A read-only map of your cloud, with every blind spot marked.
A read-only terminal app for your GCP and AWS inventory. Runs on your machine.
The terminal UI
Keyboard-driven, like k9s. These are real screens from a scan of a sample payments company.
Scopes › payments-prod payments-prod · run 18fa5ee4 · ok · Database ╭───────────────────────────────────────────────────────────────────────────────────────────────────────╮ ╭────────────────────────────────────────────────────────────────────╮ │ NAME REGION ENGINE TIER STORAGE GB STATUS │ │╭──────────╮╭─────────────╮╭──────╮╭───────╮ │ │ ledger-db me-central2 mysql-8.4 db-n1-standard-2 100 ● RUNNABLE │ ││ Overview ││ Connections ││ JSON ││ Graph │ │ │ payments-db me-central2 postgres-16 db-custom-4-16384 500 ● RUNNABLE │ │┘ └┴─────────────┴┴──────┴┴───────┴ │ │ payments-db-dr me-central1 postgres-16 db-custom-4-16384 500 ● RUNNABLE │ │Database │ │ │ │──────────────────────────────────────── │ │ │ │Engine: postgres-16 │ │ │ │Tier: db-custom-4-16384 │ │ │ │vCPUs: 4 │ │ │ │Memory: 16.0 GiB │ │ │ │Storage: 500 GB PD_SSD │ │ │ │HA: yes │ │ │ │Maintenance: │ │ │ │Status: RUNNABLE │ │ │ │ │ │ │ │Recovery │ │ │ │Retention: 7 days │ │ │ │Backups: on │ │ │ │Last backup: 2026-10-28 02:00 UTC │ │ │ │PITR: 7 days │ │ │ │Copies in: me-central2 │ │ │ │Replica: payments-db-dr (me-central1, read-replica) │ │ │ │ │ │ │ │──────────────────────────────────────── │ │ │ │ │ │ │ │──────────────────────────────────────── │ │ │ │ReplicaOf → payments-db: │ │ │ │ Database/payments-db-dr │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────────────────────────────────────────────╯ ╰────────────────────────────────────────────────────────────────────╯ focus: left · tab=swap · enter=zoom/drill · esc=back · :alias=jump · H=runs · g=graph · e=export · E=full export · q=quit payments-prod · run 18fa5ee4 · ok · 14 resources / 8 kinds · scanned 1m ago ? help · q quit · cloudcmder 2.1.0
Scopes › payments-prod payments-prod · run 18fa5ee4 · ok · Overview ╭───────────────────────────────────────────────────────────────────────────────────────────────────────╮ ╭────────────────────────────────────────────────────────────────────╮ │Run 18fa5ee4 · ok │ │ move cursor onto a resource row │ │started: 2026-10-28T15:13:09+03:00 finished: 15:13:09 │ │ to see details here │ │──────────────────────────────────────── │ │ │ │KIND COUNT USAGE HLTH STATUS │ │ │ │Database 3 ████████████████ ○○○○○ [OK] │ │ │ │VM 3 ████████████████ ●●●○○ [CRIT: 1] │ │ │ │Bucket 2 ███████████░░░░░ ●●●●● [OK] │ │ │ │Disk 2 ███████████░░░░░ ●●●●● [OK] │ │ │ │Cluster 1 █████░░░░░░░░░░░ ●●●●● [OK] │ │ │ │LoadBalancer 1 █████░░░░░░░░░░░ ●●●●● [OK] │ │ │ │Network 1 █████░░░░░░░░░░░ ●●●●● [OK] │ │ │ │Subnet 1 █████░░░░░░░░░░░ ●●●●● [OK] │ │ │ │──────────────────────────────────────── │ │ │ │Total: 14 resources across 8 kinds │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────────────────────────────────────────────╯ ╰────────────────────────────────────────────────────────────────────╯ focus: left · tab=swap · enter=zoom/drill · esc=back · :alias=jump · H=runs · g=graph · e=export · E=full export · q=quit payments-prod · run 18fa5ee4 · ok · 14 resources / 8 kinds · scanned 2m ago ? help · q quit · cloudcmder 2.1.0
Scopes › payments-prod payments-prod · run 18fa5ee4 · ok · Database ╭───────────────────────────────────────────────────────────────────────────────────────────────────────╮ ╭────────────────────────────────────────────────────────────────────╮ │ NAME REGION ENGINE TIER STORAGE GB STATUS │ │╭──────────╮╭─────────────╮╭──────╮╭───────╮ │ │ ledger-db me-central2 mysql-8.4 db-n1-standard-2 100 ● RUNNABLE │ ││ Overview ││ Connections ││ JSON ││ Graph │ │ │ payments-db me-central2 postgres-16 db-custom-4-16384 500 ● RUNNABLE │ │┘ └┴─────────────┴┴──────┴┴───────┴ │ │ payments-db-dr me-central1 postgres-16 db-custom-4-16384 500 ● RUNNABLE │ │Database │ │ │ │──────────────────────────────────────── │ │ │ │Engine: postgres-16 │ │ │ │Tier: db-custom-4-16384 │ │ │ │vCPUs: 4 │ │ │ │Memory: 16.0 GiB │ │ │ │Storage: 500 GB PD_SSD │ │ │ │HA: no │ │ │ │Maintenance: │ │ │ │Status: RUNNABLE │ │ │ │ │ │ │ │Recovery │ │ │ │Replica of: payments-db │ │ │ │ │ │ │ │──────────────────────────────────────── │ │ │ │ │ │ │ │──────────────────────────────────────── │ │ │ │payments-db-dr → ReplicaOf: │ │ │ │ Database/payments-db │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────────────────────────────────────────────╯ ╰────────────────────────────────────────────────────────────────────╯ focus: left · tab=swap · enter=zoom/drill · esc=back · :alias=jump · H=runs · g=graph · e=export · E=full export · q=quit payments-prod · run 18fa5ee4 · ok · 14 resources / 8 kinds · scanned 1m ago ? help · q quit · cloudcmder 2.1.0
How it works
- ▸One scan, taken apart. This is what a scan of a payments company's GCP and AWS estate looks like. Scroll to take it apart.Point at a layer below to see it on the screen.
