Cloud posture tools
Overview
These tools answer "how are we doing?" questions about the cloud resources in your organization's posture dataset. Cloud-provider filters accept AWS, Azure and GCP; the results depend on which resources have been discovered and ingested. Each resource carries:
- An IaC status. Managed resources are under IaC, unmanaged ones aren't, and drifted ones are managed but have changed outside IaC.
- A misconfiguration count. The number of compliance findings raised against the resource.
- Its location. Cloud, account, region, service and resource type.
All three tools are read-only and cover only your organization's resources. If your access comes from a custom role, you see only the resources from connectors your role can access.
get_posture_summary
Returns the headline numbers for your organization:
- total resources
- how many are managed, unmanaged and drifted
- how many resources have at least one misconfiguration
- the total number of misconfigurations
Assistants usually start here for broad questions, then drill down with the other tools.
Example prompts
"Give me a posture summary for our cloud accounts."
"What share of our resources is managed by IaC?"
get_resource_breakdown
Groups your resources into buckets and returns the resource count and total misconfigurations for each bucket, largest first.
| Input | Description |
|---|---|
| Group by (required) | What to group by: resource type, friendly resource type, IaC status, region, account, cloud provider, IaC source, or service. |
| Number of buckets | How many buckets to return. Default 10, maximum 100. |
| Cloud provider | Only include aws, azure or gcp resources. |
| IaC status | Only include managed, unmanaged or drifted (sg_drifted) resources. |
Example prompts
"Which AWS regions have the most unmanaged resources?"
"Break down our drifted resources by service."
get_top_misconfigurations
Lists the individual resources with the most misconfigurations, highest first.
| Input | Description |
|---|---|
| Number of resources | How many to return. Default 10, maximum 100. |
| Cloud provider | Only include aws, azure or gcp resources. |
| Resource type | A Terraform-style type, such as aws_s3_bucket. |
| Region | A cloud region, such as eu-central-1. |
Example prompts
"Which of our S3 buckets have the most misconfigurations?"
"Show the 20 worst-configured resources in eu-central-1."