See your entire AWS account. In one diagram.
A native macOS app that scans 33+ AWS services, renders your infrastructure as an interactive architecture diagram, and runs an AI audit across security, cost, reliability, and performance — using your own OpenAI (or, soon, Claude) account. Everything runs on your Mac; credentials never leave your Keychain.
Per-project. Encrypted by Apple.
Only Describe* / List* API calls.
Your infrastructure stays on your laptop.
Thirty-three-plus AWS services,
one architecture diagram.
AWSAnalyze calls the Describe/List APIs across every major category and stitches the results into a single graph — no gaps, no console tab-hopping. A complete visualization of your AWS account in under a minute.
Everything the AWS console won't show you, in one view.
Pan, zoom, and click any resource.
VPCs contain subnets contain instances — the hierarchy AWS never shows you, rendered as an actual graph.
- ▸Smooth pan and zoom across your account’s resources.
- ▸Service-type highlighting dims unrelated nodes to 30%.
- ▸Hierarchical VPC → Subnet → Resource containers.
- ▸Public vs. private subnet color coding.
One-click filtering by service.
Eleven categories. Click DynamoDB, see only DynamoDB — the rest of the graph dims to 30% so you don’t lose spatial context.
- ▸Per-service counts shown inline in the sidebar.
- ▸Click the active row again (or “Show All”) to clear the filter.
- ▸The full graph stays visible — nothing is hidden, just dimmed.
Every property, parent, child, and association.
Click a node to open the inspector. See what VPC and subnet it lives in, which security groups attach to it, every tag, every property AWS returns.
- ▸Every ID, ARN, and CIDR is selectable — ⌘C to copy.
- ▸Parent (VPC / subnet) and child resources listed in the side panel.
- ▸Associated resources (security groups, target groups, …) shown next to the properties.
EC2 · api-worker-03
Associations
Security, Cost, Reliability, Performance — reviewed by the AI you pick.
Get a severity-ranked review of your account with prioritized remediation actions. Plug in your own OpenAI account today (OAuth, no API key round-trip); Claude and OpenAI API keys are on the roadmap. Either way, the request goes straight from your Mac to the provider — nothing touches our infrastructure, because there isn’t any.
- ▸Executive summary + four pillar reports: security, cost, reliability, performance.
- ▸Findings grouped by severity: critical · warning · info.
- ▸Ranked priority actions with impact statements.
- ▸Assessment cached on the project — run once, review later.
- ▸Zero vendor lock-in: switch providers without re-scanning.
Ship your scan as code or a PDF.
Emit CloudFormation or Terraform for the core networking + compute layer, or save the map as a PDF you can hand to an auditor this afternoon.
- ▸CloudFormation / Terraform cover the core resources: VPC, subnets, security groups, EC2, RDS, Lambda, S3, ELB, NAT, IGW.
- ▸Output is sorted deterministically — friendly to git diffs.
- ▸PDF captures the rendered map, ready to print or attach.
Multiple accounts. Vaulted separately.
One app, every environment. Each project is scoped to a single region and gets its own Keychain entry — staging can’t read production. Scan another region by spinning up a second project.
Your AWS keys never leave your Mac.
AWSAnalyze is architected so there is nothing for us to leak. No account, no backend, no telemetry pipeline — the server simply doesn't exist.
Keychain-vaulted credentials
Stored per-project using Apple's Security framework. Unlocks require device authentication.
Read-only scans
The app only invokes Describe* and List* APIs. No writes, ever. Bring a policy-scoped IAM user.
No backend, no account
AWSAnalyze runs entirely on your machine. There is no server, no user database, no analytics pipeline.
Three steps. No account required.
Install
Run brew install --cask itsfreddyrb/awsanalyze/awsanalyze in your terminal. Homebrew downloads, verifies the signature, installs to Applications, and opens cleanly on first launch — no Gatekeeper dance.
Enter AWS credentials
Paste an access key ID and secret. A read-only IAM user is recommended — ViewOnlyAccess is a good baseline. Credentials are stored in your Keychain.
Scan and explore
Pick a region, hit scan. Resources populate the graph when the scan completes. Each project scans one region — create another for a different region.
Built by one developer.
Payments go a long way.
AWSAnalyze is free and always will be. If it saved you an afternoon of clicking through the AWS console, a small contribution goes directly to a Venezuelan developer working remote out of Panama. PayPal handles everything — no account required on your side.
Opens PayPal in a new tab · no PayPal account needed · card checkout supported.
The practical details.
Question didn’t make the FAQ?
Email hello@awsanalyze.app — it goes straight to the one person who makes this. Usually a reply within a day. Bug reports with a screenshot get bumped to the front of the line.