Kultarr connects AWS security changes, identity permissions, exposure, and investigation evidence in one place, so your team can see what happened and what needs attention.
Coming Early access. Self-service sign-up is not open yet. Read-only AWS role.
CloudTrail record, excerpt
{ "eventName": "AuthorizeSecurityGroupIngress", "eventTime": "2026-09-24T14:32:07Z", "sourceIPAddress": "203.0.113.24", "userIdentity": { "type": "AssumedRole", "sessionContext": { "sessionIssuer": { "userName": "terraform-deploy" } } }, "requestParameters": { "groupId": "sg-0a41c2e7f3b9d8c16", "ipPermissions": { "items": [{ "ipProtocol": "tcp", "fromPort": 22, "toPort": 22, "ipRanges": { "items": [{ "cidrIp": "0.0.0.0/0" }] } }] } }}What Kultarr makes of it
tcp/22 from 0.0.0.0/0 added to prod-apiRecordedterraform-deploy, pipeline session ci-run-8812RecordedManageSecurityGroups in policy DeployNetworkingObservedNot establishedWhether the change was intended, and whether anyone connected through the port. Kultarr says so instead of guessing.
CloudTrail, IAM, your network configuration, Security Hub, GuardDuty and your Terraform each hold a piece. Kultarr joins them around the change.
Understand AWS configuration and security changes with CloudTrail context: what changed, before and after, when, and from where.
Follow one investigation
prod-api inbound rulesRecorded
tcp 4430.0.0.0/0tcp 220.0.0.0/0AuthorizeSecurityGroupIngress14:32:07 UTC
Analyze IAM permissions and the identities involved in activity, from the session back to the statement that allowed the action.
IAM permission analysis
Why AWS allowed it
ci-run-8812terraform-deployDeployNetworkingManageSecurityGroups{
"Sid": "ManageSecurityGroups",
"Effect": "Allow",
"Action": "ec2:*SecurityGroup*",
"Resource": "*"
}Connect exposure, findings and resource context, so you can decide which change to look at first.
Network exposure visibility
What the rule makes reachableObserved
0.0.0.0/0igw-0e6a1d3csubnet-public-aprod-api:22i-0c3f9a12e7b54d801SSH reachable by configurationi-07d2b6e19a4c3f552SSH reachable by configurationEC2.13Security Hub control failing on this groupA security group rule changed, potentially exposing SSH to the public internet. Every statement below says what supports it, including the ones the data cannot settle.
AuthorizeSecurityGroupIngress at 14:32:07 UTC in eu-west-1.tcp/22 from 0.0.0.0/0 to prod-api.prod-api inbound rulesRecorded
tcp 4430.0.0.0/0tcp 220.0.0.0/0AuthorizeSecurityGroupIngress14:32:07 UTC
terraform-deploy, session ci-run-8812, from 203.0.113.24.ci-run-8812terraform-deployDeployNetworkingManageSecurityGroupsManageSecurityGroups in DeployNetworking allows ec2:AuthorizeSecurityGroupIngress.prod-api is attached to 2 instances in subnet-public-a, with a route to igw-0e6a1d3c.EC2.13 reports this group as failing.0.0.0.0/0igw-0e6a1d3csubnet-public-aprod-api:224f8a2c1e, is linked to the case.terraform apply.Defined at, with a GitHub repository connected
network/security-groups.tf:42aws_security_group.api_publicIllustrative example. The names, addresses and identifiers are invented or come from documentation ranges.
Start from the event, not a list of checks. One case per change, with the actor, the before and after, the permission and the exposure in one place.
terraform-deployRecordedtcp/22 opened on prod-apiRecordedManageSecurityGroupsObservedManagement events, made readable and tied to the resources they touched.
| UTC | Event | Actor |
|---|---|---|
| 14:32:07 | AuthorizeSecurityGroupIngress | terraform-deploy |
| 14:28:40 | AttachRolePolicy | j.rivera |
| 13:57:12 | PutBucketPolicy | data-pipeline |
| 13:12:03 | CreateAccessKey | j.rivera |
The statement behind a decision, evaluated across each policy layer.
