

You stay in control through approval workflows where every infrastructure change can require human approval before execution, custom security controls with granular access rules, complete audit trails of every action, self-hosted deployment options, and progressive trust models starting with read-only access.

How does it actually reduce costs?

CloudAgent agents delete unused resources, schedule non-production shutdowns, right-size infrastructure based on usage patterns, and recommend architectural optimizations. Early customers report 15-40% cost reduction within 90 days. Unlike dashboards, CloudAgent actually fixes the problems.

1. Assessment Phase

AWS CIS Controls v8 IG1 Compliance Assessment Execution

20 Credits

AWS CIS Controls v8 IG1 Compliance Report

Overview

This report evaluates AWS configurations against the automated controls mapped to AWS CIS Controls v8 IG1. The assessment covers 21 mapped controls using 88 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.

Mapped controls

1.1 Establish and Maintain Detailed Enterprise Asset Inventory: No EC2 Instances Stopped for More Than 30 Days, Elastic IP Addresses In Use, No Unused Network Access Control Lists (NACLs), No Unused Security Groups, EC2 Instance Compliant SSM Association Status
1.2 Address Unauthorized Assets: Amazon GuardDuty is Enabled
10.1 Deploy and Maintain Anti-Malware Software: Amazon GuardDuty is Enabled
10.2 Configure Automatic Anti-Malware Signature Updates: Amazon GuardDuty is Enabled
11.2 Perform Automated Backups: RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EFS Covered by AWS Backup, DynamoDB Table Point-in-time Recovery Enabled, EC2 Instance EBS Optimization Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, RDS Automatic Backups Enabled, Redshift Automatic Snapshots Enabled, AWS Redshift Should Have Required Maintenance Settings, S3 Bucket Encryption is Enabled, S3 Bucket Versioning Enabled
11.3 Protect Recovery Data: EC2 Default Encryption is Enabled, EC2 Instance Volumes are Encrypted, RDS Storage Encryption is Enabled
11.4 Establish and Maintain an Isolated Instance of Recovery Data: RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EFS Covered by AWS Backup, DynamoDB Table Point-in-time Recovery Enabled, EC2 Instance EBS Optimization Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, RDS Automatic Backups Enabled, Redshift Automatic Snapshots Enabled, AWS Redshift Should Have Required Maintenance Settings, S3 Bucket Encryption is Enabled, S3 Bucket Versioning Enabled
12.1 Ensure Network Infrastructure is Up-to-Date: EC2 Instances Managed by Systems Manager (SSM), EC2 Instances Compliant with SSM Patching Requirements
3.3 Configure Data Access Control Lists: CloudWatch Log Groups Retention Policy Configured, Database Migration Service Instance Not Public, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, EC2 Instance Metadata Service v2 Enforced, IAM Instance Profile is Attached to EC2 Instance, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, ECS Task Definition User Check for Host Mode, EKS Control Plane Public Access Disabled, EMR Kerberos Authentication Configured, EMR Cluster Instances do not Allow Public Access, Amazon Elasticsearch Domain is in a VPC, No Access Keys for Root Account, No Empty IAM Groups, No Inline IAM Policies Attached, IAM Policies Unused (Unattached) Should Be Removed, No IAM Principals with Full Administrator Permissions ":", IAM Users in Groups, IAM Policies Attached to Roles or Groups Only, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, RDS Storage Encryption is Enabled, No Public Redshift Clusters, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), No Direct Internet Access for SageMaker Notebook Instance, No Public SSM documents (customer owned)
3.4 Enforce Data Retention: CloudWatch Log Groups Retention Policy Configured
4.1 Establish and Maintain a Secure Configuration Process: AWS account is part of AWS Organizations, Ensure CloudTrail is Enabled for this Region, EBS Volume In Use, No EC2 Instances Stopped for More Than 30 Days, AWS Redshift Should Have Required Maintenance Settings, EC2 Instance Compliant SSM Association Status
4.6 Securely Manage Enterprise Assets and Software: AWS account is part of AWS Organizations, Auto Scaling Groups Use ELB Health Checks, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389), EC2 Default Encryption is Enabled, EC2 Instance Volumes are Encrypted, IAM Instance Profile is Attached to EC2 Instance, No Access Keys for Root Account, MFA for Root Account is Enabled, Hardware MFA for Root Account is Enabled, MFA for Users with Console Access, No Inline IAM Policies Attached, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", IAM Users in Groups, IAM Policies Attached to Roles or Groups Only, Ensure that KMS Key Rotation is Enabled, No Public S3 Buckets, S3 Bucket Encryption is Enabled, S3 Block Public Access is Enabled (Account-Level), S3 Bucket Access Logging Enabled, S3 Bucket Encryption in Transit is Enforced, Default Security Group No Rules, VPC Flow Logs Enabled
4.7 Manage Default Accounts on Enterprise Assets and Software: No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389), MFA for Root Account is Enabled
5.2 Use Unique Passwords: MFA for Root Account is Enabled, MFA for Users with Console Access, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater)
5.3 Disable Dormant Accounts: No Unused IAM User Credentials (90 Days)
5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts: No Access Keys for Root Account, No IAM Principals with Full Administrator Permissions ":"
6.5 Require MFA for Administrative Access: MFA for Root Account is Enabled, MFA for Users with Console Access
7.1 Establish and Maintain a Vulnerability Management Process: EC2 Instances Compliant with SSM Patching Requirements, Amazon GuardDuty is Enabled, AWS Security Hub is Enabled
7.3 Perform Automated Operating System Patch Management: EC2 Instances Compliant with SSM Patching Requirements, AWS Redshift Should Have Required Maintenance Settings
8.1 Establish and Maintain an Audit Log Management Process: CloudWatch Log Groups Retention Policy Configured
8.2 Collect Audit Logs: CloudFront Distribution has Access Logging Enabled, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure CloudTrail is Enabled for this Region, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, Load Balancer Access Logging is Enabled., Amazon Elasticsearch Domain Application/Performance Logging Enabled, RDS Logging Enabled, Redshift Clusters Audit Logging Enabled, S3 Bucket Access Logging Enabled, API Gateway Stage Access Logging Enabled, API Gateway Stage Logging is Enabled, VPC Flow Logs Enabled, WAF WebACL Logging Enabled

The report includes actionable findings and remediation guidance for supported checks.