CloudAgent gives you AI agents that manage your cloud infrastructure. They handle tasks like security compliance, cost optimization, deployments, and monitoring. You remain in control as agents show you their plans, wait for your approval, then execute. Think of it as having a cloud operations team that works 24/7 without needing to hire an army of cloud experts.

How can AI agents be trusted with production cloud infrastructure?

You stay in control through approval workflows where every infrastructure change can require human approval before execution, custom security controls with granular access rules, complete audit trails of every action, self-hosted deployment options, and progressive trust models starting with read-only access.

How does it actually reduce costs?

CloudAgent agents delete unused resources, schedule non-production shutdowns, right-size infrastructure based on usage patterns, and recommend architectural optimizations. Early customers report 15-40% cost reduction within 90 days. Unlike dashboards, CloudAgent actually fixes the problems.

1. Assessment Phase

AWS NIST SP 800-172 Compliance Assessment Execution

20 Credits

AWS NIST SP 800-172 Compliance Report

Overview

This report evaluates AWS configurations against the automated controls mapped to AWS NIST SP 800-172. The assessment covers 11 mapped controls using 63 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.

Mapped controls

3.1.3e Employ [Assignment: organization-defined secure information transfer solutions] to control information flows between security domains on connected systems: Application Load Balancers Drop Invalid HTTP Headers is Enabled, Application Load Balancer HTTP to HTTPS Redirect Enabled, Auto Scaling Launch Configuration Instances Do Not Assign Public IPs, Database Migration Service Instance Not Public, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, Load Balancers Use SSL Certificates, Classic Load Balancer Desync Mode Configuration Check, Elastic Load Balancers Secure Listeners Only, ALB Desync Mitigation Mode Compliance Check, EMR Cluster Instances do not Allow Public Access, Ensure Load Balancers Use ACM Certificates, Elasticsearch Node-to-Node Encryption is Enabled, Amazon Elasticsearch Domain is in a VPC, Elasticsearch Enforces HTTPS for Client Access, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, No Public RDS Snapshots, Redshift Cluster Encryption In-Transit is Enabled, Redshift Clusters Use Enhanced VPC Routing, No Public Redshift Clusters, API Gateway Stage with Client Certificate Configured, S3 Block Public Access is Enabled (Account-Level), S3 Bucket Block Public Access Is Enabled, No Public S3 Buckets, S3 Bucket Encryption in Transit is Enforced, No Direct Internet Access for SageMaker Notebook Instance, Default Security Group No Rules, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Public SSM documents (customer owned), No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0), VPC Route Tables Restrict Public Access to IGW, Vpc security group restrict ingress common ports all
3.4.2e Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, [Selection (one or more): remove the components; place the components in a quarantine or remediation network] to facilitate patching, re-configuration, or other mitigations: RDS Auto Minor Version Upgrade Enabled, AWS Redshift Should Have Required Maintenance Settings, EC2 Instance Compliant SSM Association Status
3.4.3e Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components: No Internet-Facing EC2 Instances, Elastic IP Addresses In Use, EC2 Instances Managed by Systems Manager (SSM), No EC2 Instances Stopped for More Than 30 Days, No Unused Network Access Control Lists (NACLs)
3.5.2e Employ automated mechanisms for the generation, protection, rotation, and management of passwords for systems and system components that do not support multifactor authentication or complex account management: IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule
3.11.1e Employ [Assignment: organization-defined sources of threat intelligence] as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities : Amazon GuardDuty is Enabled
3.11.2e Conduct cyber threat hunting activities [Selection (one or more): [Assignment: organizationdefined frequency]; [Assignment: organization-defined event]] to search for indicators of compromise in [Assignment: organization-defined systems] and detect, track, and disrupt threats that evade existing controls: Amazon GuardDuty is Enabled
3.13.4e Employ [Selection: (one or more): [Assignment: organization-defined physical isolation techniques]; [Assignment: organization-defined logical isolation techniques]] in organizational systems and system components: Auto Scaling Launch Configuration Instances Do Not Assign Public IPs, Database Migration Service Instance Not Public, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, EMR Cluster Instances do not Allow Public Access, Amazon Elasticsearch Domain is in a VPC, Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, No Public RDS Snapshots, Redshift Clusters Use Enhanced VPC Routing, No Public Redshift Clusters, S3 Block Public Access is Enabled (Account-Level), S3 Bucket Block Public Access Is Enabled, No Public S3 Buckets, No Direct Internet Access for SageMaker Notebook Instance, Default Security Group No Rules, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Public SSM documents (customer owned), No Network ACLs Allow Access to Remote Admin Ports (22,3389) from Any Source (0.0.0.0/0), VPC Route Tables Restrict Public Access to IGW, Vpc security group restrict ingress common ports all
3.14.1e Verify the integrity of [Assignment: organization-defined security critical or essential software] using root of trust mechanisms or cryptographic signatures: Ensure that CloudTrail Log File Validation is Enabled
3.14.2e Monitor organizational systems and system components on an ongoing basis for anomalous or suspicious behavior: Ensure that CloudTrail Logs are forwarded to CloudWatch, CloudWatch Alarm Action is Configured, EC2 Detailed Monitoring Enabled, Amazon GuardDuty is Enabled, RDS Enhanced Monitoring Enabled, AWS Security Hub is Enabled, VPC Flow Logs Enabled
3.14.6e Use threat indicator information and effective mitigations obtained from [Assignment: organization-defined external organizations] to guide and inform intrusion detection and threat hunting: Amazon GuardDuty is Enabled
3.14.7e Verify the correctness of [Assignment: organization-defined security critical or essential software, firmware, and hardware components] using [Assignment: organization-defined verification methods or techniques].: EC2 Instances Managed by Systems Manager (SSM), Image Scan on Push is Enabled, ECS Fargate Services Latest Platform Version Check, EC2 Instance Compliant SSM Association Status

The report includes actionable findings and remediation guidance for supported checks.