AWSAzureBetaGCPBetaOne inventory for all three
Google Cloud and Azure are in beta, on request.
Know what you run.Know what needs attention.
See your AWS, Azure and GCP assets in one searchable inventory. Track changes, spot security gaps and uncover wasted spend—with read-only access.
No card needed. Read-only and keyless: we never change your cloud. The demo runs on sample data, nothing to connect. See how it works
| Name | Cloud | Region | Account | Cost, month |
|---|---|---|---|---|
| checkout-api-1 | AWS | eu-north-1 | shop-prod | $182.40 |
| search-indexer | GCP | europe-north1 | search-prod | $241.87 |
| ledger-worker | Azure | westeurope | payments-prod | $96.12 |
| checkout-api-2 | AWS | eu-north-1 | shop-prod | $182.40 |
| batch-runner-7 | AWS | us-east-1 | data-prod | $64.02 |
| vpn-gateway | Azure | northeurope | network-prod | $38.50 |
Who it's for
Built for whoever answers for the cloud
The same inventory, read the way your work needs it.
- Companies running their own cloudPlatform, DevOps and security teams that run their company's cloud and would rather not pay for five tools.
- EnterprisesCloud centers of excellence, platform and FinOps teams with hundreds of accounts, many teams and more than one cloud.
- Managed service providersManaged service providers, consultancies and resellers that run other companies' clouds.
- Security teamsSecurity and compliance teams that need the whole estate, not just the accounts someone enrolled.
- Finance and FinOpsFinOps practitioners, controllers and finance partners who need cloud cost by owner, by month, and explained.
Why AssetHermit
What do we run, where, and what changed since Tuesday?
Each cloud shows its own resources, one account, subscription or project at a time. So the question above takes an afternoon of console tabs, and the answer is out of date by the time you have it.
Forgotten resources turn into cost leaks and security gaps, and each tool that could find them is one more contract, one more set of permissions and one more place to look. AssetHermit gives platform, security and finance teams one place to see everything, what's wrong with it, who changed it and what it costs.
Product
Your whole estate, in one product
Connect your clouds once. AssetHermit keeps the inventory, its history, its findings, its costs and its operations up to date.
- Inventory and searchEvery asset of every cloud in one inventory, searchable in one query language.6 features
- Changes and codeWhat changed, who changed it, and whether it went through your infrastructure code.6 features
- Security findings175 audit rules after every sync, each with the fix, tuned to what matters to you.6 features
- Costs and savingsWhat every account, team and asset costs, what changed, and savings the bill proves.6 features
- Cost for financeCost centers, month close, commitments and unit costs, for the people who book the bill.6 features
- OperationsUptime, provider incidents, usage and logs, read from the clouds you already run.6 features
- AI assistantAsk about your clouds in plain words, in the app, in Slack or in your own AI client.4 features
- Working togetherThe right people told, a shared wiki for what you know, and a setup guide for what's next.6 features
Search and findings
Ask any question of your estate
The same query language drives the search bar, asset groups and the audit rules, so a rule's findings are one click from the inventory.
A question is a query
$ marks the properties every cloud shares. Anything else is a path into the data the cloud returned.
$type:compute.vm $tag:env=prodProduction virtual machines, on every cloud$type:storage.bucket -$tag:ownerBuckets and storage accounts without an owner tag$nativeType:aws/ec2/instance metadataOptions.httpTokens:optionalEC2 instances that still allow IMDSv1$firstSeen:>now-7d order by $firstSeen descEverything new this week, newest first
Rules that run after every sync
A finding stays open until a sync no longer matches it. Each rule's guide says why it matters, when it's fine, and the command that fixes it.
- AWS107 rules
- GCP29 rules
- Azure39 rules
- AWSBucket policy allows public accessCritical
- GCPBigQuery dataset is publicCritical
- AzureNetwork security group opens SSH or RDP to the internetCritical
- AWSAll traffic and ports are open to 0.0.0.0/0High
- GCPCloud SQL instance accepts connections from anywhereCritical
- AzureAI services account accepts API keysHigh
Costs
What it costs, and why it changed
Cost comes from your clouds' own cost exports, normalized to FOCUS and linked to the accounts and assets in your inventory. Group it by service, account, region, tag, asset group or asset.
