CloudAgent gives you AI agents that manage your cloud infrastructure. They handle tasks like security compliance, cost optimization, deployments, and monitoring. You remain in control as agents show you their plans, wait for your approval, then execute. Think of it as having a cloud operations team that works 24/7 without needing to hire an army of cloud experts.

How can AI agents be trusted with production cloud infrastructure?

You stay in control through approval workflows where every infrastructure change can require human approval before execution, custom security controls with granular access rules, complete audit trails of every action, self-hosted deployment options, and progressive trust models starting with read-only access.

How does it actually reduce costs?

CloudAgent agents delete unused resources, schedule non-production shutdowns, right-size infrastructure based on usage patterns, and recommend architectural optimizations. Early customers report 15-40% cost reduction within 90 days. Unlike dashboards, CloudAgent actually fixes the problems.

1. Assessment Phase

AWS RBI ITF-NBFC Compliance Assessment Execution

20 Credits

AWS RBI ITF-NBFC Compliance Report

Overview

This report evaluates AWS configurations against the automated controls mapped to AWS RBI ITF-NBFC. The assessment covers 16 mapped controls using 119 enabled configuration checks. Framework requirements without automated mappings remain available for manual review. Technical findings support compliance evidence collection and remediation; they do not certify compliance.

Mapped controls

3.1.a Identification and Classification of Information Assets: No Internet-Facing EC2 Instances, EC2 Instances Managed by Systems Manager (SSM), No EC2 Instances Stopped for More Than 30 Days, ECR Private Tag Immutability Enabled Check
3.1.c Role based Access Control: IAM Instance Profile is Attached to EC2 Instance, EFS Access Point Root Directory Enforcement, EFS Access Point User Identity Enforcement Check, EMR Kerberos Authentication Configured, IAM Access Keys Are Rotated every 90 Days, No Empty IAM Groups, No Inline IAM Policies Attached, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", No IAM Principals with all service access or wildcard service access, No Access Keys for Root Account, Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, No Unused IAM User Credentials (90 Days), IAM Policies Attached to Roles or Groups Only, IAM Users in Groups, MFA for Users with Console Access, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule
3.1.g Incident Management: Amazon GuardDuty is Enabled, No Active GuardDuty Findings, AWS Security Hub is Enabled, EC2 Instance Compliant SSM Association Status, Application Load Balancers Protected by AWS WAF
3.1.h Trails: Ensure that CloudTrail Logs are forwarded to CloudWatch, Ensure CloudTrail is Enabled for this Region, Ensure that a Multi-Region CloudTrail Trail is Configured, S3 Object-Level Logging with CloudTrail is Enabled for Read Events, S3 Object-Level Logging with CloudTrail is Enabled for Write Events, CloudWatch Log Groups Retention Policy Configured, CodeBuild Project Logging Enabled Check, Load Balancer Access Logging is Enabled., Amazon Elasticsearch Domain Application/Performance Logging Enabled, RDS Logging Enabled, Redshift Clusters Audit Logging Enabled, S3 Bucket Access Logging Enabled, API Gateway Stage Access Logging Enabled, API Gateway Stage Logging is Enabled, VPC Flow Logs Enabled, WAF WebACL Logging Enabled
3.1.i Public Key Infrastructure (PKI): Imported and ACM-issued certificates should be renewed within 30 days of expiration, Application Load Balancers Drop Invalid HTTP Headers is Enabled, Application Load Balancer HTTP to HTTPS Redirect Enabled, Load Balancers Use SSL Certificates, Elastic Load Balancers Secure Listeners Only, Ensure Load Balancers Use ACM Certificates, Elasticsearch Enforces HTTPS for Client Access, Redshift Cluster Encryption In-Transit is Enabled, API Gateway Stage with Client Certificate Configured, S3 Bucket Encryption in Transit is Enforced
3.3 Vulnerability Management: EC2 Instances Managed by Systems Manager (SSM), No Active GuardDuty Findings, RDS Auto Minor Version Upgrade Enabled, AWS Redshift Should Have Required Maintenance Settings, EC2 Instance Compliant SSM Association Status
3.5 Cyber Crisis Management Plan: EC2 Instances Managed by Systems Manager (SSM), Amazon GuardDuty is Enabled, No Active GuardDuty Findings, EC2 Instance Compliant SSM Association Status
4.4.g Fraud analysis: Amazon GuardDuty is Enabled
