Run it hosted, or on your machine · v3.3.1

See everything.
Touch nothing.

An AWS operations console. Sign up in the browser at app.cloudeye.dev, or download it and run it on your own machine.

Open the app Download for macOS

No install for the hosted app. The desktop build is signed and notarized.

The CloudEye timeline: metrics for a service, with deploys, alarms, changes, findings and errors on lanes beneath them, a draggable playhead, and the point-in-time state of the account.

The read-only guarantee

It cannot change your infrastructure. Not by mistake, not by prompt, not by bug.

Every AWS call runs through one function with an allowlist of read verbs. Try it.

awsCall() describegetlistlookupfilter
allowed passes the allowlist

Click a command, or type your own. The mutating verbs are not in the program.

Connect an account in one click

On the hosted app you launch a CloudFormation stack that creates a read-only IAM role. CloudEye assumes it with an external id, and AWS caps every session read-only, so it cannot write even if the role let it. On your machine it uses the profiles already in ~/.aws.

Security Attack signals Resolved prod
C
64
posture score · scanned 2m ago
Open 4 · In progress 1 · Resolved 12 · Accepted 2
1 critical 3 high 11 medium
critical · 1
critical
api-sg open to the internet on 5432 network In progress seen 14d
Security group sg-04c1e8f allows ingress from 0.0.0.0/0 on 5432
sg-04c1e8f
In progress Verify History
Still present in AWS — kept as In progress
2m ago
high · 2
high
Root account MFA is disabled iam Open seen 31d
get-account-summary reports AccountMFAEnabled=0; enable MFA on the root user
2m ago
high
Bucket assets-raw has no public access block s3 Open Reappeared seen 3d
assets-raw
2m ago

Security posture

You cannot mark it fixed while AWS still says it is broken.

One sweep: GuardDuty, Security Hub, CloudTrail forensics, IAM hygiene, open security groups, S3, ECR and your logs. Scored 0 to 100, graded A to F.

  • Findings are tracked, not listed. Fingerprinted by substance, so a problem keeps its row.
  • Resolution is verified against AWS. Mark it resolved and the collector re-runs, live and uncached.
  • Regressions come back loudly. A finding that reappears is reopened, dated.
  • An outage never fakes a fix. A failed collector resolves nothing.

Incident timeline

Deploys, alarms, changes and errors on one axis.

Everything that happened to a service, drawn under its metrics on one axis. Every lane comes from the account itself.

  • Correlated lanes. A deploy with its commit, an alarm with its reason, a change with its actor.
  • A playhead that time-travels. Drag it, the account re-renders as it was then.
  • Select a window, get the story. The analyst reconstructs it and drafts the postmortem.
  • Grounded in events, not vibes. The draft cites every event behind it.

The rest of the console

One console for the whole account.

EDGE CORE DATA & EXTERNAL :3000 uploads publish ALB api · :80 → :3000 ECS Fargate service the backend API S3 buckets uploads · media · assets SQS + DLQ notifications queue

Architecture map, live

Drawn from the account today, not a diagram from two years ago.

An AI analyst on your own key

Bedrock, Anthropic, OpenAI, Gemini or DeepSeek. Your key, grounded in live data.

Ask CloudEye answers use live system data
Which lambdas are failing?
One. notifications-handler is failing on 6% of invocations, all ECONNRESET against the push provider, starting at 00:15.
How is memory right now? What shipped today?
/ecs/api-prod last 15 min filter (e.g. ?ERROR ?Exception) Auto 142 events · 2m ago
▸00:14:58INFOhealth check ok · 2 tasks running
▸00:15:02WARNmemory 91.4% of limit · task 7f2a
▸00:15:07ERROR { level: "error", msg: "ECONNRESET", requestId: "a3f81c2e", +2 more } 
{
  "level": "error",
  "msg": "ECONNRESET",
  "requestId": "a3f81c2e",
  "upstream": "push.provider",
  "durationMs": 30014
}
▸00:15:09DEBUGretry scheduled in 500 ms
▸00:15:11ERRORnotifications-handler failed after 3 retries

Live logs that behave

Level chips, JSON that expands on click, one search across every log group.

Deploy intelligence and drift

The commit running right now, next to the head of your default branch.

Every account, fully isolated

One workspace per account, so metrics, logs, maps, runbooks and findings never cross.

It never holds your keys

Hosted assumes a read-only role you create; on your machine it uses your own profiles. No long-lived AWS keys, ever.

How it works

  1. 1

    Open it or install it

    Sign up at app.cloudeye.dev, or download the app and run it on your machine.

  2. 2

    Connect an account

    One CloudFormation click creates a read-only role, or point it at an ~/.aws profile.

  3. 3

    It reads your estate

    Clusters, load balancers, logs, alarms and security, discovered and drawn for you.

Get started

Two ways to run it. Pick one.

Hostednothing to install

Sign up in the browser and connect an account. Ready in a couple of minutes.

Open app.cloudeye.dev
On your machinelocal, signed, notarized

Runs on 127.0.0.1 and reads through your own AWS profiles.

Download for macOS
Linux Windows