CloudAgent gives you AI agents that manage your cloud infrastructure. They handle tasks like security compliance, cost optimization, deployments, and monitoring. You remain in control as agents show you their plans, wait for your approval, then execute. Think of it as having a cloud operations team that works 24/7 without needing to hire an army of cloud experts.

How can AI agents be trusted with production cloud infrastructure?

You stay in control through approval workflows where every infrastructure change can require human approval before execution, custom security controls with granular access rules, complete audit trails of every action, self-hosted deployment options, and progressive trust models starting with read-only access.

How does it actually reduce costs?

CloudAgent agents delete unused resources, schedule non-production shutdowns, right-size infrastructure based on usage patterns, and recommend architectural optimizations. Early customers report 15-40% cost reduction within 90 days. Unlike dashboards, CloudAgent actually fixes the problems.

1. Assessment Phase

AWS NYDFS 23 NYCRR 500 Compliance Assessment Execution

20 Credits

AWS NYDFS 23 NYCRR 500 Compliance Report

Overview

This report evaluates AWS configurations against the automated controls mapped to AWS NYDFS 23 NYCRR 500. The assessment covers 11 mapped controls using 126 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.

Mapped controls

500.02(a): Imported and ACM-issued certificates should be renewed within 30 days of expiration, Load Balancers Deletion Protection Enabled, Application Load Balancers Drop Invalid HTTP Headers is Enabled, Application Load Balancer HTTP to HTTPS Redirect Enabled, Auto Scaling Groups Use ELB Health Checks, Auto Scaling Launch Configuration Instances Do Not Assign Public IPs, Backup Recovery Points are Encrypted, Elastic Beanstalk Enhanced Health Reporting Enabled, Ensure that CloudTrail logs are encrypted using KMS, Ensure that CloudTrail Log File Validation is Enabled, CloudWatch Log Group Encryption Enabled, AWS CodeBuild Project Artifact Encryption Check, DynamoDB Encryption with KMS Enabled, DynamoDB Auto Scaling is Enabled, EC2 Default Encryption is Enabled, EBS Volume is Encrypted, EC2 Detailed Monitoring Enabled, EC2 Instance Volumes are Encrypted, EFS Encryption At-Rest Enabled, Load Balancers Use SSL Certificates, Load Balancers Configured for Cross Zone Load Balancing, Elastic Load Balancers Secure Listeners Only, Ensure Load Balancers Use ACM Certificates, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Storage Encryption is Enabled, Kinesis Data Stream Server Side Encryption Enabled, RDS Storage Encryption is Enabled, RDS Deletion Protection Enabled, RDS Snapshots are Encrypted At-Rest, RDS Multi Availability Zones Configured, Redshift Cluster Encryption In-Transit is Enabled, Redshift Clusters Audit Logging Enabled, API Gateway Stage with Client Certificate Configured, S3 Block Public Access is Enabled (Account-Level), S3 Bucket Encryption is Enabled, S3 Bucket Object Lock is Enabled, S3 Bucket Encryption in Transit is Enforced, S3 Default Encryption with KMS Key Check, SageMaker Endpoint Configuration Encrypted At-Rest, SageMaker Notebook Instance Encryption At-Rest Enabled, SNS Topic Encryption Enabled, No Public SSM documents (customer owned), API Gateway Stage Cache Encryption At-Rest is Enabled, Backup VPN Connection Configured
500.02(b)(2): Database Migration Service Instance Not Public, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, EC2 Instance Metadata Service v2 Enforced, EC2 Instances in a VPC (No Classic EC2), EMR Kerberos Authentication Configured, EMR Cluster Instances do not Allow Public Access, Amazon Elasticsearch Domain is in a VPC, No Empty IAM Groups, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", No Access Keys for Root Account, Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, IAM Policies Attached to Roles or Groups Only, IAM Users in Groups, MFA for Users with Console Access, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, No Public RDS Snapshots, No Public Redshift Clusters, API Gateway Stage Protected by AWS WAF, S3 Block Public Access is Enabled (Account-Level), No Public S3 Buckets, No Direct Internet Access for SageMaker Notebook Instance, Default Security Group No Rules, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Public SSM documents (customer owned), VPC Route Tables Restrict Public Access to IGW, Vpc security group restrict ingress common ports all, Application Load Balancers Protected by AWS WAF
500.02(b)(3): Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, CodeBuild Project Logging Enabled Check, EC2 Detailed Monitoring Enabled, Load Balancer Access Logging is Enabled., Elasticsearch Audit Logging is Enabled, Amazon Elasticsearch Domain Application/Performance Logging Enabled, Amazon GuardDuty is Enabled, RDS Enhanced Monitoring Enabled, RDS Logging Enabled, Redshift Clusters Audit Logging Enabled, S3 Bucket Access Logging Enabled, AWS Security Hub is Enabled, EC2 Instance Compliant SSM Association Status, API Gateway Stage Access Logging Enabled, API Gateway Stage Logging is Enabled, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
