RemediGitHub

Recorded replay. This replays a real Remedi run against a simulated AWS account: no credentials, no live AWS calls, no LLM cost per click. The agents, prompts and approval gate are the real ones; the AWS responses come from a fake account. Run it live yourself.

Watch Remedi secure an AWS account

Most security scanners hand you a long list of problems and stop there. Remedi finds the problems, asks you before it touches anything, fixes them, and then proves the fixes actually held.

About 30 seconds. No signup, no AWS keys.

The scenario

A small company's AWS account, with eight things wrong

On the surface the account looks fine. In reality there is one planted problem in each of the eight services Remedi checks. It is a simulated account, built to be broken:

  • 🔑An intern account (dev-intern) has full AdministratorAccess
  • 🪣A log bucket has no public-access block and a public policy
  • 🌐A network has flow logging switched off
  • 🔒A security group leaves SSH open to the whole internet
  • 💻A server still allows IMDSv1 and has an unencrypted disk
  • 🗄️A database is reachable from the public internet
  • ⚡A Lambda function runs with admin rights
  • 📋CloudTrail is switched off, so nothing is being logged

There is also an admin user, demo-admin, on the owner's protected list. Protected users are never touched, whatever the agents think of them.

What Remedi does about it

  1. 1

    Scan

    Eight specialist AI agents, one per AWS service, audit the account in parallel. Their tools are read-only.

  2. 2

    Report

    The findings are merged into one plan, and every problem is matched to the exact fix for it.

  3. 3

    Approve

    The pipeline stops. Nothing is changed until a human says yes. This gate is enforced in code.

  4. 4

    Fix

    Approved fixes run in parallel, and every action is logged with its outcome.

  5. 5

    Verify

    A second pass re-audits only the fixed resources. It does not trust the fix report.