Indeni Cloudrail

Expand All Collapse All

Why do we need a security analysis tool for our cloud environment?

Managing security evaluations of infrastructure-as-code (IaC) files becomes increasingly difficult as a company grows. Many organizations only have a few engineers with cloud security expertise, and they could have tens of thousands of objects running in production at one time. There may be multiple projects happening at the same time, using the same set of Terraform files, or using separate sets of files targeting the same cloud environment and influencing each other. Reviewing all these files manually is time-consuming and can slow down delivery times. And if something is missed, the consequences can be costly. Research commissioned by IBM revealed the average cost of a data breach in 2020 was nearly $4 million.

What is context and how is Cloudrail different from other infrastructure-as-code security solutions?

While there are other solutions that work in conjunction with your infrastructure automation tools to identify security issues early in the development cycle, they are mostly reactive and limited in scope. They only analyze files in the “build state” and are unable to see how issues will affect existing cloud environments. This allows many security issues to go undetected. These solutions also lack an understanding of the relationships between resources, which leads to many false positives. Cloudrail analyzes infrastructure-as-code files together with the cloud environments they are targeting. Because it is capable of executing complicated rules and understanding the relationships between resources (their “context”), it proactively identifies the most critical issues without excess “noise.”

How does Cloudrail maintain context?

Cloudrail maintains a graph database that tracks resource relations within the context of the network, compute, storage and IAM space. This allows it to see how one cloud resource has access to another. It can answer simple, yet convoluted questions, such as determining what makes any resource exposed to the public before the customer deploys a project in a particular configuration.

Indeni’s team of cloud security experts regularly update the context engine to analyze additional risk patterns.

How is Cloudrail different from Application Security Testing (AST)?

Application security testing (AST) is the process of making applications more resistant to security threats, by identifying security weaknesses and vulnerabilities in application source code. AST is security testing for application code, think of Cloudrail as security testing for infrastructure-as-code. IaC security testing is the process of making your infrastructure secure by identifying security violations before the infrastructure is deployed.

How much does Cloudrail cost?

Under our Flex plan, each evaluation is $4 after your first 30. Our Standard plan includes 6,000 evaluations per year, starting at $19,800 for 12 months ($3.3 per evaluation) . Our Enterprise plan includes 12,000 evaluations per year, starting at $60,000 for 12 months ($5 per evaluation). Once you have exceeded the maximum number of evaluations for your plan, you will be billed per evaluation.

An SRE team of a mid-market organization (revenue between $50-100M) supports multiple projects. The average # of evaluations is 325 per month. Under the Flex plan, that’s $1300 per month.

How do I get started with Cloudrail?

There are several ways to try Cloudrail. First, you can see how Cloudrail works before you apply it to your own files. Simply go to https://web.cloudrail.app/signup to see it in action.

When you’re ready to try it for yourself, go to the AWS Marketplace and try it for free with no obligation under the Flex plan. This gives you 30 free evaluations with no minimum commitment.

How does Cloudrail benefit my application security process?

Cloudrail provides guardrails to your developers early in the development cycle so they can stay agile without inadvertently compromising security. Cloudrail can detect a misconfiguration or policy violation in an automated fashion. It can be integrated into your CI/CD pipeline to prevent security issues from making into your cloud environment or alert your developer to the issue that needs remediation actions before it is too late. The security shift left approach is good for reducing not only cyber risk but also cost.

How does Cloudrail run evaluations?

Running evaluations with Cloudrail is simple and straightforward. Type “cloudrail run”, pass a Terraform plan file to the CLI, and let it know where your directory is located.

Cloudrail will list the violations it finds, with a detailed explantation of how it concluded these violations exist. You can run Cloudrail locally in your machine or you can integrate Cloudrail with your CI/CD process (a container is provided).

How do I know how many Cloudrail evaluations our company needs?

Retrieve the number of pull requests incorporating Terraform files. Your DevOps Engineers should be able to provide this information from your source code repository systems (Github, Bitbucket, etc.).

How does Cloudrail gain access to my cloud environment? What privilege does it require?

You will need to create an IAM role in your account in order for Cloudrail to be able to use STS assume role to get temporary read access to your account. We require view only and security audit access. For more information, visit this page.

Why do I need to add my cloud account to Cloudrail?

Unlike other tools, we perform context-aware analysis to understand the relationships among resources in your live environment. This is key to eliminating false positives and finding potential exposures caused by resources already in the cloud environment (not referenced by the plan).

Why does Cloudrail need the Terraform plan file?

The container we provide takes the plan file and reduces it to the minimum amount of information needed by Cloudrail to conduct our context-based analysis. The reduced content does not include passwords, certificates, and other sensitive items.

You can review the reduced content before it is uploaded to the Cloudrail Service for analysis.

How will you protect my data?

Cloudrail is SOC2 certified. We follow the criteria for managing your data based on three “trust service principles” – security, availability and confidentiality.

Can I run Cloudrail in my cloud environment?

Not yet. Cloudrail is currently offered as a SaaS. In future releases, we will be adding support for running Cloudrail in your local environment.

Subscribe to the Blog

Get articles sent directly to your inbox.

Automate security reviews of infrastructure-as-code, so you can build your cloud fast and securely with 3x less noise than comparable tools.

Schedule a Cloudrail Demo

What is Cloudrail?

How does Cloudrail work?

Why do we need a security analysis tool for our cloud environment?

What is context and how is Cloudrail different from other infrastructure-as-code security solutions?

How does Cloudrail maintain context?

How is Cloudrail different from Application Security Testing (AST)?

How much does Cloudrail cost?

How do I get started with Cloudrail?

How does Cloudrail benefit my application security process?

How does Cloudrail run evaluations?

How do I know how many Cloudrail evaluations our company needs?

How does Cloudrail gain access to my cloud environment? What privilege does it require?

Why do I need to add my cloud account to Cloudrail?

Why does Cloudrail need the Terraform plan file?

How will you protect my data?

Can I run Cloudrail in my cloud environment?

Get started by signing up for Cloudrail

Let us show you

How Cloudrail Helps You

Achieve agility while staying secure.

Improve effectiveness of your security teams.

Reduce the costs of ensuring a secure cloud infrastructure.

Cloudrail for Every Team

Flex

Standard

Enterprise

Compare Offerings

Pricing Details

Base cost of contract

Evaluations included

Cost per additional evaluation

Billing cycle

Number of users

Capabilities

Data Retention

Pre-built context-aware, low noise, security rules

Stiching of TF plans with cloud accounts

Billing cycle

Number of users

Support for TF modules and variables

Unlimited custom policies

CI/CD integrations (Jenkins, CircleCI, etc.)

Dashboarding / Reporting

Single Sign-On

Custom-developed context-aware rules

Custom dashboard /reports

Pre-built Integrations (JIRA, Slack, etc.)

RBAC

Support

Chat & email support

Enterprise support