CloudAgent gives you AI agents that manage your cloud infrastructure. They handle tasks like security compliance, cost optimization, deployments, and monitoring. You remain in control as agents show you their plans, wait for your approval, then execute. Think of it as having a cloud operations team that works 24/7 without needing to hire an army of cloud experts.

How can AI agents be trusted with production cloud infrastructure?

You stay in control through approval workflows where every infrastructure change can require human approval before execution, custom security controls with granular access rules, complete audit trails of every action, self-hosted deployment options, and progressive trust models starting with read-only access.

How does it actually reduce costs?

CloudAgent agents delete unused resources, schedule non-production shutdowns, right-size infrastructure based on usage patterns, and recommend architectural optimizations. Early customers report 15-40% cost reduction within 90 days. Unlike dashboards, CloudAgent actually fixes the problems.

1. Assessment Phase

AWS CISA Cyber Essentials Compliance Assessment Execution

20 Credits

AWS CISA Cyber Essentials Compliance Report

Overview

This report evaluates AWS configurations against the automated controls mapped to AWS CISA Cyber Essentials. The assessment covers 16 mapped controls using 119 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.

Mapped controls

Booting Up: Things to Do First-1: RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EC2 instances Covered by AWS Backup, EFS Covered by AWS Backup, FSx File Systems Covered by AWS Backup, Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, DynamoDB Table Point-in-time Recovery Enabled, EC2 Instance EBS Optimization Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, RDS Automatic Backups Enabled, Redshift Automatic Snapshots Enabled, S3 Bucket Encryption is Enabled, S3 Bucket Versioning Enabled
Booting Up: Things to Do First-2: MFA for Root Account is Enabled, Hardware MFA for Root Account is Enabled, MFA for Users with Console Access
Booting Up: Things to Do First-3: EC2 Instances Compliant with SSM Patching Requirements, RDS Auto Minor Version Upgrade Enabled, AWS Redshift Should Have Required Maintenance Settings
Your Crisis Response-2: Amazon GuardDuty is Enabled, AWS Security Hub is Enabled
Your Data-1: Backup Recovery Points are Encrypted, Ensure that CloudTrail logs are encrypted using KMS, CloudWatch Log Group Encryption Enabled, DynamoDB Encryption with KMS Enabled, EC2 Default Encryption is Enabled, EC2 Instance Volumes are Encrypted, EFS Encryption At-Rest Enabled, Elasticsearch Storage Encryption is Enabled, RDS Snapshots are Encrypted At-Rest, RDS Storage Encryption is Enabled, Redshift Clusters Encrypted At-Rest, Redshift Clusters Audit Logging Enabled, S3 Bucket Encryption is Enabled, S3 Default Encryption with KMS Key Check, SageMaker Endpoint Configuration Encrypted At-Rest, SageMaker Notebook Instance Encryption At-Rest Enabled, SNS Topic Encryption Enabled, API Gateway Stage Cache Encryption At-Rest is Enabled
Your Data-2: Imported and ACM-issued certificates should be renewed within 30 days of expiration, API Gateway domain names should use TLS 1.2 security policies, Application Load Balancer HTTP to HTTPS Redirect Enabled, Backup Recovery Points are Encrypted, Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that CloudTrail logs are encrypted using KMS, Ensure CloudTrail is Enabled for this Region, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, CloudWatch Log Group Encryption Enabled, Database Migration Service Instance Not Public, DynamoDB Encryption with KMS Enabled, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389), EC2 Default Encryption is Enabled, EC2 Instance Volumes are Encrypted, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, EFS Encryption At-Rest Enabled, Application Load Balancers Protected by AWS WAF, Load Balancers Use SSL Certificates, Elastic Load Balancers Secure Listeners Only, Load Balancer Access Logging is Enabled., EMR Cluster Instances do not Allow Public Access, Ensure Load Balancers Use ACM Certificates, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Storage Encryption is Enabled, Amazon Elasticsearch Domain is in a VPC, Amazon Elasticsearch Domain Application/Performance Logging Enabled, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, RDS Storage Encryption is Enabled, RDS Logging Enabled, RDS Snapshots are Encrypted At-Rest, No Public Redshift Clusters, Redshift Clusters Encrypted At-Rest, Redshift Clusters Audit Logging Enabled, Redshift Cluster Encryption In-Transit is Enabled, No Public S3 Buckets, S3 Block Public Access is Enabled (Account-Level), S3 Bucket Encryption is Enabled, S3 Bucket Access Logging Enabled, S3 Bucket Encryption in Transit is Enforced, S3 Default Encryption with KMS Key Check, SageMaker Endpoint Configuration Encrypted At-Rest, SageMaker Notebook Instance Encryption At-Rest Enabled, No Direct Internet Access for SageMaker Notebook Instance, Default Security Group No Rules, SNS Topic Encryption Enabled, API Gateway Stage Access Logging Enabled, API Gateway Stage Cache Encryption At-Rest is Enabled, API Gateway Stage Logging is Enabled, VPC Flow Logs Enabled, Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0, WAF WebACL Logging Enabled
