Know what to fix in your cloud estate. RRP £7,495. Now Free.
A read-only scan of the AWS, Azure or Google Cloud accounts you choose, then a senior engineer walks you through every finding, ranked, with a fix roadmap. Set up in minutes. Readout the same day.
- Read-only, nothing installed
- Report is yours to keep
- No obligation to buy
- Reply within one working day
| # | Finding | Effort | When |
|---|---|---|---|
| 01 | Storage open to the internet | Now | |
| 02 | Stale admin access | Now | |
| 03 | Workloads with no backup | Next | |
| 04 | Oversized resources | Next | |
| 05 | Idle resources | Later |
1 subscription not reached: listed in the report, not guessed
From read-only access to a ranked fix list, the same day.
Illustration: your estate as found, with accounts, subscriptions and projects across clouds and one subscription the scan could not reach; a read-only scan against best practice in six areas, security, network, governance, cost, resilience and operations; and a ranked report, starting with storage open to the internet and stale admin access to fix now.
- 01ConnectMinutes
Read-only, from our template. Your administrator sets it up in minutes. Nothing installed on your workloads.
- 02ScanHours
Every account, subscription and project in scope is read and checked against each cloud’s own best practice. Anything the scan cannot reach is flagged, not guessed.
- 03ReportSame day
Your ranked findings and fix roadmap, walked through with a senior engineer. You leave knowing what to fix first.
One working day from the moment access works. We help your team set up the role.
A two-minute form. Then set up access with one of our engineers, or on your own.
01What you get
You leave knowing what to fix first, and what it will take.
- A ranked reportWith the evidence behind every finding.
- A fix roadmapNow, next and later, with indicative effort for each item.
- Cost quick winsAlongside security and optimisation gaps.
- A readout with a senior engineerAn hour, walking through every finding with you.
- The read-only role templateYours to reuse for your own reviews.
All yours to keep, whether or not you work with us afterwards.
- Evidence
- Two storage buckets in the production account allow anonymous public read. One holds application backups.
- Why it matters
- Anyone with the address can download the backups. This is the most common cause of cloud data exposure.
- Fix
- Block public access at account level. Serve the one genuinely public asset through a CDN instead.
- Mapped to
- Security pillar: data protection
- Effort
- Under a day
02Read-only by design
We see how your cloud is configured. Never what is stored in it, and we cannot change a thing.
A read-only role on your AWS, Azure or Google Cloud estate, from our template. Ideally at organisation level, so we cover more in one pass.
The role can read
- How your accounts, subscriptions and projects are set up
- Identity, access and policy settings
- Network rules and what is exposed to the internet
- Backup, recovery and logging configuration
- Resource inventory, cost and usage
The role cannot
- Change, create or delete anything in your environment
- Read the contents of your files, databases or secrets
- Install anything on your workloads
- Scan data is deleted within 30 days of your report.
- Remove our access the moment we finish.
- Your report is confidential to you.
Every permission we ask for
The exact read-only permissions, per cloud. Open one to see the full list, or download the template your administrator will use.
AWSIAM role and policy
Full permission list from the ET delivery team (open decision 4)
Download the AWS template template file
AzureCustom role definition
Full permission list from the ET delivery team (open decision 4)
Download the Azure template template file
Google CloudCustom IAM role
Full permission list from the ET delivery team (open decision 4)
Download the Google Cloud template template file
Send it to your security team
The person who approves the role is rarely the person who books the assessment. Forward them the facts in one email.
- Access
- Read-only role from our template. Cannot change anything. File, database and secret contents blocked.
- Data
- Configuration data only. Stored in data location, to confirm, deleted within 30 days of the report.
- Who sees it
- Your report is confidential to you.
- Paperwork
- NDA and DPA position
03What we look at
Open storage, stale admin access, missing backups, idle spend: what we usually find.
- Security and identity
- Network and exposure
- Governance and policy
- Cost and waste
- Resilience, backup and recovery
- Operations and monitoring
Findings are mapped to the relevant areas of each cloud’s Well-Architected Framework. Where we cannot see something, the report says so.
04Free, no obligation
The report is yours to keep. Anything after it is your call.
The offer
Free, no obligation.
The assessment and the report cost nothing and are yours to keep, with no obligation to buy anything.
What we need from you
A read-only role on your AWS, Azure or Google Cloud estate, from our template. Ideally at organisation level, so we cover more in one pass. Then an hour for the readout.
Want to go deeper? The full, workshop-led Platform Assessment adds architecture, people and process. Ask us at your readout.
05Questions
What IT leads ask before granting access
What access do you need, exactly?
A read-only role, created by your administrator from our template. Ideally at organisation level, so we cover more in one pass. The full permission list for each cloud is on this page.
Can your role change anything?
No. The access we ask for cannot change your environment: nothing is created, changed or deleted, and nothing is installed on your workloads.
Will you see our data?
No. Our template blocks reading the contents of your files, databases and secrets. We assess how your cloud is configured, not what is stored in it.
We have hundreds of accounts. Does that work?
Yes. Every account, subscription and project in scope is read. Organisation-level access covers the most in one pass. Very large estates may take longer, and we will say so up front.
How long does it really take?
Minutes to set up the role, hours to scan, and the readout the same day. Timing runs from the point access is working, so the real wait is usually your own approval process. We help your team set up the role.
Who sees the report?
Your report is confidential to you.
What happens to our data?
Scan data is deleted within 30 days of your report. Remove our access the moment we finish.
Is this a sales call in disguise?
No. The assessment and the report are free and yours to keep, with no obligation to buy anything. If you want to go deeper, the workshop-led Platform Assessment is there. Ask us at your readout, or don't.
What if you are full this month?
Places are limited each month. If we are full, we book you into the next and tell you when.
Which clouds do you cover?
AWS, Azure and Google Cloud. Accounts, subscriptions and projects can all be in scope, and each is checked against its own cloud’s best practice.
Is this an audit or a Well-Architected Review?
No. It is an automated, point-in-time review of cloud configuration through the read-only access you grant. Findings are mapped to the relevant Well-Architected areas, but it is not an audit, a Well-Architected Review or a guarantee of security or compliance.
Book your free assessment. Two minutes, two steps.
What happens next
- We reply within one working day with your read-only role template.
- Set up access with one of our engineers on a short call, or on your own.
- Your readout the same day access works, with a senior engineer.
Free for organisations with production workloads in AWS, Azure or Google Cloud.
You are booked in. Here is what happens next.
- We reply within one working dayCheck your inbox for a confirmation with the read-only role template attached.
- Set up accessPick a 20-minute slot below and one of our engineers will set up the role with your team. Or use the template on your own.
- Your readoutThe same day access works: your ranked findings and fix roadmap, with a senior engineer.
Pick a time to set up access
Open in a new tabIf the calendar does not load here.
The fine print. An automated, point-in-time review of cloud configuration through the read-only access you grant. It is not an audit, a Well-Architected Review or a guarantee of security or compliance. Timing runs from the point access is working; very large estates may take longer and we will say so up front. Your report is confidential to you. Free for organisations with production workloads in AWS, Azure or Google Cloud. Places are limited each month; if we are full, we book you into the next. We may decline requests outside scope. Want to go deeper? The full, workshop-led Platform Assessment adds architecture, people and process. Ask us at your readout. The Cloud Assessment has a recommended retail price of £7,495 (excluding VAT); it is offered free here. Provided under the Free Cloud Assessment terms, which you accept when you book.