AWS

CL4

Connects via STS GetCallerIdentity against a 12-digit account ID, defaulting to us-east-1. 20+ Terraform resource categories are covered: VPC, EC2, EKS, ECS, RDS, ElastiCache, DynamoDB, Lambda, IAM, S3, and more, alongside native CloudFormation.

Because the connection check reuses the cached AssumeRole session, a revoked IAM role shows up as a failed refresh the next time the lock renews — not only on the next full connection test.

AssumeRole session credentials are cached across an in-process map and a Redis/Postgres layer, with a SET NX lock to avoid stampeding requests for the same role.
Organizations-wide brownfield discovery calls ListAccounts, then assumes a role into each member account in turn.

Capability maturity

FinOps (cost sync)
Drift detection
Day-2 operations
Brownfield import
AI copilot

A minimal real resource

resource "aws_instance" "web" {
  ami           = "ami-0c94855ba95c71c99"
  instance_type = "t3.medium"
}

Under the hood

backend/src/services/aws/**
backend/src/services/iac/aws/**
backend/src/services/brownfield/aws/**

Ready to try it?

Start for free, no credit card.

Start for free

Kubernetes

Azure