On AWS Marketplace · Runs in your account
Landing zone as code. Access as a tree. Cost on the first screen.
CloudScry runs AWS foundations for teams without a platform team. It works with AWS Control Tower, or without it. You keep the write access.
On AWS Marketplace. Runs in your own AWS account. Links go live when the Marketplace listing and the public repository are published.
- About 30 minutes from subscribe to first numbers (estimated)
- Your data never reaches us. It stays on one EC2 instance in your account.
- Writes go only through open-source code you deploy. CloudScry holds no write credentials.
Workloads / Prod
- pay-prodPayments · operate$4,210
- data-prodData · operate$2,980
Workloads / NonProd
- pay-devPayments · develop$640
Sandbox
- sbx-jinJin · admin, 3 days left$38
From clicking to reviewing
Most of the work doesn't go away. It turns into something you check and approve instead of something you click through.
| What you do today | With CloudScry |
|---|---|
| New account: OU, logging, security services, budget, tags, roles | Name, OU and owner in a wizard. The baseline comes with it.Half a day → about 5 minutes (estimated) |
| Access request: Slack DM, console clicks, forgetting to revoke | Request, approve, expire in one flow, with a recordNo standing Prod admins |
| Offboarding | One button, or we notice the IdP deactivation. You get a list of leftover keys and resources to hand over.Nobody gets missed |
| Quarterly access review | Campaign → managers keep or revoke → signed reportA day → about an hour (estimated) |
| Changing an SCP | See which of the last 90 days of calls would be denied, before you applyYou can touch policies again |
| Splitting cost by team | Automatic Slack showback at the start of each monthNo spreadsheet |
| Baseline drift | Daily drift report with a fix PRYou find out instead of guessing |
| “Who got Prod access last week?” | Ask in the AI tool you already useOne question instead of a CloudTrail search |
Targets, not measurements yet. We’ll replace them with design-partner numbers before launch.
Ask from the tools you already use
CloudScry has a built-in MCP server. Connect Claude, ChatGPT, Cursor, Visual Studio Code, Kiro or Gemini CLI and ask about your AWS foundations in plain language. Answers come with the evidence behind them.
- Read, explain, draft. The AI can look things up and write a draft access request or fix PR. It cannot approve anything or call a broker.
- You choose the AI vendor. Results go only to the AI tool you connect. Nothing passes through us.
- Every call is logged. Who asked, which tool, what came back. One switch disconnects every AI tool and revokes all tokens.
AI finds it, a person approves, your broker applies it.
Estimated savings (example)
/ month
Example data.
Ten modules, one data layer
Every module shares the same collector, starts at L0 on day one, and ends in a number or a fix.
Foundation · Accounts, people, permissions and guardrails
“Is every account on the baseline, and what breaks if we move this one?”
- Reads
- Organizations, CloudFormation StackSets, Config, GuardDuty and Security Hub status
- You get
- Account blueprints (S, M, L), a baseline heatmap, drift repair PRs, move impact
“Who can do what, in which account? Can a new hire be set up in five minutes?”
- Reads
- Organizations, IAM Identity Center, your IdP sync status, CloudTrail
- You get
- One tree from OU to person, a team × environment matrix, time-limited access, offboarding, access reviews
“If we apply this SCP or RCP, who loses access to what?”
- Reads
- Organizations policies, IAM, the last 90 days of CloudTrail
- You get
- Affected roles and actions, a safer draft, a change log with reasons, SOC 2 and ISO 27001 evidence
Cost · The first screen is money
“Which team spent what, and which account will go over budget?”
- Reads
- Cost Explorer, CUR via Athena, Budgets, tags
- You get
- Monthly team showback, budget and tag fixes as PRs, shared cost allocation
“Which traffic is driving our NAT, Transit Gateway and cross-AZ charges?”
- Reads
- VPC Flow Logs, CUR, route tables
- You get
- Cost by network path, endpoint and routing changes with estimated savings
“Where can we cut CloudWatch Logs cost?”
- Reads
- CloudWatch Logs usage, CUR
- You get
- Cost per log group, retention and log class changes as PRs
“Which traffic doesn't need to cross the firewall, and what will this rule change block?”
- Reads
- Network Firewall logs and rule groups, VPC Flow Logs, CUR
- You get
- Savings items, rule change impact, a Terraform change
Operations · Debugging, hygiene and alerts
“Why can't A reach B?”
- Reads
- Security groups, NACLs, routes, Transit Gateway and firewall config
- You get
- The blocking point with a fix, who changed it and when, an account map
“What is about to hit end of support, expire or run out of quota?”
- Reads
- RDS, EKS and Lambda versions, AWS Backup, ACM, KMS, Service Quotas
- You get
- An end-of-support calendar, extra cost estimates, backup and expiry warnings
“Which security findings actually need attention today?”
