A read-only map of your cloud, with every blind spot marked.
A read-only terminal app for your GCP and AWS inventory. Runs on your machine.
The terminal UI
Keyboard-driven, like k9s. These are real screens from a scan of a sample payments company.
Scopes › payments-prod payments-prod · run 18fa5ee4 · ok · Database ╭───────────────────────────────────────────────────────────────────────────────────────────────────────╮ ╭────────────────────────────────────────────────────────────────────╮ │ NAME REGION ENGINE TIER STORAGE GB STATUS │ │╭──────────╮╭─────────────╮╭──────╮╭───────╮ │ │ ledger-db me-central2 mysql-8.4 db-n1-standard-2 100 ● RUNNABLE │ ││ Overview ││ Connections ││ JSON ││ Graph │ │ │ payments-db me-central2 postgres-16 db-custom-4-16384 500 ● RUNNABLE │ │┘ └┴─────────────┴┴──────┴┴───────┴ │ │ payments-db-dr me-central1 postgres-16 db-custom-4-16384 500 ● RUNNABLE │ │Database │ │ │ │──────────────────────────────────────── │ │ │ │Engine: postgres-16 │ │ │ │Tier: db-custom-4-16384 │ │ │ │vCPUs: 4 │ │ │ │Memory: 16.0 GiB │ │ │ │Storage: 500 GB PD_SSD │ │ │ │HA: yes │ │ │ │Maintenance: │ │ │ │Status: RUNNABLE │ │ │ │ │ │ │ │Recovery │ │ │ │Retention: 7 days │ │ │ │Backups: on │ │ │ │Last backup: 2026-10-28 02:00 UTC │ │ │ │PITR: 7 days │ │ │ │Copies in: me-central2 │ │ │ │Replica: payments-db-dr (me-central1, read-replica) │ │ │ │ │ │ │ │──────────────────────────────────────── │ │ │ │ │ │ │ │──────────────────────────────────────── │ │ │ │ReplicaOf → payments-db: │ │ │ │ Database/payments-db-dr │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────────────────────────────────────────────╯ ╰────────────────────────────────────────────────────────────────────╯ focus: left · tab=swap · enter=zoom/drill · esc=back · :alias=jump · H=runs · g=graph · e=export · E=full export · q=quit payments-prod · run 18fa5ee4 · ok · 14 resources / 8 kinds · scanned 1m ago ? help · q quit · cloudcmder 2.1.0
Scopes › payments-prod payments-prod · run 18fa5ee4 · ok · Overview ╭───────────────────────────────────────────────────────────────────────────────────────────────────────╮ ╭────────────────────────────────────────────────────────────────────╮ │Run 18fa5ee4 · ok │ │ move cursor onto a resource row │ │started: 2026-10-28T15:13:09+03:00 finished: 15:13:09 │ │ to see details here │ │──────────────────────────────────────── │ │ │ │KIND COUNT USAGE HLTH STATUS │ │ │ │Database 3 ████████████████ ○○○○○ [OK] │ │ │ │VM 3 ████████████████ ●●●○○ [CRIT: 1] │ │ │ │Bucket 2 ███████████░░░░░ ●●●●● [OK] │ │ │ │Disk 2 ███████████░░░░░ ●●●●● [OK] │ │ │ │Cluster 1 █████░░░░░░░░░░░ ●●●●● [OK] │ │ │ │LoadBalancer 1 █████░░░░░░░░░░░ ●●●●● [OK] │ │ │ │Network 1 █████░░░░░░░░░░░ ●●●●● [OK] │ │ │ │Subnet 1 █████░░░░░░░░░░░ ●●●●● [OK] │ │ │ │──────────────────────────────────────── │ │ │ │Total: 14 resources across 8 kinds │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────────────────────────────────────────────╯ ╰────────────────────────────────────────────────────────────────────╯ focus: left · tab=swap · enter=zoom/drill · esc=back · :alias=jump · H=runs · g=graph · e=export · E=full export · q=quit payments-prod · run 18fa5ee4 · ok · 14 resources / 8 kinds · scanned 2m ago ? help · q quit · cloudcmder 2.1.0