Savings, priced from your own bill
Unused disks, idle addresses and old snapshots, each with what it cost you over the last 30 days. Never a list price.
How savings work
Anomalies, with where the money went
After every cost sync, each account and service is checked for days well above or below what its own weekly pattern expects. Mark each one expected or not, so others know it's been looked at.
How anomalies are found
For finance: cost centers, month close, commitments, budgets, unit costs and carbon.Cost for finance
Operations
What your clouds already measure, beside what you run
Uptime, provider incidents, usage and logs, read where they are with the same keyless access. No agents to install, nothing copied out of your accounts.
UptimeBeta
Your clouds' own health checks in one place, the public endpoints none watches, and outages with what changed around them.
Read the docsProvider healthBeta
What AWS, Azure and Google Cloud say about your own accounts: incidents, maintenance and actions due.
Read the docsUsage
Idle and oversized resources, unusual usage, and capacity or quotas about to run out.
Read the docsLogsBeta
Where every asset logs, and queries over your logs where they are, with an estimate before each one.
Read the docs
How it works
From sign-up to a searchable inventory
There is nothing to install. You grant read access, and AssetHermit does the collecting.
- 1
Register your organization
Choose your organization ID and where your data lives. Your team signs in at its own address, such as acme.app.assethermit.com.
- 2
Create workspaces
Keep Production, Staging or a subsidiary apart, each with its own clouds, members and data, in its own region.
- 3
Connect your clouds
Add an AWS Organization, GCP organization or Azure tenant, or a single account, and optionally its cost export. We check every permission as you connect.
- 4
Search, fix and follow
AssetHermit syncs on a schedule, or whenever you press Sync now. New accounts in a connected organization are picked up on the next sync.
What we collect
The core resource types of each cloud, mapped to one set of types. Anything we don't map yet is kept too, so you can still find it.
- Virtual machinecompute.vm
- Functioncompute.function
- Container clustercontainer.cluster
- Storage bucketstorage.bucket
- Diskstorage.disk
- Databasedatabase.instance
- Virtual networknetwork.vpc
- Subnetnetwork.subnet
- Load balancernetwork.load-balancer
- Public IPnetwork.public-ip
- Firewall rulesnetwork.firewall
- Identityidentity.principal
- DNS zonedns.zone
- Imagecompute.image
- Scaling groupcompute.scaling-group
- Workflowcompute.workflow
- Servicecontainer.service
- Registrycontainer.registry
- Imagecontainer.image
- Snapshotstorage.snapshot
- Backupstorage.backup
- File systemstorage.file-system
- Cachedatabase.cache
- Warehousedatabase.warehouse
- Queuemessaging.queue
- Topicmessaging.topic
- Streammessaging.stream
- Gatewaynetwork.gateway
- Route tablenetwork.route-table
- Interfacenetwork.interface
- Endpointnetwork.endpoint
- Connectionnetwork.connection
- Cdnnetwork.cdn
- Api gatewaynetwork.api-gateway
- Web firewallnetwork.web-firewall
- Recorddns.record
- Groupidentity.group
- Policyidentity.policy
- Credentialidentity.credential
- Provideridentity.provider
- Keysecurity.key
- Secretsecurity.secret
- Certificatesecurity.certificate
- Log groupmonitoring.log-group
- Alarmmonitoring.alarm
- Trailmonitoring.trail
- Repositorydevops.repository
- Pipelinedevops.pipeline
- Stackmanagement.stack
- AI modelai.model
- AI endpointai.endpoint
- AI agentai.agent
- AI guardrailai.guardrail
- Knowledge baseai.knowledge-base
- Notebookai.notebook
- AI studioai.studio
Security
The hermit only observes
AssetHermit is built to see your clouds, not to touch them.
Read-only
AssetHermit never creates, changes, tags or deletes anything in your cloud.
No keys to hand over
A role, a workload identity grant or a managed identity per connection. We store no secrets of yours.
Isolated and encrypted
Your organization's own sign-in, services, tables and keys, and each workspace's again.
In your region
Your data stays in the region you choose, and staff read it only with your grant.
Take stock of your cloud
Start a 14-day free trial, no card needed. Connect a first cloud and see everything you run in one place.