Which sensitive ports your configuration opens to the internet, and what sits behind them.
Rule-basedThe severity beside each port
tcp/22SSHprod-api2 instancesCriticaltcp/5432PostgreSQLreporting-db1 databaseCriticaltcp/5601Dashboardsops-dash1 instanceHighSecurity Hub and GuardDuty findings, where you use them, joined to the change on the same resource.
Each signal about a change, in the order it happened.
Where your code and live AWS disagree, and which side the fix belongs on. Needs a connected GitHub repository, which you grant separately.
Terraform
tcp/5432 from 10.0.0.0/8Live AWS
tcp/5432 from 0.0.0.0/0The resources behind a finding, and how they relate to the case.
prod-apiPublic ingressapi-worker-1Uses the groupterraform-deployMade the changeProduct frames are illustrative. Names and identifiers are examples.
Sign up for the Kultarr web application. No credit card.
Create the read-only IAM role. Your 3 days start when it is verified.
See what changed, who changed it, what it exposed and how to fix it.
No customer-side agent. Optional integrations, such as a GitHub repository for Terraform comparison, ask for their own access when you connect them.
Kultarr is a web application. You sign in to your workspace dashboard from any modern browser; there is nothing to install and no agent to run.
The software reads your AWS configuration and CloudTrail activity through a read-only IAM role you create, and builds the investigations, findings and timelines for you.
Your subscription is access to the Kultarr software for your workspace, billed monthly. Updates to the software are included.
Kultarr does not include consultants, a managed security service or analysts watching your accounts. Your team uses the software and decides what to change.
A tool that investigates your cloud should need less access than the people using it. Read-only access is still access, and configuration metadata is still sensitive, so read the role before you connect it.
Kultarr generates a CloudFormation template for your account. Review every statement before you create the stack, or create the role yourself from the JSON or Terraform shown. You can revoke it per account.
Every action the role grants is a read, and the template generator refuses to produce one that can change your account. The role also explicitly denies reading object contents, secrets, parameters, database items and decrypted data.
Kultarr assumes the role through AWS STS with an external ID unique to your connection, and the credentials expire on their own.
An account is marked connected only after Kultarr has assumed the role, checked the account and tested the permissions.
From the role templateNeverReadDataContents
"Effect": "Deny",
"Action": [
"s3:GetObject",
"s3:GetObjectVersion",
"secretsmanager:GetSecretValue",
"ssm:GetParameter",
"ssm:GetParameters",
"ssm:GetParametersByPath",
"kms:Decrypt",
"dynamodb:GetItem",
...
]An explicit deny outranks any allow, including one added to the role later by mistake. Kultarr reads configuration and metadata, not the contents of your data.
Kultarr
$99/month
US dollars, plus applicable sales tax or VAT, calculated at checkout.
Investigate AWS security changes, understand what happened, and identify what needs attention.
Self-service sign-up is not open yet.
Coming . Kultarr is in early access and still in development. Paid subscriptions cannot be purchased yet: checkout through Paddle opens when payments are enabled, and nothing can be bought or charged before then. The price and terms on this page are the ones that will apply.
No payment details are needed to start.
The 3 days start when your first AWS account connection is verified, not at sign-up.
Nothing is charged when the trial ends. To keep using Kultarr, you subscribe through checkout.
One trial per workspace.
Refunds are covered by the Refund Policy, and the full terms by the Terms of Service.
Kultarr is a cloud security software-as-a-service (SaaS) platform for Amazon Web Services (AWS). You use it through a web dashboard in your browser, and it is sold as a monthly subscription. It investigates changes in AWS accounts: it connects each CloudTrail event to the identity that made it, the IAM permission that allowed it and what the change exposed, and recommends a fix at the source.
What Kultarr doesSoftware. Kultarr is a hosted web application that analyses your AWS accounts automatically through a read-only IAM role. A subscription gives your workspace access to that software. It does not include consultants, a managed security service or people monitoring your accounts; your team uses the dashboard and decides what to change.
