See your AWS.
Touch nothing.
EyeKeen is a native Mac app that shows you everything happening in an AWS account, and is built so it cannot change any of it. Not by mistake, not by prompt, not by bug.
Private beta, free of charge·Licensed per person·macOS 12+·Apple silicon and Intel
FairgroundprodTask definition api:311 → api:312, image sha-9f1e2c, 3 tasks replaced.
MemoryUtilization 96% ≥ 85% for 3 datapoints.
UpdateService desiredCount 3 → 5 by autoscaling.
The memory climb starts 4 minutes after #482 and recovers only after tasks are replaced. The 5xx burst is downstream of the memory pressure, not a separate failure.
Incident timeline
Everything that happened, on one axis.
Deploys, alarms, configuration changes, errors, scaling events and metrics, drawn together under the service they belong to. Drag the playhead and the whole account re-renders at that moment.
Architecture
A live map, not a diagram.
Edge, compute, data and external services laid out from what is actually running right now: load balancers, ECS and EKS, Lambda, RDS, DynamoDB, queues, buckets, and the connections between them.
- Drawn from the account, today. Open it after a deploy and it already reflects the change.
- Click anything to see its metrics, logs, cost and recent changes without leaving the map.
- Capacity simulation. Ask what happens at 3× traffic and see which tier gives first.
Security
One sweep. A score you can defend.
GuardDuty, Security Hub, CloudTrail, IAM hygiene, open security groups, S3 and ECR, read in one pass and scored 0 to 100. Findings are tracked over time, and a finding cannot be marked fixed while AWS still reports it.
- Detected, reappeared, resolved. Every change in state has a timestamp and lands on the timeline.
- Verified against AWS before anything is closed. No optimistic ticking.
Savings
Find what you pay for and never use.
Nine detectors look for resources that bill while doing nothing: unattached volumes, idle NAT gateways and load balancers, orphaned snapshots, stopped instances still paying for disks, oversized ECS services, idle databases and log groups that grow forever.
- The exact resource, its monthly cost and the metric that proves it is idle.
- Still read-only. EyeKeen tells you; you decide what to delete, in your console.
| Resource | Why | / month |
|---|---|---|
| nat-0b71c2 · eu-west-2a | idle NAT 0 B out in 14 d | €38.40 |
| vol-09e4 · 500 GB gp3 | unattached since 3 Sep | €42.11 |
| i-07a1 · g5.xlarge | stopped disks still billed | €16.00 |
| worker · ECS | oversized CPU 2.1% avg | €61.20 |
| /aws/lambda/import | no retention 48 GB stored | €1.44 |
| fairground-staging-db | idle RDS 0 connections | €112.30 |
| Recoverable | €1,284 / month |
AI analysis on Amazon Bedrock
Ask the account, not the docs.
Every answer is grounded in the live data EyeKeen already collected: the timeline, the logs, the findings, the costs. Inference runs on Amazon Bedrock with your credentials, in your region, on your bill. There is no third-party AI key to manage.
- Incident stories and post-mortems written from the actual events, with sources listed.
- Cannot act. The assistant reads through the same allowlist as everything else.
The read-only guarantee
It cannot change your infrastructure.
Read-only is not a setting someone could flip. It is how the program is built, and AWS enforces it a second time.
- One door to AWSEvery call goes through a single function with an explicit allowlist of describe, get and list operations. The mutating verbs are not in the program, so there is nothing to misuse.
- Capped by AWS tooWhen EyeKeen assumes a role it attaches a session policy that denies writes, so even an over-permissive role cannot be used to change anything through it.
- Your own templateFor cross-account access EyeKeen generates the CloudFormation template for a read-only role that trusts only your account and a pinned external id. You review it before anything is created.
- Two named exceptionsBedrock model invocation and AWS SSO sign-in are real AWS operations. They are documented, they run in your account, and they are the only ones.
# every AWS call is checked before it leaves the app ✓ ecs describe-services ✓ cloudwatch get-metric-data ✓ logs filter-log-events ✓ ce get-cost-and-usage ✓ guardduty list-findings ✗ ecs update-service not in the allowlist ✗ ec2 terminate-instances not in the allowlist ✗ iam create-user not in the allowlist ✗ s3 delete-object not in the allowlist
Private by design
There is no EyeKeen server.
The app runs entirely on your Mac. There is nothing to sign up for and nowhere for your data to go.
Your AWS profiles, untouched
EyeKeen uses the profiles and SSO sessions already on your machine. It never copies a key, and it never sees one for a role.
Local storage only
Configuration and history live in Application Support on your Mac, as files you can read, back up and delete.
Protected by your Mac
A local app password, with Touch ID or your Mac password to recover it. Sessions can be remembered in Keychain and revoked at any time.
A private backend
The engine listens on the loopback address only and accepts requests solely from the app that launched it. Browsers get a 403.
AI on your terms
Analysis runs on Amazon Bedrock with your credentials in your region. Configure the model globally or per workspace.
Open about what it does
The allowlist, the licence and the data locations are documented, and the licence is shown before first use.
Private beta
Request access to EyeKeen.
EyeKeen is in a private beta. Tell us a little about your AWS setup and we will review the request and email you a download link and a personal licence key, usually within two working days.
- Free of charge during the beta
- One licence key per person, time-limited and renewable
- macOS 12 or later, Apple silicon and Intel
- Bedrock and Logs Insights usage billed by AWS to you
FAQ