Somebody on your team wrote that policy two years ago. CloudValet reads all of them, tells you in plain words what they allow, and shouts when they change.
01 / Monitor, audit, alert
Access review shouldn't be an annual spreadsheet exercise. We keep it live, readable, and noisy only when it matters.
Monitor
We read every role, group, policy, and key across your accounts and keep an up-to-date map of effective access: what each identity can really do once inheritance and conditions are resolved.
Audit
Each policy becomes a sentence anyone in the business can read: "this role can delete any storage bucket in production." Then we grade it against what the identity actually used.
Alert
Permissions widen quietly. We watch for new grants, removed guardrails, fresh keys, and privilege escalation paths, then tell the right person with the change spelled out.
02 / Policy, translated
"Action": "s3:*", "Resource": "*"Can read, change and permanently delete every file in every storage bucket, including production backups.
Too broad"Action": "iam:PassRole", "Resource": "*"Can hand any role to a service, a path to becoming an administrator without being one.
Escalation path"Action": ["ec2:StartInstances","ec2:StopInstances"]Can start and stop virtual machines in the dev account. Cannot create, resize or delete them.
Right-sizedIllustrative examples of the translations CloudValet produces.
03 / What you get
Search by person, team, role, or resource and get a direct answer instead of a policy tree to interpret.
Every dense statement rendered as a sentence, with the risky ones surfaced first.
Identities and permissions nobody has touched in months, ranked by the damage they could do.
A narrower policy proposed alongside the original, with the permissions the identity actually used.
A timeline of every access change with who made it, when, and what it opened up.
Route production alerts to security and sandbox noise to the owning team, so alerts stay worth reading.
Read-only by default. CloudValet needs no permission to change your permissions.
IAM monitoring runs on scoped read access. Any change to access stays in your hands. We show the narrower policy, you decide whether to apply it.
04 / IAM pricing
Plain-English policy summaries are free forever. Continuous monitoring, unused-access reports and change alerts come with Pro; approvals and audit history with Enterprise.
$0
forever, up to 25 resources
Connect one cloud account read-only, see the waste, and read your IAM in plain English.
$0.25
per managed resource / month
Automated parking schedules, rightsizing plans, and IAM change alerts for the whole team.
Custom
annual, volume-based
For large estates, managed providers, and teams with audit and approval requirements.
Pre-launch pricing. Nothing is charged today. Design partners help us set the final numbers, and checkout opens at launch.