500.02(b)(5): RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EFS Covered by AWS Backup, Backup Plans Minimum Retention Configured (35 days), Backup Vault Recovery Point Manual Deletion is Disabled, DynamoDB Table Point-in-time Recovery Enabled, EC2 Instance EBS Optimization Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, RDS DB instances backup retention period should be greater than or equal to 7, Redshift Automatic Snapshots Enabled, S3 Bucket Versioning Enabled, S3 Bucket Cross-Region Replication
500.06(a): Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure CloudTrail is Enabled for this Region, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, CloudWatch Log Groups Retention Policy Configured, CodeBuild Project Logging Enabled Check, Load Balancer Access Logging is Enabled., Elasticsearch Audit Logging is Enabled, Amazon Elasticsearch Domain Application/Performance Logging Enabled, RDS Logging Enabled, Redshift Clusters Audit Logging Enabled, S3 Bucket Access Logging Enabled, API Gateway Stage Access Logging Enabled, API Gateway Stage Logging is Enabled, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
500.06(b): CloudWatch Log Groups Retention Policy Configured
500.07 Access Privileges and Management: Database Migration Service Instance Not Public, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, ECS Task Definition User Check for Host Mode, EMR Kerberos Authentication Configured, EMR Cluster Instances do not Allow Public Access, Amazon Elasticsearch Domain is in a VPC, IAM Access Keys Are Rotated every 90 Days, No Empty IAM Groups, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", No Access Keys for Root Account, No Unused IAM User Credentials (90 Days), IAM Policies Attached to Roles or Groups Only, IAM Users in Groups, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, No Public RDS Snapshots, No Public Redshift Clusters, S3 Block Public Access is Enabled (Account-Level), No Public S3 Buckets, No Direct Internet Access for SageMaker Notebook Instance, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, No Public SSM documents (customer owned), VPC Route Tables Restrict Public Access to IGW
500.08(a): CodeBuild Environment Variables Do No Contain Secrets, CodeBuild GitHub or Bitbucket Use OAuth
500.12 Multi-factor Authentication: No Access Keys for Root Account, Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, MFA for Users with Console Access
500.14(a): Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure CloudTrail is Enabled for this Region, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, CloudWatch Alarm Action is Configured, CloudWatch Log Groups Retention Policy Configured, CodeBuild Project Logging Enabled Check, Load Balancer Access Logging is Enabled., Elasticsearch Audit Logging is Enabled, Amazon Elasticsearch Domain Application/Performance Logging Enabled, Amazon GuardDuty is Enabled, RDS Logging Enabled, Redshift Clusters Audit Logging Enabled, S3 Bucket Access Logging Enabled, AWS Security Hub is Enabled, API Gateway Stage Access Logging Enabled, API Gateway Stage Logging is Enabled, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
500.15(a): Imported and ACM-issued certificates should be renewed within 30 days of expiration, Application Load Balancers Drop Invalid HTTP Headers is Enabled, Application Load Balancer HTTP to HTTPS Redirect Enabled, Backup Recovery Points are Encrypted, Ensure that CloudTrail logs are encrypted using KMS, CloudWatch Log Group Encryption Enabled, AWS CodeBuild Project Artifact Encryption Check, DynamoDB Encryption with KMS Enabled, EC2 Default Encryption is Enabled, EBS Volume is Encrypted, EC2 Instance Volumes are Encrypted, EFS Encryption At-Rest Enabled, Elastic Load Balancers Secure Listeners Only, Ensure Load Balancers Use ACM Certificates, Elasticsearch Node-to-Node Encryption is Enabled, Elasticsearch Storage Encryption is Enabled, Kinesis Data Stream Server Side Encryption Enabled, RDS Storage Encryption is Enabled, RDS Snapshots are Encrypted At-Rest, Redshift Cluster Encryption In-Transit is Enabled, Redshift Clusters Audit Logging Enabled, Redshift Clusters Encrypted At-Rest, API Gateway Stage with Client Certificate Configured, S3 Bucket Encryption is Enabled, S3 Bucket Encryption in Transit is Enforced, S3 Default Encryption with KMS Key Check, SageMaker Endpoint Configuration Encrypted At-Rest, SageMaker Notebook Instance Encryption At-Rest Enabled, Secrets Manager Secrets Use Custom KMS Key, SNS Topic Encryption Enabled, API Gateway Stage Cache Encryption At-Rest is Enabled

The report includes actionable findings and remediation guidance for supported checks.