A single place your whole policy estate is legible from.
Cloud Patrol collects firewall and cloud security configuration, normalizes it into one model, and answers questions about it that no single provider console can answer.
Unified inventory
Accounts, VPCs and VNets, firewalls, security groups, NACLs, objects and every rule, in one model that does not care which vendor wrote it.
Vendor-neutral
Policy management
Read and compare policy across environments. Rules keep their position, their zone scope and their negations, because all three change what they match.
Order preserved
Traffic testing
Pick a source, destination, protocol and port. Get one verdict and the rule that produced it, across devices and providers.
Answers, not lists
Findings
Public exposure, overly permissive rules, duplicates, unused rules, shadowed and conflicting rules, with the evidence behind each one.
Checkable
Impact analysis
Before you remove a rule, see what stops working. The answer comes from re-evaluating the flows, not from a heuristic.
Before, not after
Remediation
Generated Terraform or provider CLI for the change you approved, so the fix lands the same way the rest of your infrastructure does.
Your pipeline
Provider consoles answer about themselves.
Each console can tell you what its own rules say. None of them can tell you whether a packet leaving your corporate network reaches a database subnet three hops and two vendors away.
- Rules listed by object name, so what they resolve to is left to you
- No view across providers, so the path is reconstructed by hand
- Group membership expanded manually, cycles and all
- NAT reasoned about on a whiteboard
- Removing a rule is a guess with a change window attached
- Rules shown as the addresses and ports they actually resolve to
- One path across every device and provider it crosses
- Groups resolved recursively, cycles reported rather than followed
- NAT applied between hops, and never guessed when it cannot be computed
- Impact of a removal evaluated before you approve it
What a verdict contains
Four values, never two. A tool that can only say yes or no has to guess when the data is incomplete, and a guess about network access is worse than an admission.
- AllowedEvery control on some path permitted it, with complete evidence.
- BlockedA control denied it, and the rule that did is named.
- Partially evaluatedEverything checkable permitted it, but something could not be checked.
- UnknownNothing decisive could be established, usually because the topology was not collected.
See it against your own rules.
A demo runs read-only against your configuration. Nothing changes without your approval.