BlueArch.io
BA v0.13.7 · brew installInstall →
Flagship product · AI-nativeFor SREs & solution architects

Alerts that
know your
business.

BlueArch CLI pairs the world's largest AWS misconfiguration database with your business context — revenue tags, customer tiers, regional exposure — so the first alert you see is the one that actually matters. Notes, runbooks, and AI triage, one terminal away.

Install BlueArch →See it in action →
Self-hosted in your AWS account · macOS Apple Silicon · Linux x86_64 · Read-only IAM by default
~/infra · bluearch-aws-opsprod · us-east-1, us-west-2, eu-west-1
$ bluearch-aws-ops scan --services s3 --regions us-east-1BlueArch Scan (bluearch-aws-core)Collecting S3 resources in us-east-1…Scan complete: 81 resources found. $ bluearch-aws-ops recommendationsRecommendations (3)Type Resource Region Rationalepublic access shared-assets us-east-1encryption archive-data us-east-1versioning audit-logs us-east-1
What you get

Built for the on-call engineer who runs everything.

Three things every SRE and solution architect asks for, finally in one tool.

01 · Signal

Business-aware severity

Every finding is paired with your revenue tags, customer tiers, and regional exposure. The CLI sorts by dollars at risk — not by "high / medium / low." Critical means the order pipeline. Low means a dev sandbox.

2,147 rules · Hub-backed →
02 · Triage

AI-native notes & snoozes

Per-finding notes that travel with the engineer, not the resource. Snooze with reason, escalate to JIRA, or ask InfraGPT to draft the remediation PR. State is shared across your team, not stuck in someone's terminal history.

Notes · Snooze · Escalate · Draft PR →
03 · Action

Reversible fixes, suggested

Every finding ships with a tested remediation — Terraform, CDK, or raw AWS CLI. Apply it as a dry-run, review the diff, and ship. No SaaS in the loop; the CLI runs in your VPC and writes to your account.

terraform · cdk · awscli →
71%
Faster mean-time-to-remediate
Median across 84 SRE teams running BlueArch for >90 days.
83%
Findings auto-triaged
By business impact, before a human ever opens the terminal.
24 ×
Spend managed per SRE
Up from baseline 1× — one engineer can now cover 2–4× the footprint.
2147
Rules out of the box
Sourced from the Governance Hub. New rules ship daily.
"

We went from triaging Security Hub findings on Mondays to a 9am Slack digest with three things to fix. BlueArch knows which of our buckets actually serve customer traffic — Security Hub never did.

JM
J. Morales
Staff SRE · Logistics platform · $9M AWS / yr

30-day result

Critical alerts / week
↓ 78%
Time on triage
−9.4 hrs
P1 incidents avoided
3
ARR protected
$1.1M
Install · macOS Apple Silicon · Ops v0.13.7 · Core v0.2.8

Core when needed. One local workflow.

brew list --formula bluearch-aws-core >/dev/null 2>&1 || brew install bluearchio/tap/bluearch-aws-corebrew install bluearchio/tap/bluearch-aws-ops
Launch. Core serves the local Ops dashboard on port 8095.Operate. Start read-only scans and choose services and regions in the browser.Review. Inventory results and scan history stay together in the dashboard.
01

Install Core if missing

brew list --formula bluearch-aws-core >/dev/null 2>&1 || brew install bluearchio/tap/bluearch-aws-coreTypical: 1–3 min

This check does nothing when the Homebrew Core formula is already installed. Otherwise, the fully qualified install trusts only bluearch-aws-core.

02

Install Ops

brew install bluearchio/tap/bluearch-aws-opsTypical: 1–3 min

Installs the signed bluearch-aws-ops binary and trusts only that formula, not the whole tap.

03

Authenticate AWS

aws sso login --profile my-profileexport AWS_PROFILE=my-profileTypical: 1–2 min

Keep using your existing AWS SSO profile. Ops starts read-only and does not deploy infrastructure for a local scan.

04

Launch the live server

bluearch-aws-core start --daemonbluearch-aws-core statusTypical: under 30 sec

Core starts its API on 127.0.0.1:8094 and the installed Ops dashboard on http://127.0.0.1:8095.

05

Open the Ops dashboard

Open Ops dashboard Ready when Core is healthy

Use Resources to start a read-only inventory scan, then inspect resources and scan history without returning to the terminal.

Installing on Linux x86_64?

The release installer verifies the GitHub assets and installs Core automatically when it is missing. Add the install directory to PATH for this shell.

curl -fsSL https://github.com/bluearchio/bluearch-aws-ops/releases/latest/download/install-linux.sh | bashexport PATH="$HOME/.local/bin:$PATH"
Existing tap says a formula is untrusted?

Trust only Core and Ops, then retry. Whole-tap trust and HOMEBREW_NO_REQUIRE_TAP_TRUST are not required.

brew trust --formula bluearchio/tap/bluearch-aws-corebrew trust --formula bluearchio/tap/bluearch-aws-opsbrew install bluearchio/tap/bluearch-aws-ops
FAQ

Common questions.

For deep technical details, see the docs. Or ask InfraGPT.

Does the CLI need access to my AWS account?+
Read-only IAM by default. Remediation actions require explicit per-action approval and a separate write role — you control which actions are pre-authorized vs. require a PR.
Where does the business context come from?+
A YAML file (finops-tags.yml) you keep in your infra repo. It maps AWS tags to revenue, tiers, and ownership. Tag Manager can generate it for you from existing tags.
Does data leave my VPC?+
No. The CLI runs entirely in your environment. The Governance Hub manifest is pulled over HTTPS at startup; everything else stays local. AI features call an LLM endpoint of your choice (Bedrock, Anthropic API, or your own).
How does it compare to Security Hub / Wiz / Prowler?+
Those tools are great at producing findings. BlueArch is built around what to do with findings — business-aware ranking, shared notes, AI-drafted remediation. It happily ingests Security Hub findings as one of its inputs.
Pricing?+
Free for individual SREs (limit: 1 account, 1k resources). Team plan starts at $1,200 / month per AWS organization. See the pricing page.

One brew install from a quieter on-call.

Install in five minutes. Get your first business-aware report on coffee #2.

Book a review →Browse the database →