A read-only assistant for AWS and the wider cloud.
plainfra connects to your AWS accounts through a read-only IAM role and answers plain-English questions about cost, security, reliability and recent changes. Every week it sends a cloud health report that shows what changed since the last one.
I built plainfra for small teams that run production on AWS without a dedicated operations function. It is a product in its own right, at plainfra.com, and it is also how I assess and report on client environments.
What plainfra does
plainfra reads the configuration, metrics, logs and billing data your cloud already exposes, and explains what is happening in plain English, with resource IDs, dollar amounts and a suggested next action.
- Connects to AWS through a read-only IAM role deployed from a CloudFormation template. No agents.
- Connects to Sumo Logic, Datadog and other cloud services through MCP Hub.
- Answers questions such as "why did our bill go up?", "are any buckets public?" and "what changed since last week?".
- Produces a weekly cloud health report, delivered as a PDF, that compares against the previous week.
The AWS role is read-only, with explicit denials for data contents: S3 objects, database rows and Secrets Manager values are off limits. plainfra cannot start, stop, modify or deploy anything, and you can remove the role yourself from CloudFormation at any time. The details are on the plainfra security page.
What it looks at
Cost
Week-on-week changes with the resource that caused them, idle load balancers, detached volumes, unused IPs, over-provisioned instances and missing cost tags.
Security
Public buckets, permissive security groups, missing MFA on root, expiring certificates and the other findings that turn into incidents if nobody is watching.
Reliability
Single-AZ databases, missing backups, growing dead-letter queues, auto-scaling groups without health checks and CloudWatch alarms that should exist but do not.
Recent changes
What changed since the last report, what was resolved, and what has drifted, so the weekly review starts from facts rather than memory.
Lifecycle and end of support
RDS and Aurora engine versions nearing end of life, EKS versions leaving standard support, Lambda runtimes due for deprecation and certificates up for renewal.
Beyond AWS
Through MCP Hub, plainfra can draw on Sumo Logic, Datadog and other connected services, so a question about an incident can be answered across logs, metrics and configuration together.
How plainfra fits into my engagements
In a technology leadership engagement, plainfra is the assessment and reporting layer. It gives us a baseline in the first week and a consistent weekly view after that.
- Onboarding: deploy the read-only role, connect any logging or monitoring services, and run the first scan.
- Baseline: establish the current state of cost, security, reliability and lifecycle risk.
- Cadence: the weekly report becomes a standing item for platform and leadership reviews.
- Action: I turn the findings into a 3 to 6 month roadmap and own the execution.
plainfra is a self-service product with a free trial and monthly plans. Teams can connect an account and start asking questions without an engagement. The engagement adds the person who is accountable for acting on what plainfra finds.
See plainfra
The quickest way to judge it is a 15-minute demo against a live, read-only environment. You can also read a sample report, or start a trial on your own account.
A good first question for a demo is simply:
"If plainfra had read-only access to our AWS for a week, what do you expect it would tell us, and what are you hoping it would not?"
That usually opens up exactly the right discussion. If the engagement side is what you are after, contact me directly.