Cloud

Overview

Cloud brings your AWS, Azure and GCP accounts together: what they cost, what resources they hold, and how their configuration scores against security checks. Connect each account once with the connector wizard; DeviceQuest then syncs cost, inventory and posture data on a schedule.

Open it from Cloud Resources in the Risk group of the sidebar. You need at least one of cloud:connector:read, cloud_costs:read or posture:read to open the page.

Screen tour

Click to enlarge

Until a provider is connected, the page shows No cloud providers connected. Connect your first account to start collecting cost, posture and inventory data.

Connect a cloud account

Before you start, add a credential for the account under Scan Credentials (AWS, Azure or GCP type). See the Credentials page of the Discover section.

Step 1: Choose the provider

Click to enlarge

1. Click Connectors (or Open setup). Cloud Connector Setup opens.
2. Click AWS, Azure or GCP. The wizard moves to step 2.

Step 2: Enter the account details

Click to enlarge

Click Save Connector. If a field is missing, the wizard shows Provider, account ID, and credential are required.

Step 3: Sync

The wizard confirms that the connector is saved. It shows as unconfigured until its first sync completes. Click Retry Sync on its card to sync now, or wait for the next scheduled sync. Click Add another connector to connect another account, or Done to close the setup.

Manage connectors

Connected accounts lists every connector as a card with the provider, a status badge, the name and account ID, the last error (hover for the full text) and Last sync:

• Retry Sync starts a sync of that account.
• Remove deletes the connector.

Overview tab

The Overview tab answers “where do we stand?”:

• Cloud provider footprint: a strip with one segment per provider. Click a segment to see that provider’s resources in Inventory.
• A summary sentence, for example $12,480 spent this period, 7 failing posture checks and 2 budgets configured.
• Providers, Accounts, Checks evaluated and Posture pass rate.
• Data source health: one chip per account with its last sync, for example AWS · Just synced, 3h ago — check sync or 2d ago — stale. A Retry button appears for accounts in error.
• Cost: the daily spend over the last 90 days as a heatmap, with anomalous days marked, and the burn card with the 30-day run-rate, the trend and the Projected next 90 days. Projections appear once there are two weeks of cost data.
• Posture coverage: a matrix of the passing share by service and control family (Identity, Network, Encrypt, Logging, Backup, Comply), coloured Passing, Degraded, Failing or Unscanned.
• Provider comparison: one row per provider with Status (Connected or Not connected), Accounts, Cost (period), Posture, Top issue and Last sync.

Inventory tab

The Inventory tab lists the cloud resources found in your accounts: virtual machines, databases, storage buckets, IAM users and Kubernetes clusters.

• Click a column header to sort.
• Click Filter to filter by Provider, text (Name, region, tag…), Cost band, Posture state, and Tag key / Tag value, then click Apply.
• Select resources to show N selected with Copy IDs and Clear.
• Click a row, or press Enter on it, to open the resource side sheet.

EC2 instances also link to their asset in Asset Inventory.

Resource side sheet

The side sheet shows one resource:

• The name, provider, type, region and creation date.
• Tags. Values of sensitive tags (keys containing secret, key, token, password, credential or private) are masked as ••••••; click Copy and confirm to copy one.
• Relationships: the resources this one is connected to.
• Open in AWS console (or Azure, GCP): opens the resource in the provider’s console.

Press Esc or click outside the sheet to close it.

Cost tab

The Cost tab shows where the money goes:

• Period spend across all connected providers.
• The burn card with the run-rate and projection.
• Spend trend: daily spend over 90 days for the top five services and Other.
• Daily spend: a heatmap, one cell per day.
• Top cost drivers: the ten services whose cost changed most in the last 30 days compared with the 30 days before.

Budgets

The Budgets panel tracks the rolling 30-day spend against a monthly cap per provider. Each budget shows the amount spent of the budget, the percentage, and a state:

To create a budget:

Click to enlarge

1. Open the Cost tab and click + New in Budgets (or + Create your first budget).
2. Enter a Name, choose the Provider and enter the Monthly budget ($). The name defaults to “{Provider} budget”.
3. Click Create. Budget created successfully. confirms it.

The monthly budget must be greater than $0.

Posture tab

The Posture tab shows how your accounts score against cloud security checks:

• A summary card per provider with the score, a pass/warn/fail bar and the score per category.
• Coverage matrix: the same matrix as on Overview.
• N failing · M passing and one Scan {provider} button per connected provider.
• The critical findings, listed first.
• The failing checks, which you can filter by Severity (critical, high, medium, low) and by type (Security risk or Hygiene).

Each finding card shows the severity, category and check type, what was found, the remediation and the resource. CVE IDs link to the CVE details.

Run a posture scan

1. Open the Posture tab.
2. Click Scan AWS (or Azure, GCP).
3. DeviceQuest confirms {provider} scan started — results will appear after completion.

After a scan, the button rests for 15 minutes before you can scan that provider again. Hover it to see when: Scan ran 3m ago. Try again in 12 minutes.

Request an exception for a finding

If you accept a failing security check for now, request an exception for it:

1. On the finding card, click Request exception.
2. Fill in Request exception as described in Request an exception: the reason, business case, compensating controls, evidence, suggested approver and end date.
3. Click Request.

The exception follows the normal approval lifecycle. Request exception is offered on security findings; hygiene findings are fixed rather than excepted. Click Open in {provider} console to fix a finding at the source.

Saved views

Click Views to apply a view: All providers, AWS only, Azure only, GCP only, Failing posture, High cost (>$1k/mo), Recently synced or Unscanned resources. To save your own, click Save current view… and enter a name. Saved views are kept in this browser; click ✕ to delete one.

Keyboard shortcuts

Shortcuts are ignored while you type in a field.

Related pages

• Exceptions
• CVE details
• Vulnerabilities