A daily AI brief on your AWS account, with cross-signal root-cause traces.

A SaaS that holds other companies’ AWS credentials is a credential aggregator with a target on its back. Application-level encryption (the backend wraps and unwraps in Python) means a single SSRF or memory-dump bug exposes plaintext. Disk-level encryption (the EBS volume is encrypted) means anyone with database access reads cleartext.

Cloudbrief stores the customer’s AWS access key and secret as bytea columns encrypted with pgcrypto symmetric encryption. The encryption key lives in AWS SSM SecureString and rotates independently of the application. A read-only SELECT against aws_accounts returns ciphertext; the only path to plaintext is through a database function the API uses with the runtime key. A leak of the database without the SSM key is useless; a leak of the SSM key without the database is useless. The dangerous path requires both.

The bar for a customer to try Cloudbrief is: paste an external ID, paste a role ARN, hit verify. The role policy is published — Cost Explorer read, CloudWatch metric/logs read, RDS Performance Insights read, Lambda read, S3 list/get-bucket-policy, IAM list (no write anywhere). Customers can review the policy line by line before they create the role. Verification runs sts:AssumeRole end-to-end and refuses to save the connection if a single permission is missing.

The pattern matters because it sets the trust ceiling honestly. Cloudbrief cannot modify anything in a customer’s account — not a tag, not an alarm, not a parameter. Operators sleep better knowing the product is structurally incapable of writing.

The temptation in an AI product is to hand the LLM the raw metrics and a prompt that ends “find anomalies.” That product silently hallucinates within a week — a percentage point off, a wrong service named, a confident sentence that contradicts the data. The downstream cost of a wrong finding is high (an engineer pages, a finance partner re-runs the math) so the bar for correctness is high.

Cloudbrief inverts the order. Deterministic Python detectors (cost-spike, RDS slow-query, HTTP error-budget, Lambda throttle, S3 unusual-egress) run against scoped metric pulls and emit candidate signals with explicit thresholds and citations. Only when two or more detectors agree on a window does Claude get called — and even then, Claude’s prompt includes the raw signal payloads and is told to summarize, not infer. Every emitted finding includes a metric trail; the user can click a number and land on the underlying datapoint. Hallucination has nowhere to hide.

An early-stage AI product that consumes Anthropic and OpenAI tokens is paying for the LLM. The infra around it should not also be expensive. Cloudbrief and Paperbrief share one Lightsail box in Mumbai (medium tier, 4 GB RAM, $24/mo), one PostgreSQL 16 instance, one nginx, one set of systemd units. Static frontends live on Cloudflare. The TLS path is Cloudflare Origin CA — 15-year certs, zero certbot rotation.

What makes the single-box shape safe is full Infrastructure-as-Code. OpenTofu manages the Lightsail instance, static IP, IAM users, S3 buckets, SES domains, SSM parameters, CloudWatch alarms, SNS topic, and the Cloudflare zones / DNS / Origin CA. Disaster recovery is tofu apply + an Ansible play + a Postgres restore from S3 — measured target is 30 minutes. The architecture refuses the false choice between “cheap and fragile” or “robust and expensive.”

Every detector run, every finding read, every credential rotation writes a row to an immutable access-audit table. The table has a trigger that rejects updates and deletes — once a row lands, it stays. The audit row carries the org_id, the user_id, the action, the resource accessed, and the request fingerprint. When a customer asks “who looked at our findings on Tuesday,” the answer is a SQL query, not a log-search through CloudWatch.

The same org_id is the primary tenant key on every domain table — accounts, findings, runs, settings. Row-level security policies on the PostgreSQL side make WHERE org_id = current_org() implicit; an endpoint that forgets to filter returns zero rows rather than another org’s. The dangerous path requires intent.