Open-source runtime verification for AI, licensed under Apache-2.0.
QWED
Contact

Type to search pages, engines and advisories.

    Looking for API details?Search the docs

    QWED Infrav0.3.0

    Prove what infrastructure code allows before it deploys.

    Deterministic checks for infrastructure as code. QWED Infra proves what IAM policies and network rules allow and estimates cost before a Terraform change is applied, without asking a model to judge a model.

    Read the documentationSource on GitHub

    At a glance

    Version
    0.3.0
    Status on PyPI
    Not declared
    Install
    pip install qwed-infra
    Focus
    AWS and Terraform
    Model in the check
    None
    Output
    Verification Context documents, signed with ES256
    Licence
    Apache-2.0

    What it checks

    • IamGuard

      Access policies

      Uses the Z3 solver to prove what AWS IAM policies allow, including wildcards, explicit denies, and source IP and time conditions.

    • NetworkGuard

      Network reachability

      Whether the internet can reach a subnet or a database.

    • CostGuard

      Cost

      Estimates cost from public on-demand prices before deployment and blocks changes over budget.

    • ArtifactBoundaryGuard

      Release packages

      Release artefacts must not contain secrets, debug files or wrong build paths.

    Mistakes it is built to catch

    Nobody checked any of it

    Without QWED Infra

    • Access to everythingA policy grants s3:* on every resource, so any bucket can be read or deleted.
    • Open to the internetSSH port 22 is opened to 0.0.0.0/0, the whole internet.
    • A bill nobody expectedA development server is set to a p4d.24xlarge instance, about $23,000 a month.

    Each one checked before it is used

    With QWED Infra

    1. Access to everythingIamGuardThe solver proves the policy reaches every bucket.
      VERIFIED · DENY
    2. Open to the internetNetworkGuardThe internet can reach port 22, so the change is held.
      VERIFIED · DENY
    3. A bill nobody expectedCostGuardOver budget, so the change is not applied.
      BLOCKED · DENY

    What is proven correct goes through, with a record of why.

    QWED returns the decision; your integration acts on it.

    Get started

    shell
    pip install qwed-infra
    DocumentationRepository PyPI Release history

    Good to know

    • QWED Infra currently focuses on AWS and Terraform. Kubernetes and Azure are on the roadmap.
    • NetworkGuard does not model NAT gateways, VPC peering, network ACLs or Transit Gateway. When they are present it returns UNVERIFIABLE instead of guessing.
    Use case: Cloud infrastructureChanges to permissions, infrastructure code and cloud costs checked before they apply.

    More domain packages