Your Data-3: Application Load Balancers Protected by AWS WAF
Your Data-4: RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EC2 instances Covered by AWS Backup, EFS Covered by AWS Backup, FSx File Systems Covered by AWS Backup, Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, DynamoDB Table Point-in-time Recovery Enabled, EC2 Instance EBS Optimization Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, Load Balancers Deletion Protection Enabled, RDS Automatic Backups Enabled, RDS Deletion Protection Enabled, Redshift Automatic Snapshots Enabled, S3 Bucket Encryption is Enabled, S3 Bucket Versioning Enabled
Your Data-5: Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled
Your Surroundings-1: Elastic IP Addresses In Use, No Unused Network Access Control Lists (NACLs), VPC Flow Logs Enabled
Your Surroundings-2: MFA for Root Account is Enabled, Hardware MFA for Root Account is Enabled, MFA for Users with Console Access
Your Surroundings-3: Ensure Load Balancers Use ACM Certificates, No Access Keys for Root Account, No Inline IAM Policies Attached, No IAM Principals with Full Administrator Permissions ":"
Your Surroundings-4: IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater)
Your Systems-1: EBS Volume In Use, EC2 Instances Managed by Systems Manager (SSM), EC2 Instances Compliant with SSM Patching Requirements, No EC2 Instances Stopped for More Than 30 Days, Elastic IP Addresses In Use, No Unused Network Access Control Lists (NACLs), EC2 Instance Compliant SSM Association Status
Your Systems-2: EC2 Instances Compliant with SSM Patching Requirements, RDS Auto Minor Version Upgrade Enabled, AWS Redshift Should Have Required Maintenance Settings
Your Systems-3: API Gateway domain names should use TLS 1.2 security policies, Application Load Balancer HTTP to HTTPS Redirect Enabled, API Gateway Stage Protected by AWS WAF, RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EC2 instances Covered by AWS Backup, EFS Covered by AWS Backup, FSx File Systems Covered by AWS Backup, Backup Recovery Points are Encrypted, Backup Vault Recovery Point Manual Deletion is Disabled, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, Ensure CloudTrail is Enabled for this Region, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, CloudWatch Log Group Encryption Enabled, CodeBuild Environment Variables Do No Contain Secrets, CodeBuild Project Source Repository URL Credential Check, Database Migration Service Instance Not Public, DynamoDB Encryption with KMS Enabled, DynamoDB Table Point-in-time Recovery Enabled, DynamoDB Auto Scaling is Enabled, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to RDP (TCP 3389), EC2 Default Encryption is Enabled, EC2 Instance EBS Optimization Enabled, EC2 Instance Volumes are Encrypted, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, ECS Task Definition User Check for Host Mode, EFS Encryption At-Rest Enabled, Application Load Balancers Protected by AWS WAF, Load Balancers Use SSL Certificates, Load Balancers Configured for Cross Zone Load Balancing, Elastic Load Balancers Secure Listeners Only, Load Balancer Access Logging is Enabled., Load Balancers Deletion Protection Enabled, EMR Cluster Instances do not Allow Public Access, Ensure Load Balancers Use ACM Certificates, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Storage Encryption is Enabled, Amazon Elasticsearch Domain is in a VPC, Amazon Elasticsearch Domain Application/Performance Logging Enabled, Amazon GuardDuty is Enabled, No Access Keys for Root Account, MFA for Root Account is Enabled, Hardware MFA for Root Account is Enabled, MFA for Users with Console Access, No IAM Principals with access to blocked actions on KMS, No Inline IAM Policies Attached, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", IAM Access Keys Are Rotated every 90 Days, IAM Policies Attached to Roles or Groups Only, No Unused IAM User Credentials (90 Days), KMS Keys Not Pending Deletion, Ensure that KMS Key Rotation is Enabled, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, RDS Storage Encryption is Enabled, RDS Automatic Backups Enabled, RDS Deletion Protection Enabled, RDS Enhanced Monitoring Enabled, RDS Logging Enabled, RDS Multi Availability Zones Configured, RDS Snapshots are Encrypted At-Rest, No Public Redshift Clusters, Redshift Clusters Encrypted At-Rest, Redshift Automatic Snapshots Enabled, Redshift Clusters Audit Logging Enabled, Redshift Cluster Encryption In-Transit is Enabled, No Public S3 Buckets, S3 Bucket Encryption is Enabled, S3 Bucket Versioning Enabled, S3 Block Public Access is Enabled (Account-Level), S3 Bucket Access Logging Enabled, S3 Bucket Encryption in Transit is Enforced, S3 Default Encryption with KMS Key Check, SageMaker Endpoint Configuration Encrypted At-Rest, SageMaker Notebook Instance Encryption At-Rest Enabled, No Direct Internet Access for SageMaker Notebook Instance, Secrets Manager Secrets Automatic Rotation is Enabled, No Unused Secrets (90 days), AWS Security Hub is Enabled, Default Security Group No Rules, SNS Topic Encryption Enabled, API Gateway Stage Access Logging Enabled, API Gateway Stage Cache Encryption At-Rest is Enabled, API Gateway Stage Logging is Enabled, VPC Route Tables Restrict Public Access to IGW, Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0, WAF WebACL Logging Enabled

The report includes actionable findings and remediation guidance for supported checks.