AWS
AWS, managed with guardrails.
Inventory every region, see what depends on what before you touch it, check configuration against cited benchmarks, reach instances without opening a port, and run Terraform from a repository behind an approval step. The deepest of the four cloud managers.
SEE IT RUN
THE MANUAL WAY
What running AWS from the console looks like.
THE DELETE THAT TOOK THREE THINGS WITH IT
A security group looked unused. It was referenced by a launch template, which fed an Auto Scaling group, which kept checkout running. The console showed you the group, not what depended on it.
THE BASTION NOBODY WANTS TO OWN
To reach a private instance you keep a jump host with port 22 open to an office range that changed twice. Everyone knows it is a risk; it is also the only way in.
THE CLEAN REPORT THAT CHECKED NOTHING
A compliance scan came back with no findings. It had not been able to read half the regions, and it did not say so. Silence looked exactly like a pass.
WHAT TALOS DOES
Six things Talos makes visible in AWS.
Every region, and the global scope
Inventory sweeps each enabled region plus the global services separately. A region that could not be read is named as missing, and a partial sweep never overwrites a complete one.
Ownership and tombstones
Each resource records who is allowed to change it (Talos, a Terraform stack or someone else), and a resource that vanishes from a sweep is marked absent, not quietly deleted.
Resource graph and blast radius
Relationships between instances, groups, subnets, load balancers and roles are collected, so a destructive action shows what depends on its target before it is allowed to run.
Posture with cited severity
S3 and IAM configuration checked against published controls. Every finding links its source and the framework version, and a check that could not run says NOT EVALUATED rather than pass.
Fleet operations without inbound ports
Port-forward to an instance through Session Manager, run commands from an allow-list of documents, and rotate secrets. All three are off until enabled per account, scoped to tagged instances, and never show a secret’s value.
Terraform from your repository
Connect a repository, plan it through the queue, review the plan, and apply exactly that saved plan after approval. Drift is checked on a schedule, so changes made outside Terraform surface early.
HOW IT RUNS
Every action is a tracked job.
WHAT MAKES THIS DIFFERENT
A check that could not run is not a pass, and a missing resource is not a deleted one.
Talos reports coverage as well as results: a region it could not read and a resource it did not see are each recorded as findings, never treated as empty or deleted. Every check reports PASS, FAIL or NOT EVALUATED with a reason. A scan is only complete if every scope it was meant to cover reported, and an incomplete one never supersedes a complete one’s verdict. Write access is limited the same way. Fleet writes are off for an account until someone turns them on, and the IAM policy Talos generates scopes sessions and commands to instances tagged ManagedBy=talos, so the limit is enforced by AWS, not only by Talos’s own code.
RELATED CAPABILITIES
Attach one account, read-only.
Talos generates the IAM policy it needs. The first sweep writes nothing and tells you which scopes it could not read.