- Reads
- Security Hub and GuardDuty findings
- You get
- Duplicates grouped, priorities, owners and fix PRs
You decide what we're allowed to write
All ten modules work from day one at L0. CloudScry's role can't change your infrastructure. Its only non-read permissions are listed in the exceptions table. If you want CloudScry to make changes, you raise the level yourself, one step at a time.
- L3
Delegated apply
Brokers apply to a canary OU, wait 24 hours, then roll out. Simulation, automatic rollback, kill switch.
If it goes wrong: Limited to the canary OU
Recommended after 30 days on L2, explicit opt-in
- L2
Writes as code
Landing zone and guardrails as StackSets or Terraform. You apply them.
If it goes wrong: Nothing gets applied
Connect a repository
- L1
Narrow writes
Identity Center assignments (only sets you created), budgets, tags, Security Hub finding status, scheduled expiry.
If it goes wrong: Someone keeps an existing set a bit longer
Deploy the assignment, budget and tag brokers
- L0
Read
No infrastructure changes. Insights and PRs only.
If it goes wrong: Nothing
On at install
What CloudScry can’t do
Enforced by permission boundaries, not by policy documents. The IAM policies and broker source are public, so you can check.
- Hold write credentials or call infrastructure-changing APIs directly
- Do anything outside your allow list, or apply anything without approval
- Create or edit permission sets, or issue IAM users and access keys
- Approve, call a broker or change settings through the AI connector
- Send your data to us
- Update itself outside the update policy you set
What CloudScry doesn’t do
We’d rather tell you now than after the trial.
- Incident response, CI/CD, Kubernetes operations and monitoring stay with your team. CloudScry covers foundations: accounts, people, permissions, guardrails, cost allocation and hygiene.
- Without AWS Organizations and IAM Identity Center you get about half the product. We'll show you how to set them up, or work at the IAM level.
- At L0 it is a dashboard with PRs. The time savings start at L1.
- Writes for foundation modules need one extra stack in your management account. We say so in the wizard.
- We don't have our own SOC 2 report yet. We're a one-person company. You get the source, a reproducible build, an SBOM and a pen test report instead.
The exceptions table ships with the security review pack and will be linked here before launch.
A landing zone you don't have to design
Pick a blueprint size and CloudScry lays out a reduced version of the OU structure AWS recommends. New accounts land in the right place with the baseline already applied.
Organizational units
- Securitylog-archive, security-tooling
- Infrastructurenetwork, platform
- Workloads / Prodone account per service
- Workloads / NonProddev and staging
- Sandboxpersonal, budget-capped, auto-expiring
- Suspendedisolated before closing
- Transitionalexisting accounts, before they move
Sizes (suggested): S up to about 15 accounts · M about 50 · L about 200
Baseline on every account: organization CloudTrail, Config, GuardDuty and Security Hub membership, Access Analyzer, S3 public access block, default EBS encryption, budget alarm, required tags.
Existing accounts move through Transitional. Before each move you see which calls the new OU’s SCPs would block.
Already on Control Tower? CloudScry connects to it for drift, evidence and access instead of replacing it.
Based on the AWS whitepaper “Organizing your AWS environment” (April 2025 edition).
Priced so you don't need a purchase order
It's billed on your AWS invoice. No vendor onboarding, no contract, no card. Stop the instance and the software fee stops too.
Software
$0.136 per hour
About $99 a month for one instance running all month (estimated)
Links go live when the Marketplace listing and the public repository are published.
- Annual
- $990 per year
- Free trial
- 14 days on one instance, software fee waived. AWS infrastructure charges still apply. The trial turns into a paid subscription when it ends; AWS emails you three days before.
- Included
- Unlimited accounts and users. AI connector included. No add-ons. English UI by default; Korean UI available in settings.
- Your AWS infrastructure
- From about $18 a month: t4g.small, 20 GB gp3, one public IPv4 (estimated)
Install in about 30 minutes (estimated)
- 01Launch the AMI from AWS Marketplace. Graviton or x86, same price.
- 02Open https://<instance-ip> and sign in with the one-time token from the system log.
- 03Attach the CloudScry role. The wizard gives you the policy JSON. Every non-read permission in it is in the exceptions table.
- 04Pick the modules you want, run the checks, see your first numbers.
Source. The core code, IAM policies and action brokers are in a public repository. AMI builds are reproducible from a public commit. Images are signed and ship with an SBOM.
How CloudScry fits with what you already use
Most teams already use some of these. CloudScry is built to sit next to them.
AWS Control Tower
Keep it if you run it. CloudScry connects for drift, evidence and access.
AWS TEAM
Time-bound access only, or the whole access lifecycle.
Vanta / Drata
They run the company-wide program. CloudScry goes deeper on AWS evidence.
AWS Cost Explorer
CloudScry reads it, then adds teams and network causes.
Comparisons use each vendor’s public documentation, with the date we checked it. If something is out of date, tell us and we’ll fix it.