Know which scanner findings are real before your auditor asks
Inherited Terraform you didn’t write. AI-generated modules you don’t fully trust. A SOC 2 audit on the calendar. A Series B diligence call on Tuesday. ArchGuard validates your scanner findings and maps them to compliance frameworks — in under 30 minutes, without touching your AWS account.
Five triggers we see most often
SOC 2 or enterprise security questionnaire incoming
You need to know which scanner findings are real before the auditor asks. ArchGuard validates your Terraform and maps findings to the SOC 2 criteria — so you fix the right things first.
Just inherited a Terraform repo
You need to know what you own before you're accountable for an incident. A post-hire audit surfaces the risk before it surfaces in production.
Launching to production next month
One more set of eyes before you're live. Architectural debt is cheapest to fix before deployment.
Series B diligence is in two weeks
Investor DD teams check cloud infrastructure. A compliance-mapped PDF structured against AWS standards and SOC 2 criteria is the document they expect to see.
You let AI write 40% of your Terraform this quarter
AI-generated infrastructure is syntactically valid and often architecturally unsound. "96% of developers don't fully trust AI-generated code" (Sonar 2026). Review it before it becomes a production incident.
What the free AWS tools don’t give you
AWS Well-Architected Tool is excellent but is an interview-driven checklist in the AWS Console — it does not read your Terraform. AWS Solutions Architect office hours are real but rationed and tied to your AWS account team. ArchGuard reads your Terraform, validates findings against your workload context, maps everything to CIS, NIST 800-53, SOC 2, and PCI DSS, and returns a stakeholder-ready PDF in under 30 minutes.
What you actually pay for
| Option | Cost | Notes |
|---|---|---|
| Free AWS WA Tool | $0 | Self-attested, Console UI, no Terraform input |
| AWS SA office hours | $0 | Rationed, scheduled, tied to account team |
| Boutique security consulting | $5K–$25K | Two to four weeks to deliver |
| ArchGuard Solo | $49/mo | Terraform-native, compliance-mapped PDF in under 30 min, no credentials needed |
Frequently asked questions
Does this make me SOC 2 compliant?↓
No. ArchGuard maps findings to SOC 2 Trust Services Criteria and produces evidence useful in an audit — but compliance requires a formal assessment by an accredited auditor. Think of ArchGuard as the technical evidence layer: it tells you which controls your Terraform satisfies, which gaps exist, and what to fix before the auditor arrives. The certification decision is the auditor's.
How is this different from running Checkov in CI?↓
ArchGuard works alongside Checkov. Checkov catches rule-level misconfigurations; ArchGuard validates which of those findings are real in your architecture and surfaces the cross-resource gaps rules can't see — blast radius, component interaction, availability topology.
Can ArchGuard read my Terraform state?↓
No, and we don't accept state files. We analyse HCL only.
Is the review usable in a Series B diligence room?↓
Yes. The PDF is compliance-mapped against CIS AWS Foundations v3.0, NIST 800-53, SOC 2, and PCI DSS — the frameworks most investor DD teams and technical acquirers already recognise. Pair it with your own remediation roadmap.
What if my workload spans CloudFormation and Terraform?↓
We review Terraform only today. CloudFormation support is on the roadmap.
For the full CC6/CC7/CC8 mapping behind the SOC 2 answer above, see the SOC 2 compliance for Terraform guide.