New Savings Proposals: approve, test and roll back cost changesLearn more Sign in|Talk to a cloud engineer
Product tourGet a demo

How CloudLens protects your cloud and your data

CloudLens reads your cloud with a read-only role, signs people in through your identity provider, and only sends data to an AI model after an admin turns Copilot on. Resources change only when someone approves the change.

Talk to a cloud engineerCloud connections
What you're watching
  1. 1
    Work email finds the provider

    Ana types ana@lumoraretail.com. CloudLens recognizes the domain and replaces the password field with Continue with Okta SSO.

  2. 2
    Okta signs her in

    She is redirected to Okta and CloudLens verifies the signed SAML assertion. Her password stays with Okta.

  3. 3
    Settings are tested before saving

    In Settings, an admin configures Okta from a metadata URL and runs Test SSO Login. It succeeds with 4 attributes mapped.

Who does thisIT administrator configuring Okta, and every employee who signs in afterwardWhat you getPeople sign in with their Okta account, and deactivating someone in Okta stops them signing in to CloudLens.
Read-only connectionSeeing your cloud never needs write access.
SAML 2.0 SSOOkta, Microsoft Entra ID or Google Workspace.
Separate tenantsEach organization's data is kept apart.
Opt-in AIAllow-listed columns, tokenized ids, every call logged.

What a security review asks before anyone connects an account

The questions we hear from security teams, and how CloudLens answers each one.

Identity

Logins outlive employees

What usually happens: A shared or local login to a cloud tool stays active after the person leaves, because nobody remembers it exists.

How CloudLens resolves it: People sign in through Okta, Entra ID or Google. Deactivate them in your identity provider and they can't sign in to CloudLens.

Resolved
Access

Write access widens the blast radius

What usually happens: If a tool can change resources, anyone who steals a session in that tool can change them too.

How CloudLens resolves it: The connection is read-only. Changes go through Savings Proposals, which need approval, a dry run and a rollback plan.

Resolved
Data privacy

AI tools see more than they need

What usually happens: Someone pastes a cost export into a chatbot, and account ids and resource names leave the company.

How CloudLens resolves it: Copilot sends allow-listed columns only, replaces ids with tokens first, and logs every call.

Resolved

Sign in through your identity provider

Connect one SAML 2.0 identity provider per organization, from a metadata URL, pasted XML or manual fields. Run Test SSO Login before you save. On the login page, email-domain discovery sends people to the right provider, and membership of an IdP group can grant admin.
  • SAML 2.0
  • Metadata URL, XML or manual
  • Test SSO Login
  • Email-domain discovery
  • Identity-provider group grants Admin
What you're watching
  1. 1
    Domain routes to Okta

    The login page recognizes lumoraretail.com and sends Ana to lumoraretail.okta.com. There is no CloudLens password to type.

  2. 2
    Role comes from the group

    CloudLens checks the assertion's signature, audience and expiry. Membership of cloudlens-admins signs Ana in as Admin.

  3. 3
    Configure from a metadata URL

    On the SAML / SSO settings page, the admin picks Okta, pastes the metadata URL and adds lumoraretail.com as the email domain.

  4. 4
    Test SSO Login, then save

    Test SSO Login runs a real sign-in round trip before Save. Here it succeeds with 4 attributes mapped.

Who does thisIT administrator setting up the identity provider, with a security reviewer checking the group mappingWhat you getAdmin rights are controlled by one Okta group, and the setup is proven to work before anyone depends on it.
OktaSAML 2.0
Microsoft Entra IDSAML 2.0
Google WorkspaceSAML 2.0

Setting up SSO before lunch

Lumora Retail uses Okta for every internal tool. This is how CloudLens was added to it, and what happened when someone left.

LPLena ParkIT administrator, Lumora Retail

Lumora Retail is a fictional company. The people, names and numbers are sample data.

