ClearSky — AWS posture and cost platform

problem

Reproducible findings without giving AI control

Security scanners are usually opaque: a score appears and the reasoning behind it belongs to someone else. I wanted findings that were reproducible — the same account state producing the same findings every time — with any AI strictly additive, able to explain and investigate but never to decide what counts as a finding.

The second constraint was running cost. The platform uses no always-on compute, NAT gateway or managed scanner. Its deployment pipeline can also remove the complete stack when it is not needed.

architecture

Serverless scanning with read-only account access

The detectors are pure functions — API responses in, findings out — so they are tested against fixtures rather than mocked against live AWS. The whole backend runs on the Python standard library plus boto3: no layers, no third-party packages, nothing to patch. JWT verification, RS256 included, is implemented in-process against Cognito's JWKS.

Login is a custom page rather than Cognito's hosted UI, authenticating with USER_PASSWORD_AUTH over fetch, which is what makes the new-password, forgot-password and silent-refresh flows behave the way the rest of the dashboard does.

decisions and tradeoffs

Key design decisions

A Lambda function URL instead of API Gateway

One less service to run and pay for. The tradeoff is real: no usage plans and no request validation, so validation lives in the handler.

Detectors as pure functions

Deterministic and fixture-testable, which is what makes a finding trustworthy. The cost is that every new AWS API shape needs a fixture before it needs a detector.

Read-only IAM as the AI's hard boundary

The agent's tool loop is limited to describe, list and get calls. It cannot change account resources. IAM enforces that boundary independently of the model prompt.

A zero-dependency backend

No supply chain to audit and no layer builds in CI. The cost is code written by hand that a library would otherwise provide, including RS256 verification.

Cost Explorer results cached per preset per day

Cost Explorer charges per query. Caching keeps a page that is all about cost from being the expensive part of the platform.

what broke

Terraform dependency ordering blocked cleanup

Terraform attempted to delete the origin access control before detaching it from the CloudFront distribution, and AWS returned a dependency conflict. Applying the distribution change first, then running the complete apply, allowed Terraform to remove the detached resource cleanly.

numbers

Scope and test coverage

• 24+read-only detectors, every enabled region
• 113unit tests against fixtures
• 66findings on the first real scan (35 high, 9 medium, 22 low)
• noneleft running — destroyed from its own pipeline

A push to main can recreate the platform after the stack has been removed. Terraform, the application source and the deployment workflows contain everything needed to rebuild it.