Cloud Approver logo
Cloud Approver Cloud architecture, security, and risk guidance
Sign in Have a code?
Read-only cloud review across AWS, Azure, and Google Cloud

Turn cloud confusion into a short list of business decisions.

Cloud Approver gives teams of any size a practical review layer across AWS, Azure, and Google Cloud. Each workspace can group resources from different provider accounts into workloads by purpose, client, department, product, migration, or owner, creating cross-cloud and cross-account workload monitoring so teams can review what matters to the business instead of reviewing one account at a time. It does this without installing agents or giving Cloud Approver permission to change infrastructure.

Traditional CSPM and FinOps tools usually start with a large alert catalog. Cloud Approver starts with a smaller operating question: what changed, what needs approval, what creates cost or risk, and who should decide? See how this compares with Trusted Advisor, Prowler, and CloudCheckr below.

AWS Azure Google Cloud
Request an invite
Multi-cloud setup Connect AWS, Azure, and Google Cloud with provider-native read-only access, then let scheduled scans turn scattered provider details into one review.
Read-only by design The scanner roles and grants have no write permissions, install no agents, and cannot change customer infrastructure. Every provider scan rechecks the configured read-only grants and stops if unexpected permissions are detected.
Workspace workload view Group resources by business purpose across accounts and supported clouds, then review spend, approvals, drift, and risk in that shared context.
Review packet This week
Risk

Administrator-style workload role found on a production resource.

Cost

Old backups and storage are retained past the review threshold.

Habit

Required owner, workload, or environment tags are missing.

Outcome Prioritized recommendations with evidence, impact, and next-step guidance.
The business proposition

Cloud governance that advises the team while it protects the business

Many companies do not need a heavyweight security platform or a standing cloud consulting team. They need a clear monthly rhythm: review what changed, understand the business risk, decide what to approve, and know where cloud operating habits are getting stronger or weaker.

Reduce avoidable spend

Find stale resources, excess backup retention, idle storage, missing lifecycle rules, size drift, and workload spend that needs an owner.

Lower security risk

Surface exposed access, broad identities, weak logging, missing encryption, public sharing, and configuration drift in plain language.

Improve reliability habits

Review backup coverage, monitoring, zone redundancy, managed group posture, key-system awareness, and missing self-recovery signals.

Monitor by purpose

Workspace workloads can span accounts and supported clouds, giving teams a view by product, client, department, migration, or budget owner.

Simple enough for teams still building cloud confidence

New customers do not install agents or grant administrator access. AWS uses CloudFormation, Azure uses reader-style delegation, and Google Cloud uses scoped read-only access; scans run without changing infrastructure or reading application data.

Connect safely

Use provider-native setup with scoped read-only permissions for each cloud account or subscription you want reviewed.

Build repeatable review habits

Scheduled scans organize account evidence into dashboards, recommendations, inventory, workspace workload views, reports, and scan history.

Ask for help when needed

Support requests can carry recommendation context so customers can get guidance without giving the product remediation powers.

Competitive context

How this is different from what you’re using now

Most teams evaluating Cloud Approver already use something: AWS Trusted Advisor, Prowler, or a platform such as CloudCheckr. Cloud Approver is not trying to out-scan them. It closes the gap between a large set of findings and the one decision the team needs to make this week, with an owner and context attached.

Capability Cloud Approver AWS Trusted Advisor Prowler CloudCheckr
Cloud coverageAWS, Azure, and Google CloudAWSAWS, Azure, and Google CloudAWS, Azure, and Google Cloud
Access modelProvider-native read-only access; no agentsNative AWS serviceCLI or hosted scans; setup varies by deploymentRead-only cloud connector
Primary outputA short decision-ready review with evidence and next stepsAWS checks and recommendationsControl and check reportsCompliance, cost, and billing reports
Decision workflowApprovals are recorded against a workload with an owner and expirationRecommendations are reviewed in AWSWorkflow is built around the scan outputRecommendations and reports support broader operations workflows
Business groupingWorkloads span accounts and clouds by product, client, department, or ownerAWS account and organization contextProvider and account scan contextAccount, billing, and compliance management context
Best fitSmall teams, agencies, and fractional IT teams without a dedicated operations functionAWS-only teams using AWS SupportTeams that want open-source scan breadth and CLI-level controlEnterprises and MSPs with compliance or billing operations
Concrete example

Example recommendation: public admin access needs a business decision

This written example shows the kind of recommendation Cloud Approver produces. The screenshot walkthrough below is different: it shows the product workflow for turning discovered inventory into a workload approval that can be monitored later.

Evidence

Administrative port exposed to 0.0.0.0/0 or an equivalent public source range.

Decision

Restrict access to a known network, replace direct access with a safer path, approve the exception, or request guidance.

Resolution

The finding stays visible until a later scan confirms the public exposure is gone or the approved exception still matches intent.

Product walkthrough

From scan evidence to approved workload inventory

A short visual path through one normal review: scan a read-only account, discover a resource, organize business initiatives into workloads, attach the resource, approve it, and keep watching it on later scans.

Cloud Approver scan details page showing a successful scan and provider API calls
Step 1

Scan runs read-only checks

The account scan shows status, check progress, region rollup, and read-only provider API calls used to collect evidence.

Cloud Approver inventory page showing a discovered EC2 instance
Step 2

Inventory appears by account

The discovered EC2 instance is visible with service, region, status, approval state, and estimated monthly cost context.

Cloud Approver workload page showing an initiative-oriented workload
Step 3

Organize resources into initiatives

Create workloads for specific initiatives, products, clients, departments, or migrations so related resources can be reviewed together across clouds and accounts.

Cloud Approver add inventory page showing an EC2 instance selected for a workload
Step 4

Select it for a workload

A user can attach inventory to a cross-account workload by selecting the resource and starting the approval workflow.

Cloud Approver approval dialog for adding a selected resource to a workload
Step 5

Record the approval decision

The approval dialog captures expiration and context so the decision is tied to a workload instead of living only in a cloud tag.

Cloud Approver workload page showing the approved EC2 resource
Step 6

Monitor the approved workload

The workload view shows approved resources, current estimate, account coverage, and whether later scans still match the approval.

Pricing follows account spend

Cloud Approver is testing spend-under-management pricing during the invite-only rollout. Fees are based on the prior period's billable cloud spend for connected accounts, excluding support charges and taxes.

Alpha phase: $0.00 cost while the product is invite-only and available until October 1, 2026.

Combined cloud spend range Fee
$0 - $250 $0
$250 - $5,000 $49 flat
$500 - $5,000 1% of spend
$5,000 - $50,000 1% of spend
$50,000+ 0.50% of spend Capped at $3,500
$200,000+ 0.50% of spend Capped at $3,500

Request an invite

Tell us where you are in your cloud review. We are onboarding in small alpha batches and will reply with fit, setup expectations, and timing before you connect an account.

If your suggested scan becomes part of Cloud Approver, we will credit you 6 months.