Audit Kubernetes, Terraform and CI/CD across AWS, Azure or Google Cloud. Get prioritized risks, real impact and concrete fixes in minutes.
Overall score
The native engine works automatically with Trivy and KubeLinter to uncover insecure configuration, exposed secrets, known vulnerabilities and Kubernetes-specific risks.
Security, reliability, operations and FinOps.
Cloud Health Check, Trivy and KubeLinter in one workflow.
Trivy checks dependencies and images against its vulnerability database.
Your code and evidence remain on your machine.
Infrastructure, containers and automation in one review.
Docker
Kubernetes
Terraform
GitHub Actions
AWS
Microsoft Azure
Google CloudAmazon EKSAzure AKSGoogle GKEExplore every column, inspect exact paths and lines, and navigate between findings pages.
The demo restarts automatically. Hover over it to pause and inspect.
The CLI scans your repository locally and only produces sanitized results. No IAM permissions, no agents inside your cluster and no source uploads.
$ cloud-health-check scan .
Discovering infrastructure...
✓ Kubernetes manifests 47 files
✓ Terraform modules 12 modules
✓ CI/CD workflows 8 workflows
Applying 66+ security, reliability, operations & FinOps controls...
✓ Report ready 53/100
One command inside your repository.
Deduplicated, prioritized findings.
Fix issues with an actionable plan.
We connect every technical issue to its impact and the action that should come next.
Detect privileged workloads, exposed secrets, excessive RBAC, weak identities and software supply-chain risks.
Review replicas, probes, updates, workload distribution, backups and disruption tolerance.
Find unbounded resources, wasted capacity and configurations that increase your cloud bill.
Assess observability, deployment safety, Terraform state and incident readiness.
Cloud Health Check scans the change inside the runner, points to the exact file and line and enforces the team's policy before merge.
Findings placed directly on the pull request file and line.
Choose whether Critical, High or Medium findings stop delivery.
Job summary, PR comment and HTML, JSON and SARIF artifacts.
The repository is never sent to Cloud Health Check; only the licence is validated.
resource "azurerm_kubernetes_cluster" "prod" {
name = "production"
private_cluster_enabled = false
}Use private access or restrict CIDRs, firewall rules and authentication.
Choose your operating system. The ZIP includes Cloud Health Check, Trivy and KubeLinter; no registration or cloud credentials required. The macOS builds are Apple-signed and notarized, and the Windows executable is digitally signed.
The ZIP includes the free scan plus Trivy and KubeLinter. A Professional license unlocks the complete report.
Open a terminal, navigate to the extracted ZIP and run the commands for your operating system. You do not need to bypass security controls or approve the application manually.
cd ~/Downloads
mkdir -p cloud-health-check-macos-arm64
unzip cloud-health-check-macos-arm64.zip -d cloud-health-check-macos-arm64
cd cloud-health-check-macos-arm64
./cloud-health-check-macos-arm64 scan /path/to/repositoryThe Apple Silicon build is Developer ID signed and notarized by Apple. It runs directly without xattr or changes to system security permissions.
cd ~/Downloads
mkdir -p cloud-health-check-macos-x64
unzip cloud-health-check-macos-x64.zip -d cloud-health-check-macos-x64
cd cloud-health-check-macos-x64
./cloud-health-check-macos-x64 scan /path/to/repositoryThe Intel build is also Apple-signed and notarized, so no security exception is required.
cd $HOME\Downloads
Expand-Archive .\cloud-health-check-windows-x64.zip -DestinationPath .\cloud-health-check-windows-x64 -Force
cd .\cloud-health-check-windows-x64
.\cloud-health-check-windows-x64.exe scan C:\path\to\repositoryThe executable is digitally signed through Microsoft Artifact Signing, and its Authenticode signature is verified before every release is published.
cd ~/Downloads
mkdir -p cloud-health-check-linux-x64
unzip cloud-health-check-linux-x64.zip -d cloud-health-check-linux-x64
cd cloud-health-check-linux-x64
chmod +x cloud-health-check-linux-x64
./cloud-health-check-linux-x64 scan /path/to/repository--lang en or --lang es. Without it, the CLI automatically detects your system language.cloud-health-check activate CHC-XXXXX-XXXXX-XXXXX-XXXXXA tool should not give you 300 alerts. It should tell you which 10 decisions will materially change your platform risk.
That principle shapes every report.
Check your overall posture before committing.
The complete report with clear priorities and fixes.
Human validation and decisions tailored to your platform.
An automatic pull-request health gate for the whole team.
Unlimited coverage and guided adoption for organisations with large repository estates.
By continuing to payment you accept our terms and conditions and confirm that you have read our privacy policy. Professional and Continuous are delivered digitally after payment, last 12 months and do not renew automatically. Expert Review can be refunded up to 48 hours before the session and rescheduled once at no cost with 24 hours’ notice.
Continuous includes 12 months of access for up to 100 repositories. Continuous Enterprise provides unlimited repositories through a custom proposal. Both include unlimited runs.
No. The initial scan runs locally. The professional report only uses sanitized findings and never requires the full repository contents.
Not for repository analysis. Future direct connections will remain optional and strictly read-only.
Yes. Common controls work with standard Kubernetes, alongside provider-specific modules for EKS, AKS and GKE.
No. It helps detect and prioritize configuration risk. For regulated environments, combine it with human review and organizational controls.
You choose the threshold: Critical, High, Medium or informative-only. To prevent merging, configure the cloud-health-check status as required in the branch ruleset.
The first edition is open to teams that want to evaluate their platform and help us refine the report.