Scopes › payments-prod payments-prod · run 18fa5ee4 · ok · Database ╭───────────────────────────────────────────────────────────────────────────────────────────────────────╮ ╭────────────────────────────────────────────────────────────────────╮ │ NAME REGION ENGINE TIER STORAGE GB STATUS │ │╭──────────╮╭─────────────╮╭──────╮╭───────╮ │ │ ledger-db me-central2 mysql-8.4 db-n1-standard-2 100 ● RUNNABLE │ ││ Overview ││ Connections ││ JSON ││ Graph │ │ │ payments-db me-central2 postgres-16 db-custom-4-16384 500 ● RUNNABLE │ │┘ └┴─────────────┴┴──────┴┴───────┴ │ │ payments-db-dr me-central1 postgres-16 db-custom-4-16384 500 ● RUNNABLE │ │Database │ │ │ │──────────────────────────────────────── │ │ │ │Engine: postgres-16 │ │ │ │Tier: db-custom-4-16384 │ │ │ │vCPUs: 4 │ │ │ │Memory: 16.0 GiB │ │ │ │Storage: 500 GB PD_SSD │ │ │ │HA: no │ │ │ │Maintenance: │ │ │ │Status: RUNNABLE │ │ │ │ │ │ │ │Recovery │ │ │ │Replica of: payments-db │ │ │ │ │ │ │ │──────────────────────────────────────── │ │ │ │ │ │ │ │──────────────────────────────────────── │ │ │ │payments-db-dr → ReplicaOf: │ │ │ │ Database/payments-db │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────────────────────────────────────────────╯ ╰────────────────────────────────────────────────────────────────────╯ focus: left · tab=swap · enter=zoom/drill · esc=back · :alias=jump · H=runs · g=graph · e=export · E=full export · q=quit payments-prod · run 18fa5ee4 · ok · 14 resources / 8 kinds · scanned 1m ago ? help · q quit · cloudcmder 2.1.0
How it works
- ▸One scan, taken apart. This is what a scan of a payments company's GCP and AWS estate looks like. Scroll to take it apart.Point at a layer below to see it on the screen.
Diagram: one cloudcmder screen separated into six layers: the terminal interface, the resource table, connections between resources, recovery facts per resource, what the scan could not see, and the inventory file it writes.
Blind spots, written down
Cloud permissions often block part of a scan. cloudcmder records each blocked lookup as unknown, with the permission it needed, so a gap never passes for "no backups".
Take one of the three, payments-db. What did the scan find?
Switch between the three to compare the two reports below.
cloudcmder writes
backups: { state: unknown }
blind_spot: backup lookup denied
backups: { state: on, days: 7 }
blind_spot: none
backups: { state: off }
blind_spot: noneA tool that leaves the field blank writes
backups: false # reads as "no backups"
backups: true
# correct
backups: false
# correctThe reports disagree. One sends someone to fix a database that may be fine. cloudcmder names the permission to grant so you can find out.
The reports agree. Backups are on, kept for 7 days.
The reports agree. Backups are off, so this database needs attention.
Three files you keep
Every scan writes an inventory file in a published format, a workbook for the spreadsheet crowd, and a sealed manifest. Open them in anything, share the hashed version safely.
gcpcloudpayments-prodproject or accountDatabasekind, the same on every cloudpayments-dbthe resourceOne id per resource, the same in every file and every scan.
