Know why AWS broke.Fix it before the next alert.
Sandingzone builds AI tools for AWS operations teams. Rosud finds the root cause of every alert. CloudScry runs your AWS foundation, from accounts and access to cost, in one tree.
- No infrastructure changes from our roles
- Runs in your AWS account
- Changes only through your PRs
- 1Firewall rule change blocked egress to the payment gatewayDrops to 203.0.113.0/24 began 2 min after rule group v41
- 2NAT gateway in ap-northeast-2a hit connection limitErrorPortAllocation rising on nat-0a1c…
- 3Upstream latency from a third-party APINo matching change in flow volume
Illustrative example of a Rosud analysis
Products
Two tools, one data layer
Both products install in your own AWS account. Rosud reads your stack through a read-only role; CloudScry’s role can’t change your infrastructure. Rosud answers “why did this break?” CloudScry answers “what is this costing us, and what should we change?”
Rosud
Coming to AWS MarketplaceAI root cause analysis for AWS
Every alert gets a short list of likely causes, the evidence behind each one, and what to check first. Rosud runs inside your AWS account and reads your stack through a read-only role.
Explore Rosud- Automatic analysis when a CloudWatch or Datadog alert fires
- Ranked causes with log and config evidence, not a guess
- Results in Slack or any webhook, with a link to the full investigation
- Operators confirm the real cause, so analysis improves over time
Rosud · AI root cause analysis
From alert to likely cause, with the evidence
Most of an incident is spent switching between consoles to work out what changed. Rosud does that walk for you and hands back the answer with its evidence.
01
Connect with one template
Deploy Rosud in your account from AWS Marketplace, then add a read-only IAM role per account with the CloudFormation template it generates. External ID is required, keys are never stored.
02
Every alert is analyzed
When an alarm fires, Rosud walks a graph of your infrastructure and recent changes, then ranks the likely causes with the logs and config that support each one.
03
Your team confirms the cause
The result lands in Slack or a webhook. An operator confirms the real cause in one click, which is how Rosud learns your environment.
Runs in your account
Deployed on ECS Fargate in your VPC with encrypted storage and no public IP. Your logs stay where they are.
Read-only by design
Only describe, list and log-read permissions. Rosud never changes your infrastructure.
A map of your stack
An ontology of accounts, VPCs, routes, firewalls and services links each alert to what could have caused it.
Evidence, not a guess
Each cause comes with the specific log lines and config diffs behind it, plus the order to check them in.
Finds the gaps first
On connect, Rosud lists missing permissions and log sources that are off, such as WAF logging or flow logs not yet attached.
Model inside AWS
The Marketplace edition uses Amazon Bedrock, so analysis stays inside AWS.
Where Rosud looks
- CloudWatch alarms
- VPC Flow Logs
- Network Firewall
- AWS WAF
- CloudTrail
- AWS Config
- AWS Health
- Datadog
CloudScry
Landing zone as code. Access as a tree. Cost on the first screen.
CloudScry runs AWS foundations for teams without a platform team, for companies with 10 to 200 AWS accounts. It works with AWS Control Tower, or without it. You keep the write access.
First numbers in about 30 minutes (estimated)
Launch one instance from AWS Marketplace, open it by IP and attach the CloudScry role. Team cost and network leaks come first.
Nothing comes to us.
The only outbound calls are the update check and connections you turn on, such as Slack, GitHub or your AI tool.
Ask from the tools you already use
Claude, ChatGPT, Cursor or Visual Studio Code. AI finds it, a person approves, your broker applies it.
$0.136 per hour on AWS Marketplace, about $99 a month (estimated). AI connector included.
Security
Built to pass your security review
Operations tools see a lot of your infrastructure. Ours are designed so the answer to “what can it change?” is nothing.
No infrastructure changes
Rosud reads through a role that can only describe, list and read logs. CloudScry's role can't change your infrastructure; its only non-read permissions are listed in its exceptions table.
Changes through your review
Fixes arrive as Terraform changes or pull requests. If you want CloudScry to apply changes, it goes through open-source broker stacks you deploy, with allow lists and approvals.
Your data stays put
Rosud and CloudScry both install inside your AWS account. Collection, analysis and AI calls through your Bedrock stay there.
Scoped, auditable roles
Roles require an External ID, S3 access is limited to the log buckets you connect, and every connection is logged.
Contact
See it on your own AWS accounts
We are onboarding early customers for Rosud and CloudScry. Tell us how many AWS accounts you run and what slows your team down, and we will set up a pilot.
Headquarters
131 Continental Dr, Suite 305Newark, DE 19713United States
Incorporation
Sandingzone, Inc.Delaware CorporationFounded January 8, 2025
Registered Agent
Legalinc CorporateServices Inc.Newark, DE, USA