01
The console is a tour, not a map.
Every team runs their own homegrown spreadsheet of accounts, owners, and "who knows about that Lambda." Tags rot. Inventory drifts. The org chart of your AWS doesn't exist anywhere durable.
The state of running AWS
AWS gave you 200 services.
It didn't give you a control plane.
02
Findings live in five tools that don't agree.
Security Hub, Cost Explorer, Trusted Advisor, Config, your own runbooks. None of them know about each other. By the time signal reaches an engineer, the context is gone.
03
Automation feels too risky to attempt.
Without a read-only baseline, an audit trail, and a rollback story, every “fix this” is a Jira ticket nine months long. You don't write the playbook because nobody trusts the playbook.
The platform
One surface. Four jobs.
Built for the engineers who actually run it.
Trueno is organized around the work — not around AWS services. You observe what you have, analyze what it's costing and risking, run scheduled jobs that close the loop, and bring the right people in when judgment is required.
01OBSERVE
Every account, every region, one inventory.
Trueno discovers every AWS resource you have — across accounts and regions — and keeps it current with scheduled and on-demand scans. Stale-state detection catches what disappears between runs.
- Multi-account, multi-region discovery via AssumeRole
- EC2, EBS, S3, RDS, Lambda, security groups
- Per-resource metadata, tags, and freshness signals
- Stale-state detection when resources disappear between scans
02ANALYZE
Resource and cost intelligence, in the same pane.
Cost broken down by service, account, and tag — with findings linked back to the specific resource that drives them. Daily snapshots feed trend windows and anomaly detection.
- Cost grouped by service, account, and tag
- Estimated monthly savings on every cost-tagged finding
- Daily cost / findings / resource snapshots
- Anomaly detection across 7 / 30 / 90-day windows
03AUTOMATE
Scheduled jobs you can audit, not magic you can't.
Recurring inventory, cost, and recommendation jobs run on a schedule per account. Failures retry with bounded attempts. Every action lands in the workspace activity feed with actor, scope, and outcome.
- Schedules per account and job type
- Bounded retries on transient failure
- Default schedules provisioned on first AWS account
- Activity feed records every scheduled run
04COLLABORATE
Operational trust is a team sport.
Findings get owners, status, and deadlines. Comments thread against the actual resource or finding — not a screenshot in Slack. The workspace-wide activity feed makes "who owned this" answerable in a query.
- Assign findings, recommendations, and resources to teammates
- Threaded comments scoped to resources, findings, recommendations
- Saved views per entity type, private or shared
- Workspace-wide activity feed with actor, target, and outcome
Security & Architecture
Read-only by default. Every AWS call originates server-side.
Trueno never asks for AWS access keys, never runs an agent in your VPC, and never copies your application data. Security is not a tab on the website — it's how the product is shaped.
Read-only AWS access
Trueno authenticates via AssumeRole with an external ID. AWS-managed read-only policies attached. No write API is ever called. Delete the IAM role to revoke access entirely.
No long-lived credentials
Every scan assumes a role with short-lived STS credentials. Cross-account access stays in your IAM, your policy, your revocation path.
No agents, no VPC peering
Trueno connects through the AWS APIs from a server-side control plane. Nothing to install in your environment, nothing to patch.
Findings persist; raw data does not
We store findings, resource snapshots, and recommendations in your workspace. We don't read S3 object contents, RDS row contents, or application data.
Workspace-isolated data
Row-level security on every workspace table. A workspace can only see its own data — enforced in the database, not the app.
Activity feed records every action
Status changes, comments, assignments, schedule edits — every mutation lands in the workspace activity feed with actor, target, and outcome.
Resources
Operator-grade documentation.
DOCS
Getting started
Connect AWS, run a scan, review findings — the in-app onboarding flow walks every step with workspace-specific values.
8 steps · in-app guided
ARCHITECTURE
How Trueno is built
Next.js, Supabase, the AWS SDK pattern, the async job queue, Vercel Cron — every layer maps to a real file in the repo.
platform tour
SECURITY
Access model & limits
AWS access flow, workspace isolation, revocation, and the things we have explicitly NOT done yet.
honest scope · no fake certs
CHANGELOG
What's shipped
Past-tense entries only. Phase 13 onwards. Dated to the commit that landed each phase.
6 entries · newest first
Connect in the dashboard
One workspace, one role, about three minutes.
The in-app onboarding generates your workspace's external ID, lists the AWS-managed read-only policies to attach, and verifies the trust relationship before the first scan runs.
Request early access →1
Create workspace
Sign up. First workspace is created automatically.
2
Generate external ID
In the dashboard, start the AWS connect flow.
3
Create the read-only role
Trueno shows you the trust policy + the AWS-managed read-only policies to attach in your AWS console.
4
Verify + scan
Trueno calls sts:AssumeRole; first inventory scan runs in the background.
Connect AWS
Connect your first account.
See your AWS in about four minutes.
Read-only IAM role. No long-lived keys. Delete the role at any time to revoke access. Trueno is in early access — no card, no sales meeting, no demo gating.
Early accessRead-only by designExternal-ID gatedWorkspace-isolated data