Foundry.
Features: governance

Gates in front of every change.

Knowing what is wrong is half of it. Foundry also decides what may change, how far a change reaches, and who has to say yes.

Taxonomy

Tags, policy, and chargeback

Define the tag keys an organization uses, the rules about them, and which resource types must carry which tags. Foundry then shows what breaks the rules.

  • A taxonomy of keys, rules, and per-type requirements
  • Untagged resources, and resources with an expiry
  • Enforcement policies and the resources that violate them
  • Cost grouped by taxonomy key, and a chargeback report in a chosen mode
Safety

Pre-flight gates

  1. Validate

    The governance validator checks a stack against policy before a plan can run.

  2. Blast radius

    Foundry inverts the organization's dependency graph and scores every resource that depends on what is changing, by reference, security group, subnet, or KMS key. With the gate on, a high-risk apply waits until an operator dismisses the report.

  3. CIDR authority

    With the gate on, a VPC or subnet create that overlaps an allocated CIDR is blocked. An administrator can override it with an audited flag.

Both gates are configuration switches.

Self-healing, with limits

Remediation

A remediation policy binds a trigger (an advisor check, a compliance rule, drift, or a spend threshold) to a corrective stack patch. The patch runs through the same planner, applier, and gates as any other change. Only a curated safe list applies automatically; everything else opens an approval card in Docket. The sweep that re-evaluates policies is a scheduled automation, not a loop inside the API.

Least privilege

Access graph

The access graph joins IAM entitlements with what CloudTrail shows was used to find unused permissions and security group rules, and produces tightened policies as stack patches an administrator can apply.

Screens

On screen

Captures of the running console with fictional StrataForge Robotics data. No real AWS account or cost appears.

The taxonomy editor: tag keys with required flags and allowed values, and the enforcement rules below them.The taxonomy editor: tag keys with required flags and allowed values, and the enforcement rules below them.
Taxonomy: the tag keys and rules an organization sets.
The remediation page: executions awaiting approval or already succeeded, each tied to the advisor check that triggered it.The remediation page: executions awaiting approval or already succeeded, each tied to the advisor check that triggered it.
Remediation: what is waiting on approval, and what ran.
The access graph: IAM roles listed with the count of permissions each has never used.The access graph: IAM roles listed with the count of permissions each has never used.
Access graph: roles and their unused permissions.
The CIDR planner checking a block against the allocation ledger, showing seven conflicts and suggested non-overlapping blocks below.The CIDR planner checking a block against the allocation ledger, showing seven conflicts and suggested non-overlapping blocks below.
The CIDR planner: conflicts found, and blocks that fit.

← Back to features

Contact

Questions about this tool?

Write to Renkara Media Group and a person will answer.

Email contact@renkara.com