What problem does it solve?
Cloud infrastructure drifts out of compliance over time — buckets become public, resources lose required tags, and IAM roles accumulate overly broad permissions. Manually auditing AWS state against policy is slow and error-prone, and auto-remediation without human review is risky.
Core Features & Use Cases
- Read-only AWS auditing: Lists S3 buckets and IAM roles, checks bucket exposure, required tags, and IAM scope against a human-authored compliance policy.
- Audit log cross-referencing: Queries CloudTrail to determine when each violation happened and who caused it, attaching actor and timestamp to every finding.
- Human-reviewed remediation: Drafts proposed fixes and opens one change request per finding — never applies a fix directly.
- Use Case: A daily cron fires the sweep; the agent checks all buckets and roles against the policy in
.kortix/memory/compliance-policy.md, files findings to the alert channel, and opens change requests like compliance: newly-public bucket acme-uploads for human approval.
Quick Start
Ask the agent to run a compliance check against the current AWS account and file any drift findings with proposed remediation change requests.
