Stop AWS misconfigurations before attackers find them first
AWS's breadth — 200+ services across global regions — creates a sprawling attack surface that traditional tools cannot keep pace with. Onam continuously monitors every IAM policy, S3 bucket, security group, and Lambda configuration across all your AWS accounts with 800+ purpose-built rules.
One platform on AWS
Connect AWS once. Onam Security is covered in detail below; the rest of the platform works from the same discovery.
Every AWS resource Onam discovers lands in one inventory, with provider, region, account, state and last-seen time, through the same read-only access. Every discovery run is recorded with its trigger and status. The per-account architecture view draws each AWS account's topology: what it holds and how it connects.
Posture, identity, attack paths, workloads and compliance for AWS. The detail is on the rest of this page.
Onam FinOps works on reconciled billing data: billed and effective cost, ownership, forecast, budgets, anomalies and savings. It holds read-only billing access and changes nothing in your accounts. Ask us which AWS billing data applies to your accounts.
Onam DRM works from the same inventory: it proposes applications from your tags, reads backup, snapshot and replication from cloud configuration, and predicts RTO and RPO against your targets. It plans and records — it does not run a failover or a DR test. Ask us about DRM coverage for AWS.
Onam AIOps
Early accessAI agents investigate your Onam Security inventory and findings and propose changes a person approves. Executing a change in your AWS account is built but not offered — it is on the roadmap.
Services we monitor on AWS
Every service below is scanned continuously — no agents, no network changes, read-only.
Plus: CloudFormation, CodeBuild, CodePipeline, SageMaker, Bedrock, Elastic Beanstalk, Inspector, Macie, and more.
Compliance frameworks
Onam maps every AWS finding to the frameworks your auditors care about.
Connect in 3 steps
From consent to your first findings, with no agents to install for posture scanning.
Create a read-only IAM role
Use our CloudFormation template — one click, read-only, no destructive permissions. The role trusts Onam's AWS account with an external ID unique to your tenant.
Paste the Role ARN into Onam
Multi-account organizations connect in a single step via AWS Organizations: deploy a StackSet from the management account and every member account is onboarded automatically.
Findings from the first scan
Onam assumes the role via STS and scans all in-scope regions. Findings arrive prioritized, mapped to CIS/NIST/PCI, and ready to route to your ticketing system.
AWS in the Onam Security console.
A recreation of the Onam console with sample data: connect, inventory and posture in one view.
What makes Onam different on AWS
Organizations-aware multi-account scanning
Onboard the AWS Organization once and every member account — current and future — is scanned automatically. SCPs, delegated admins, and OU structure are respected as first-class data.
IAM effective-permission graph
Onam resolves Service Control Policies, permission boundaries, identity policies, and resource policies into a single effective-access graph. See what a principal can actually do — not just what a policy says.
S3 public-exposure chain analysis
Every bucket is evaluated end-to-end: bucket policy, ACL, Block Public Access settings, and CloudFront origin. If any hop makes it reachable from the internet, Onam flags the full chain — not just the bucket.
Questions we get a lot
AWS security — related reading
How the engines behind AWS coverage work, and what the categories actually mean.
EC2, EKS, ECS and Lambda workloads, scanned without agents.
Cloud security posture management explained — what it catches, and what it cannot.
Why a list of findings is not a priority, and how chains reach crown jewels.
Attack paths and choke points computed across your whole estate.
Effective permissions after role chains, SCPs and permission boundaries.
CIS, NIST, ISO 27001, PCI-DSS and more, scored continuously.
Snapshot-based workload scanning that runs inside your own account.
See Onam on your AWS environment
Connect once with read-only access. Every Onam product you use works from the same discovery, so your accounts are connected once.