    1
    Wed 11:00

    Adds Okta as the identity provider

    Lena creates a SAML app in Okta and pastes its metadata URL into CloudLens Settings. The sign-in URL, entity ID and certificate fill in from it.
    2
    Wed 11:06Test passed

    Runs Test SSO Login

    Before saving, she runs Test SSO Login with her own account. The round trip completes, so she saves the configuration.
    3
    Wed 11:15

    Maps an Okta group to admin

    Members of the cloudlens-admins group in Okta get admin rights in CloudLens. Everyone else is invited with Editor access.
    4
    Thu 09:30

    Colleagues sign in with their work email

    On the CloudLens login page, anyone with an Lumora Retail email address is sent straight to Okta. Nobody has a separate CloudLens password to remember.
    5
    Fri 17:00Offboarded

    An engineer leaves the company

    Lena deactivates the account in Okta as part of offboarding. That person can no longer sign in to CloudLens, with no extra step in CloudLens itself.

Read-only to see, approved to change

CloudLens connects with a read-only IAM role, an Azure service principal with reader roles, or an EKS access entry. If you want to apply a recommendation, it goes through Savings Proposals, which require approval, a dry run with IAM permission simulation, and offer rollback.
  • No agents
  • No access keys
  • Role validated on connect
  • Dry run before apply
  • Rollback
CloudLensReadOnlyRole validated
{
  "Effect": "Allow",
  "Action": [
    "ec2:Describe*",
    "rds:Describe*",
    "s3:GetBucket*", "s3:List*",
    "iam:Get*", "iam:List*",
    "cur:DescribeReportDefinitions",
    "ce:Get*"
  ],
  "Resource": "*"
}
No Create*, Put*, Delete* or Terminate* actions

What Copilot sends to the model

Copilot stays off until an admin turns it on. When it runs, only allow-listed columns are sent to the model. Account and resource ids are replaced with tokens before the request leaves, and every call is written to an AI processing log you can review.
  • Explicit opt-in
  • Allow-listed columns only
  • Ids tokenized
  • Every call logged
What you're watching
  1. 1
    An admin turns Copilot on

    The consent toggle is off by default. The question about EC2 spend in prod-core goes nowhere until an admin enables it.

  2. 2
    Columns are filtered

    Service, usage_date, cost, account and resource are allowed. The tags, owner_email and ip_address columns are struck out and stay behind.

  3. 3
    Names become tokens

    Before the call, prod-core becomes ACCT_1, checkout-api becomes RES_7 and orders-db becomes RES_12. Real names return only inside CloudLens.

  4. 4
    Every call is logged

    The answer comes back, and the AI processing log records the time, who asked, which columns went out and that ids were tokenized.

Who does thisAdmin who approves Copilot, with a security reviewer auditing the processing logWhat you getFor every Copilot question you can show which columns were sent and confirm that no account or resource names went with them.
Security review coming up?

Review our access model with an engineer

Book a review

The basics, done properly

Verified sign-in

Email and password with one-time-code verification, and password reset links that expire.

Invite-only teams

People join through an invite from an admin. Nobody can sign themselves up into your organization.

Roles

Super Admin, Admin and Editor. With SSO, membership of an IdP group can grant admin.

Encrypted secrets

Integration credentials such as Jira API tokens are stored encrypted and not shown again after saving.

Audit trail

Proposals keep before and after specs, who applied a change and who rolled it back. Atlas logs every finding state change.

Reversible changes

Before a rollback runs, a preview lists what can be reverted and what can't.

Security FAQ

No. Everything you see is read with read-only access. Applying changes is optional and only happens through approved Savings Proposals.

Connect your SAML identity provider, and email-domain discovery sends users from your domain to it when they sign in.

Only allow-listed columns, with account and resource ids replaced by tokens, and only after an admin has turned Copilot on. Each call is logged.

Talk to us about your security review. We'll walk through our controls and answer your questionnaire directly.

Running a vendor security review? Send us your questionnaire and we'll go through it with you.

Ready to see CloudLens in action?

Connect a read-only AWS role or Azure service principal. We'll walk you through your bill, your security graph and the first things worth fixing.