Changes recorded as CloudTrail management events; IAM users, roles and policies, including role-assumption chains and indirect privilege paths; network exposure through security groups, public addresses and routes; S3 bucket configuration; and findings from AWS Security Hub, Amazon GuardDuty, AWS Config and IAM Access Analyzer where you use them.
Built for the questions that follow a changeWhen something changes in an AWS account, the answer to who did it, why AWS allowed it and what it exposed is spread across CloudTrail, IAM, the network configuration, Security Hub, GuardDuty and often Terraform. Kultarr joins those sources around the change, so a team can see what happened and what needs attention without assembling the evidence by hand.
One change, followed step by stepEach investigation starts from the CloudTrail management event: the action, the time, the region, the source IP address and the acting identity and role session. Kultarr links that record to the case and marks every statement by what supports it: recorded by AWS in a log, observed in the account’s configuration, guidance from a Kultarr rule, or not established when the data does not say.
The evidence marksIt traces an action from the role session back to the role, the policy and the statement that allowed it, and shows how each layer of the IAM evaluation answered: service control policies, permissions boundaries, session policies and identity policies. It also maps role-assumption chains and indirect privilege paths for IAM users and roles.
A cross-account IAM role that you create in each AWS account you connect, from a CloudFormation template Kultarr generates or from the JSON or Terraform it shows. Every action the role grants is a read, and it explicitly denies reading data contents such as S3 objects, secrets and parameters. Kultarr assumes the role through AWS STS with an external ID unique to your connection, so it holds only temporary credentials. There is no agent to install.
The security modelConfiguration and metadata, not the contents of your data: account, region and resource identifiers, resource configuration and tags; IAM users, roles, groups, policies, trust relationships and access-key metadata (never secret keys); CloudTrail events, including the acting identity, action, time, source IP address, user agent and region; and findings your account already produces, such as GuardDuty findings. Cloud metadata can contain personal information, and the Privacy Policy explains how it is handled.
Privacy PolicyTaking one change in an AWS account and answering seven questions about it: who made it, what changed, when, where, which policy allowed it, what it exposed and what to do next. Kultarr keeps the evidence behind each answer so another engineer can check it.
The five investigation stepsAn alert says that something happened. Kultarr joins the CloudTrail event, the identity, the permission, the exposure and related Security Hub and GuardDuty findings into one case, and treats a case as resolved only when it re-reads the account and the condition is gone.
Businesses that run workloads on AWS, particularly engineering and platform teams without a dedicated cloud security function. Kultarr is offered to businesses and professionals, not consumers, and currently focuses on Amazon Web Services.
No. Kultarr connects through a read-only IAM role that you create, which also explicitly denies reading data contents such as S3 objects and secrets. It does not currently make changes in AWS accounts: it explains the recommended fix and, where you connect a repository, can open a pull request for your team to review and merge.
The security modelSelf-service sign-up is not open yet. To request access, email ofirbe@kultarr.io. When sign-up opens, the 3-day free trial and the monthly subscription described on this page apply.
One plan, $99 (USD) per month, with every capability included. It is billed monthly in advance and renews automatically until you cancel. Payment is processed by Paddle, our merchant of record, which also calculates any sales tax or VAT at checkout.
Pricing and billingThe trial lasts 3 days and needs no payment details. It starts when your first AWS account connection is verified, so setup does not use it up. Nothing is charged when it ends: product access is restricted until you choose to subscribe through checkout. There is one trial per workspace.
Cancel from your workspace’s billing settings at any time. Cancelling stops future renewals, and access continues until the end of the month you have paid for. Refunds are handled by Paddle as merchant of record, as described in the Refund Policy, and your statutory consumer rights are not affected.
Refund PolicyKultarr is operated by Ofir Benav, an individual based in Israel, under the service name “Kultarr.”, which is not a separate legal entity. The Terms of Service and Privacy Policy give the operator’s details and contact address.
Terms of Service
Early access. Self-service sign-up is not open yet. Read-only AWS role.