---
title: "QWED Infra"
description: "QWED Infra proves what AWS IAM policies and network rules allow and estimates cost before a Terraform change is deployed."
url: https://qwedai.com/platform/infra
---

QWED Infrav0.3.0

# Prove what infrastructure code allows before it deploys.

Deterministic checks for infrastructure as code. QWED Infra proves what IAM policies and network rules allow and estimates cost before a Terraform change is applied, without asking a model to judge a model.

[Read the documentation](https://docs.qwedai.com/infra/overview) [Source on GitHub](https://github.com/QWED-AI/qwed-infra)

At a glance

Version

0.3.0

Status on PyPI

Not declared

Install

pip install qwed-infra

Focus

AWS and Terraform

Model in the check

None

Output

Verification Context documents, signed with ES256

Licence

Apache-2.0

## What it checks

-   IamGuard

    ### Access policies

    Uses the Z3 solver to prove what AWS IAM policies allow, including wildcards, explicit denies, and source IP and time conditions.

-   NetworkGuard

    ### Network reachability

    Whether the internet can reach a subnet or a database.

-   CostGuard

    ### Cost

    Estimates cost from public on-demand prices before deployment and blocks changes over budget.

-   ArtifactBoundaryGuard

    ### Release packages

    Release artefacts must not contain secrets, debug files or wrong build paths.

## Mistakes it is built to catch

Nobody checked any of it

### Without QWED Infra

-   **Access to everything** A policy grants s3:\* on every resource, so any bucket can be read or deleted.

-   **Open to the internet** SSH port 22 is opened to 0.0.0.0/0, the whole internet.

-   **A bill nobody expected** A development server is set to a p4d.24xlarge instance, about $23,000 a month.

Each one checked before it is used

### With QWED Infra

1.  **Access to everything** IamGuard The solver proves the policy reaches every bucket.

    VERIFIED · DENY
2.  **Open to the internet** NetworkGuard The internet can reach port 22, so the change is held.

    VERIFIED · DENY
3.  **A bill nobody expected** CostGuard Over budget, so the change is not applied.

    BLOCKED · DENY

What is proven correct goes through, with a record of why.

QWED returns the decision; your integration acts on it.

## Get started

shell

```
$ pip install qwed-infra
```

[Documentation](https://docs.qwedai.com/infra/overview) [Repository](https://github.com/QWED-AI/qwed-infra) [PyPI](https://pypi.org/project/qwed-infra/) [Release history](https://qwedai.com/releases)

Good to know

-   QWED Infra currently focuses on AWS and Terraform. Kubernetes and Azure are on the roadmap.
-   NetworkGuard does not model NAT gateways, VPC peering, network ACLs or Transit Gateway. When they are present it returns UNVERIFIABLE instead of guessing.

[**Use case: Cloud infrastructure** Changes to permissions, infrastructure code and cloud costs checked before they apply.](https://qwedai.com/solutions/cloud)

## More domain packages

-   [QWED Finance](https://qwedai.com/platform/finance)
-   [QWED Legal](https://qwedai.com/platform/legal)
-   [QWED Tax](https://qwedai.com/platform/tax)
-   [Every package](https://qwedai.com/ecosystem)