- scan sealed by manifest.json
- gcp:payments-prod each project or account you allowed
- me-central2 region
- Database payments-db
- recovery backups on · 7d pitr 7d backup service unknown
- connections replica → payments-db-dr, me-central1
- could not see backup service · api disabled kept per project
- aws:4058… same shape for every cloud
# profile=shareable: identifiers hashed. Collapsed, not anonymized. schema: kontinuity.io/inventory/v1 scopes: - id: gcp:h:9e5f70dbae visibility: recorded counts: { Database: 3, Disk: 17, Bucket: 9, VM: 14 } blind_spots: - { check: backup-service, region: "*", reason: api-disabled } nodes: - id: gcp:h:9e5f70dbae:Database:h:5a7b27bf1f type: Database service: cloudsql engine: postgres-16 region: me-central2 recovery: backups: { state: on, retention_days: 7, latest: "2026-10-27T02:08:04Z" } pitr: { state: on, days: 7 } backup_service: { state: unknown } edges: - { source: …Database:h:5a7b27bf1f, target: …Database:h:7a32912bd7, mechanism: cloudsql-replica }
| Project | Name | Engine | Region | Backups | Retention | PITR | Replicas | Backup service |
|---|---|---|---|---|---|---|---|---|
| payments-prod | payments-db | postgres-16 | me-central2 | true | 7 | true | payments-db-dr@me-central1 | unknown |
| payments-prod | payments-db-dr | postgres-16 | me-central1 | false | false | unknown | ||
| aws:4058… | orders | postgres-16.4 | us-east-1 | true | 14 | true | orders-dr@us-west-2 | AWS Backup |
{
"run_id": "5d0c6a2e-1b7f-4c55-9a1e-2f8b9d0c1a11",
"provider": "gcp",
"status": "ok",
"scope": { "id": "payments-prod", "consent": { "answer": "y", "at_utc": "2026-10-28T09:00:12Z" } },
"api_methods_called": [ every read-only method it called ],
"negative_attestation": "NOT read: Secret Manager payloads, KMS key material, database rows, object contents…",
"integrity": { "manifest_sha256": "f24b405d…94662", "resources": { "count": 43 } }
}What cloudcmder can see
It runs on your machine with your own read-only credentials, through the same APIs as your cloud console. Your inventory stays on your disk.
GCPyour projects
AWSyour accounts
read-only
your machine or CloudShell
cloudcmderyour credentials, asks before it scans
writes
inventory.yaml
estate.xlsx
manifest.json
cloudcmder.comgets your work email, once, at download
never receives: Scan 3 projects? [y/N] y
Asks before it scansEvery project and account is listed first, and nothing runs until you answer. Scripts pass
--yes.roles/viewerroles/cloudasset.viewer--iam-role
Read-only rolesTwo viewer roles on GCP. On AWS,
--iam-role prints the exact policy to attach.manifest.jsonsha256 ✓ matches
Sealed runsEach scan records the API methods it called and a hash of the results. Edit a row later and the hash stops matching.
cloudcmdercloud APIsus
Sends us nothingNo telemetry and no update pings. Block every host except your cloud's APIs and it still runs.
For banks and regulated teams
Regulators in the Gulf, India and the EU want proof that your DR site matches production and that recovery was tested. A scan gives your team the inventory behind that proof.
SAMASaudi Arabia
Your DR site must match the primary in data, systems and configuration, tested every year.
A scan showsreplicasregionsbackupsblind spots
RBIIndia
DR drills every six months, with identical configuration between the data centre and DR site.
A scan showsreplica configrestore windows
SEBIIndia
Resilience and recovery testing for market intermediaries.
A scan showsrecovery factsdependencies
CBUAEUAE
A continuity plan for material cloud arrangements, tested at least once a year.
A scan showscloud dependencies
DORAEU
A register of every ICT third-party arrangement your services depend on.
A scan showsprovider servicesper workload
cloudcmder supports the evidence for these requirements. Compliance itself stays with you and your auditor.
Pricing
Free for individuals and small teams. Larger companies need a licence to use it at work.
Individuals and small teams
$0
- Every GCP project and AWS account you can read
- Connections, recovery facts and blind spots
- Excel, YAML and JSON exports
- Sealed run manifests
Larger companies
Talk to us
- Everything in the free version
- A licence to use it at work
- Support in Gulf and India hours
Releases
Google CloudEvery project and how its resources connect, without opening the console.
AWSOne account or a whole organization, with an audit trail of every scan.
Shareable exportsHand reports to auditors and vendors without exposing internal names.
ComingAzure and Oracle CloudOne read-only view across all four major clouds.
Download
macOS and Linux, Intel and Apple silicon or ARM. Runs in Google Cloud Shell and AWS CloudShell.