Seven steps, and none of them guess.

Cloud Patrol authenticates as its own principal and assumes a role you create in each target account. No account keys are ever stored. For firewalls, a read-only API account is enough to begin.

Read-only by default. Write access is a separate, explicit grant.

Accounts, VPCs and VNets, subnets, route tables, gateways, firewalls, zones and interfaces are collected into a topology graph. Workloads are deliberately left out of the graph until a query needs one resolved.

A collection that fails partway reports itself incomplete rather than looking finished.

Every rule is resolved: nested address and service groups expanded recursively, negations applied, zone scope preserved. A group that references itself is reported as a finding instead of being followed forever.

Resolution never guesses. A token it cannot expand is recorded as a gap.

Choose a source, destination, protocol and port. The engine locates both endpoints in the topology, walks every path between them, applies NAT between hops, and evaluates each control the flow crosses.

Security policy is matched on pre-NAT addresses, because that is what the devices do.

The same resolved model drives the findings: exposure, over-permissive access, duplicates, unused objects, shadowed and conflicting rules. Each finding carries the affected resources and why it matters.

Every candidate is confirmed semantically before it is reported.

Approve a change and Cloud Patrol generates the Terraform or provider CLI for it. The impact is stated first: which flows change, and which findings the change resolves or creates.

The change lands through your pipeline, not behind your back.

Collection runs on a schedule and never overwrites what came before. Changes made outside Cloud Patrol show up in the timeline, so drift is visible rather than discovered during an incident.

Snapshots are append-only, so any point in time can be produced again.