4.4.h Capacity and performance analysis: Load Balancers Deletion Protection Enabled, Auto Scaling Groups Use ELB Health Checks, Elastic Beanstalk Enhanced Health Reporting Enabled, DynamoDB Auto Scaling is Enabled, EC2 Detailed Monitoring Enabled, EC2 Instance EBS Optimization Enabled, Classic Load Balancer Spans Multiple Availability Zones, Load Balancers Configured for Cross Zone Load Balancing, ELBv2 Multiple Availability Zones Check, Amazon GuardDuty is Enabled, Lambda Dead-Letter Queue Configured, Lambda Functions Concurrent Execution Limit Configured, Lambda Multi-AZ Availability Check, RDS Deletion Protection Enabled, RDS Enhanced Monitoring Enabled, RDS Multi Availability Zones Configured, S3 Bucket Object Lock is Enabled, AWS Security Hub is Enabled, Backup VPN Connection Configured
4.4.i Incident reporting: Amazon GuardDuty is Enabled, No Active GuardDuty Findings
6.3 Backup and Recovery: RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EC2 instances Covered by AWS Backup, EFS Covered by AWS Backup, Backup Plans Minimum Retention Configured (35 days), Backup Recovery Points Do Not Expire Before Retention Period, DynamoDB Auto Scaling is Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, FSx File Systems Covered by AWS Backup, Ensure that KMS Key Rotation is Enabled, RDS DB instances backup retention period should be greater than or equal to 7, Redshift Automatic Snapshots Enabled, S3 Bucket Cross-Region Replication
8.1 IT Systems: Load Balancers Deletion Protection Enabled, Auto Scaling Groups Use ELB Health Checks, DynamoDB Auto Scaling is Enabled, EC2 Detailed Monitoring Enabled, Classic Load Balancer Spans Multiple Availability Zones, Load Balancers Configured for Cross Zone Load Balancing, ELBv2 Multiple Availability Zones Check, Amazon GuardDuty is Enabled, Lambda Functions Concurrent Execution Limit Configured, Lambda Multi-AZ Availability Check, RDS Deletion Protection Enabled, RDS Enhanced Monitoring Enabled, RDS Multi Availability Zones Configured, AWS Security Hub is Enabled, Backup VPN Connection Configured
8.I Basic Security Aspects: Auto Scaling Launch Configuration Instances Do Not Assign Public IPs, Database Migration Service Instance Not Public, EBS Snapshots Should Not Be Publicly Restorable, EBS Volume In Use, IAM Instance Profile is Attached to EC2 Instance, EC2 Instances in a VPC (No Classic EC2), EC2 Launch Templates Do Not Assign Public IPs, EFS Access Point Root Directory Enforcement, EFS Access Point User Identity Enforcement Check, EMR Kerberos Authentication Configured, EMR Cluster Instances do not Allow Public Access, Amazon Elasticsearch Domain is in a VPC, IAM Access Keys Are Rotated every 90 Days, No Empty IAM Groups, No Inline IAM Policies Attached, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", No IAM Principals with all service access or wildcard service access, No Access Keys for Root Account, Hardware MFA for Root Account is Enabled, MFA for Root Account is Enabled, No Unused IAM User Credentials (90 Days), IAM Policies Attached to Roles or Groups Only, IAM Users in Groups, MFA for Users with Console Access, VPC Does Not Enable Direct Internet Connectivity (No Attached IGWs), Lambda functions should be in a VPC., No Public Accessible Lambda Functions, RDS Cluster/Instance Security Group Does Not Allow 0.0.0.0/0 and ::/0, No Public RDS Snapshots, No Public Redshift Clusters, S3 Bucket ACL Prohibited, S3 Bucket Block Public Access Is Enabled, No Public S3 Buckets, No Direct Internet Access for SageMaker Notebook Instance, Secrets Manager Secrets Automatic Rotation is Enabled, Secrets Manager Secrets Are Rotated Per Schedule, Default Security Group No Rules, No Security Group Rules Allowing 0.0.0.0/0 and ::/0 to SSH (TCP 22), No Public SSM documents (customer owned), Vpc security group restrict ingress common ports all, VPC Security Groups Should Restrict Ingress TCP And UDP Access From 0.0.0.0/0
8.II User Role: No Empty IAM Groups, No Inline IAM Policies Attached, IAM Password Policy Expires Passwords within 90 Days or less, IAM Password Policy Requires Uppercase Characaters, IAM Password Policy Requires Lowercase Characaters, IAM Password Policy Requires Symbols, IAM Password Policy Requires Numbers, IAM Password Policy Requires Minimum Length of 14 Characters, IAM Password Policy Configured to Prevent Password Reuse (24 or Greater), No IAM Principals with Full Administrator Permissions ":", No Unused IAM User Credentials (90 Days), IAM Policies Attached to Roles or Groups Only, IAM Users in Groups
8.III Maker-Checker Concept: S3 Bucket Versioning Enabled
8.IX Backup and Recovery: RDS and Aurora Covered by AWS Backup, DynamoDB Tables Covered by AWS Backup, EBS Volumes Covered by AWS Backup, EFS Covered by AWS Backup, Backup Plans Minimum Retention Configured (35 days), Backup Vault Recovery Point Manual Deletion is Disabled, Backup Recovery Points Do Not Expire Before Retention Period, DynamoDB Table Point-in-time Recovery Enabled, ElastiCache (Redis) Automatic Backups are Enabled, ElastiCache (Redis) Snapshot Retention Period 7 days or More, RDS DB instances backup retention period should be greater than or equal to 7, Redshift Automatic Snapshots Enabled, S3 Bucket Cross-Region Replication

The report includes actionable findings and remediation guidance for supported checks.