Cirrus goes past inventory. It traces network paths hop-by-hop, validates your estate against the Well-Architected Framework, simulates NSG traffic decisions, and audits against CIS Azure Benchmark — for every subscription in your tenant. All read-only. All read live from Azure.
| Name | Status | Size | Region | Est./mo |
|---|---|---|---|---|
| aks-runner-01 | running | Standard_D4s_v5 | eastus | $182.50 |
| sql-primary | running | Standard_E8s_v5 | eastus | $412.10 |
| batch-node-02 | deallocated | Standard_D8s_v5 | westeu | $0.00 |
| jump-box | running | Standard_B2ms | eastus | $60.80 |
| reporting-web | running | Standard_D2s_v5 | eastus | $70.10 |
| legacy-ftp | stopped | Standard_A2_v2 | westus | $44.90 |
Cirrus answers the questions an inventory tool stops at — which VMs are reachable, what your architecture scores against WAF, which CIS controls fail, which RIs would pay back.
Pick any VM and Cirrus walks the network chain — NIC, subnet, NSG, effective rules, route table, public IP — reproducing the same source-to-destination trace az network watcher gives you. Then the traffic simulator evaluates a given (source, port) against every rule in priority order and shows exactly which one matched.
Cost, Reliability, Security, Operational Excellence, Performance Efficiency. Every VM, storage account, key vault, and public IP is scored against the WAF checklist with letter grades and an overall roll-up. Findings link back to the exact resource — no leaving the report to drill in.
RDP, SSH, and database ports open to the Internet. Storage accounts allowing HTTP or public blobs. Key Vaults without purge protection. App Services that don't enforce HTTPS. All flagged with the CIS control ID they violate, ready to export as an audit PDF.
Every VM cost is pulled from Microsoft's public Retail Prices API for the exact SKU and region. PAYG, 1-year RI, and 3-year RI rates arrive in the same round trip. Cached 24 hours per (SKU, region) so a 200-VM estate typically hits the API less than fifteen times.
| SKU | PAYG | 3-Yr RI | Save |
|---|---|---|---|
| Standard_D4s_v5 | $192 | $77 | −60% |
| Standard_D8s_v5 | $384 | $154 | −60% |
| Standard_B2ms | $61 | $25 | −59% |
| Standard_E4s_v5 | $252 | $101 | −60% |
Not a policy. Not a checklist. Four defensive layers in code make mutation impossible.
The proxy that talks to Azure only accepts read verbs. Any request that would create, change, or delete a resource is rejected before it leaves the app.
Cross-subscription searches run through Azure's read-only query engine. It has no write primitives — there is no query text that could ever change a resource, by design.
The Azure client libraries that could theoretically perform write operations are never loaded. If a developer ever tried to add one, the app would fail its build check.
Drift snapshots are cached in your own browser and never sent to a server. Deleting a snapshot removes it locally — Azure is untouched, and there is no server copy to leak.
Inventory, cost, security, networking, monitoring, and tools — all in one shell, all read-only.
One command to create it, one form to sign in. Credentials are encrypted server-side for eight hours and are never readable from your browser. Logout wipes the session immediately.
# One command to create the SP az ad sp create-for-rbac \ --name "azure-inventory-utility" \ --role Reader \ --scopes /subscriptions/YOUR_SUB_ID
Service Principal · Reader role · Read-only
Inventory is the entry point, not the product. Cirrus traces end-to-end network paths for any VM, simulates NSG traffic decisions rule-by-rule, scores your estate against the Well-Architected Framework's five pillars, audits twelve CIS controls, cross-references Azure Advisor with live Retail prices for right-sizing, and detects drift between snapshots. Inventory is what feeds those tools.
No. Every request the app makes to Azure is a read. Any write attempt is rejected before it leaves the app, and no write client is loaded in the first place.
Encrypted server-side and referenced by a session cookie your browser cannot read. The session expires after 8 hours or when you click Logout.
Nothing about your estate. VM prices are cached briefly to avoid hammering Microsoft's public price API. Drift snapshots live in your own browser and never touch a server.
A Service Principal (one command with the Azure CLI) and a Reader role assignment. No agents, no policies, no workspaces.
VM PAYG / 1-Yr / 3-Yr RI rates come from Microsoft's public Azure Retail Prices API. Disks, IPs, storage, and App Services use conservative fallback rates when usage-based cost can't be inferred from inventory alone.
Yes. Tick the Lighthouse checkbox on the login form. Every subscription your Service Principal can see is listed and marked as either HOME or delegated.
Independent tools for cloud operators. Small, sharp, opinionated.
Inventory, cost intelligence, security posture, and compliance reporting for every subscription in your tenant. All read-only.
Design, diagram, and share cloud architectures visually — a canvas built for the way cloud teams actually think.
cloudcanvas.co