Desired state versus actual state
Declared infrastructure-as-code is compared with what the provider actually reports. Every difference becomes a drift finding with the resource, the changed field and the moment it was observed.
Infrastructure Governance
Cloud infrastructure as an asset class.
Servers, buckets, databases and IAM principals are unowned and unbudgeted until they sit next to people, devices and contracts. Lojycal puts them in the same operational graph — with a desired state, an owner and a cost.
Why infrastructure belongs in the operational graph
A cloud bill tells you what was spent. It does not tell you which team owns the resource, whether it still matches the code that created it, or whether the identity that can reach it belongs to someone who left in March. Lojycal reconciles infrastructure against the same records that already carry people, assets, contracts and controls, so every resource has an owner, a budget line and an audit trail.
What the module does today
Zombie-resource detection
Idle compute, detached volumes and orphaned storage are surfaced as candidates for review — with the last activity signal that justifies the call.
Cloud OpEx attribution
Spend is attributed to owner, team and cost centre so cloud cost lands in the same financial picture as licences and hardware, instead of a separate spreadsheet.
IAM offboarding cascade
Leaver events reach cloud identities. Principals, roles and access keys attached to a departing person are listed as part of the offboarding record rather than discovered a year later.
Credential inventory and rotation posture
Long-lived keys and secrets are inventoried with their age and rotation state, so stale credentials are visible before an auditor finds them.
Compliance mapping and audit trail
Findings map to the control frameworks already tracked in Lojycal, and every decision — accept, remediate, exempt — is written with actor and timestamp.
How it works
1. Connect read-only
AWS, Azure and GCP are connected with read-only credentials. Nothing in your environment is modified by connecting.
2. Start in dry-run
Each connection begins in dry-run/mock mode. You see exactly which resources would be inventoried and which findings would be raised before anything is recorded live.
3. Go live on inventory and drift
Once dry-run output looks right, the connection promotes to live read. Inventory, drift and cost attribution refresh on a schedule.
4. Act under governance
Remediation is a decision, not a side effect. Actions are approved, attributed and recorded — never applied silently.
From Browser Endpoints to Integration Ledger
Infrastructure governance is one leg of a longer pipeline. Select a stage to see what enters it, what Lojycal does, and what evidence it writes.
Browser Endpoints
- Input
- Managed browser and endpoint telemetry: which people reach which cloud consoles and SaaS surfaces, from which device.
- What Lojycal does
- Attributes each session to a person and a device already held in the operational graph, so cloud access is never an anonymous IP.
- Evidence written
- Endpoint posture records and the access signal that later justifies an ownership or offboarding decision.
Cloud Inventory
- Input
- Read-only AWS, Azure and GCP connections, promoted out of dry-run only after you have reviewed what they would read.
- What Lojycal does
- Enumerates compute, storage, databases, networks and IAM principals as assets with a provider, a region and a lifecycle state.
- Evidence written
- A dated inventory snapshot per provider, with the credential scope used to produce it.
Drift Detection
- Input
- Declared infrastructure-as-code alongside the actual state reported by each provider.
- What Lojycal does
- Compares desired against actual and raises a finding for every difference — resource, field, previous value, observed value.
- Evidence written
- A drift finding with first-observed and last-observed timestamps, plus the accept, remediate or exempt decision made on it.
Owner + Cost Attribution
- Input
- Inventory and provider spend, joined against teams, cost centres and the people directory.
- What Lojycal does
- Assigns every resource an owner and a budget line, so cloud OpEx sits beside licences and hardware rather than in a separate report.
- Evidence written
- Attributed spend rows per owner and cost centre, and an unattributed queue that cannot be quietly ignored.
IAM Offboarding Cascade
- Input
- A leaver event from HRIS, joined to the cloud principals, roles and access keys held by that person.
- What Lojycal does
- Lists every cloud identity attached to the departing person as part of the offboarding record, with a governed revoke decision per item.
- Evidence written
- An offboarding record showing what was revoked, by whom, when — and what was deliberately retained, with a reason.
Integration Ledger
- Input
- Every read, decision and dispatch produced by the stages above.
- What Lojycal does
- Records the full chain in one append-only ledger, so any downstream system or auditor reads the same history you do.
- Evidence written
- WORM audit entries and signed evidence packs that can be exported without reconstructing anything by hand.
Use the arrow keys to move between stages.
Browser Endpoints
Evidence, not screenshots
Every drift finding, exemption and remediation decision is recorded with the actor who made it, the reason given and the time it happened. When an auditor asks how a production resource came to differ from its declared state, the answer is a record — not a reconstruction.
Frequently asked questions
See infrastructure governance on your own estate
We walk your AWS, Azure or GCP footprint through the graph in a live session.