Diagram: one cloudcmder screen separated into six layers: the terminal interface, the resource table, connections between resources, recovery facts per resource, what the scan could not see, and the inventory file it writes.
Blind spots, written down
Cloud permissions often block part of a scan. cloudcmder records each blocked lookup as unknown, with the permission it needed, so a gap never passes for "no backups".
Take one of the three, payments-db. What did the scan find?
Switch between the three to compare the two reports below.
cloudcmder writes
backups: { state: unknown }
blind_spot: backup lookup denied
backups: { state: on, days: 7 }
blind_spot: none
backups: { state: off }
blind_spot: noneA tool that leaves the field blank writes
backups: false # reads as "no backups"
backups: true
# correct
backups: false
# correctThe reports disagree. One sends someone to fix a database that may be fine. cloudcmder names the permission to grant so you can find out.
The reports agree. Backups are on, kept for 7 days.
The reports agree. Backups are off, so this database needs attention.
Three files you keep
Every scan writes an inventory file in a published format, a workbook for the spreadsheet crowd, and a sealed manifest. Open them in anything, share the hashed version safely.
gcpcloudpayments-prodproject or accountDatabasekind, the same on every cloudpayments-dbthe resourceOne id per resource, the same in every file and every scan.
- scan sealed by manifest.json
- gcp:payments-prod each project or account you allowed
- me-central2 region
- Database payments-db
- recovery backups on · 7d pitr 7d backup service unknown
- connections replica → payments-db-dr, me-central1
- could not see backup service · api disabled kept per project
- aws:4058… same shape for every cloud
# profile=shareable: identifiers hashed. Collapsed, not anonymized. schema: kontinuity.io/inventory/v1 scopes: - id: gcp:h:9e5f70dbae visibility: recorded counts: { Database: 3, Disk: 17, Bucket: 9, VM: 14 } blind_spots: - { check: backup-service, region: "*", reason: api-disabled } nodes: - id: gcp:h:9e5f70dbae:Database:h:5a7b27bf1f type: Database service: cloudsql engine: postgres-16 region: me-central2 recovery: backups: { state: on, retention_days: 7, latest: "2026-10-27T02:08:04Z" } pitr: { state: on, days: 7 } backup_service: { state: unknown } edges: - { source: …Database:h:5a7b27bf1f, target: …Database:h:7a32912bd7, mechanism: cloudsql-replica }
| Project | Name | Engine | Region | Backups | Retention | PITR | Replicas | Backup service |
|---|---|---|---|---|---|---|---|---|
| payments-prod | payments-db | postgres-16 | me-central2 | true | 7 | true | payments-db-dr@me-central1 | unknown |
| payments-prod | payments-db-dr | postgres-16 | me-central1 | false | false | unknown | ||
| aws:4058… | orders | postgres-16.4 | us-east-1 | true | 14 | true | orders-dr@us-west-2 | AWS Backup |
{
"run_id": "5d0c6a2e-1b7f-4c55-9a1e-2f8b9d0c1a11",
"provider": "gcp",
"status": "ok",
"scope": { "id": "payments-prod", "consent": { "answer": "y", "at_utc": "2026-10-28T09:00:12Z" } },
"api_methods_called": [ every read-only method it called ],
"negative_attestation": "NOT read: Secret Manager payloads, KMS key material, database rows, object contents…",
"integrity": { "manifest_sha256": "f24b405d…94662", "resources": { "count": 43 } }
}What cloudcmder can see
It runs on your machine with your own read-only credentials, through the same APIs as your cloud console. Your inventory stays on your disk.
--yes.--iam-role prints the exact policy to attach.For banks and regulated teams
Regulators in the Gulf, India and the EU want proof that your DR site matches production and that recovery was tested. A scan gives your team the inventory behind that proof.
Your DR site must match the primary in data, systems and configuration, tested every year.
A scan shows replicas, regions, backups and blind spots.
DR drills every six months, with identical configuration between the data centre and DR site.
A scan shows replica config and restore windows.
Resilience and recovery testing for market intermediaries.
A scan shows recovery facts and dependencies.
A continuity plan for material cloud arrangements, tested at least once a year.
A scan shows cloud dependencies.
A register of every ICT third-party arrangement your services depend on.
A scan shows the provider services each workload uses.
cloudcmder supports the evidence for these requirements. Compliance itself stays with you and your auditor.
Pricing
Free for individuals and small teams. Larger companies need a licence to use it at work.
- Every GCP project and AWS account you can read
- Connections, recovery facts and blind spots
- Excel, YAML and JSON exports
- Sealed run manifests
- Everything in the free version
- A licence to use it at work
- Support in Gulf and India hours
Releases
Download
macOS and Linux, Intel and Apple silicon or ARM. Runs in Google Cloud Shell and AWS CloudShell.