New Savings Proposals: approve, test and roll back cost changesLearn more Sign in|Talk to a cloud engineer

QarbixCloudLens

Product tour Get a demo

Act where your team already works

CloudLens reads AWS, Azure and Kubernetes with read-only access, and your code in GitHub, GitLab, Bitbucket and Azure DevOps — Jenkinsfiles included. It sends the work to Jira, Slack, Microsoft Teams and email. People sign in through your SAML identity provider.

Get a demo Security & trust

What you're watchinglive product

1
Work goes out to Jira and Slack
FINOPS-218 is created in Jira and a cost anomaly alert is sent to Slack, both from the same CloudLens organization.
2
Sign-in and cloud access check in
An employee signs in through Okta SSO, and AWS reports the read-only role as validated.
3
Teams and Macie follow
A recommendation is posted to Microsoft Teams, and Amazon Macie results classify a data store as holding PII.

Who does thisAdmin who connects each integration in Settings, and the teams who receive the workWhat you getTickets, alerts, sign-in and cloud access all run through connections an admin set up and tested once.

Built into CloudLens, with nothing extra to buy

AWS Microsoft Azure Kubernetes Jira Slack Microsoft Teams Okta Microsoft Entra ID Google Workspace Amazon Macie GitHub GitLab Bitbucket Azure DevOps Jenkins

Every integration, in one place

Filter by what you want to connect. Each one is configured by an admin in Settings, with a test before it goes live.

Jira

Create issues and epic bundles from recommendations, EOL and Atlas findings. Status synced both ways.

Slack

Cost anomaly alerts for medium and high severity, and recommendations posted to a channel.

Microsoft Teams

Post recommendations to any channel through an incoming webhook.

Okta

SAML 2.0 single sign-on with email-domain discovery and admin group mapping.

Microsoft Entra ID

SAML 2.0 SSO from a metadata URL, pasted XML or manual fields.

Google Workspace

SAML 2.0 SSO with a Test SSO Login before you save.

AWS

Read-only IAM role via CloudFormation, or a StackSet across your whole Organization.

Microsoft Azure

Admin consent, service principal, reader roles and Cost Management exports.

Kubernetes

EKS clusters through an access entry — pods, workloads and CIS Kubernetes checks.

GitHub

Read-only GitHub App: secrets in code and history, SAST, dependencies, IaC, Actions, and pull request checks.

GitLab

Group token with read scopes, gitlab.com or self-managed. Every project, .gitlab-ci.yml and on-demand MR scans.

Bitbucket

Bitbucket Cloud access tokens. Repositories, Pipelines and every pull request via a signed webhook.

Azure DevOps

A Code (Read) PAT. Azure Repos, azure-pipelines.yml and pull requests via a service hook.

Jenkins

Jenkinsfile analysis in your connected repositories — keys, roles and risky steps. Nothing installed on Jenkins.

Amazon Macie

Sensitive-data findings joined to the security graph for PII, PCI and PHI.

Email

Anomaly, budget, proposal and schedule alerts, plus the weekly cost report.

Approvals in Slack & Teams

Approve savings proposals and schedules without leaving chat.

Configured once, tested before use

Set up by an admin

Webhooks, the Jira service account and SSO are configured in Settings by an admin, so nobody connects a personal token.

Tested before saving

Test connection for Jira, a test message for Slack and Teams, and Test SSO Login for SAML. You see each one work first.

Credentials handled carefully

Jira API tokens are stored encrypted. Cloud access uses a read-only role or a reader service principal, never keys pasted into a form.

Integration FAQ

Not yet. Approvals happen in CloudLens and the approver is notified by email. Approving from chat is in early access through Atlas Labs.

No. CloudLens reads Jira's live status and shows it next to its own. If they disagree, the row is flagged so someone can reconcile it.

Cost anomaly alerts for medium and high severity, plus any recommendation someone chooses to post to a channel.

GitHub (read-only App), GitLab (gitlab.com and self-managed), Bitbucket Cloud and Azure DevOps Services. Jenkins pipelines are judged from the Jenkinsfile in those repositories — nothing is installed on Jenkins.

No. AWS uses a read-only IAM role (CloudFormation or StackSet), Azure uses a service principal with reader roles, and EKS uses an access entry.

Ready to see CloudLens in action?

Connect a read-only AWS role or Azure service principal. We'll walk you through your bill, your security graph and the first things worth fixing.