---
title: "Cloud infrastructure · Solutions"
description: "QWED Infra proves what AWS IAM policies and network rules allow and estimates cost before an AI-written Terraform change is deployed."
url: https://qwedai.com/solutions/cloud
---

# Prove what an infrastructure change allows before it ships.

AI now writes Terraform, access policies and network rules. QWED Infra proves what those changes actually allow, who can reach what, and what they will cost, before anything is deployed.

[Contact](https://qwedai.com/contact) [Read the documentation](https://docs.qwedai.com/infra/overview)

What QWED checks here

-   Access policies
-   Network reachability
-   Cost
-   Release packages

With QWED Infra

## One line of infrastructure code can open everything.

The mistakes are small to write and large to live with.

Nobody checked any of it

### Without QWED

-   **Access to everything** A policy grants s3:\* on every resource, so any bucket can be read or deleted.

-   **Open to the internet** SSH port 22 is opened to 0.0.0.0/0, the whole internet.

-   **A bill nobody expected** A development server is set to a p4d.24xlarge instance, about $23,000 a month.

Each one checked before it is used

### With QWED

1.  **Access to everything** IamGuard The solver proves the policy reaches every bucket.

    VERIFIED · DENY
2.  **Open to the internet** NetworkGuard The internet can reach port 22, so the change is held.

    VERIFIED · DENY
3.  **A bill nobody expected** CostGuard Over budget, so the change is not applied.

    BLOCKED · DENY

What is proven correct goes through, with a record of why.

QWED returns the decision; your integration acts on it.

## What QWED checks

Every check is deterministic. QWED Infra does not ask a model to judge a model, and Terraform does not need to be installed.

-   IamGuard

    ### Access policies

    Uses the Z3 solver to prove what AWS IAM policies allow, including wildcards, explicit denies, and source IP and time conditions.

-   NetworkGuard

    ### Network reachability

    Whether the internet can reach a subnet or a database.

-   CostGuard

    ### Cost

    Estimates cost from public on-demand prices before deployment and blocks changes over budget.

-   ArtifactBoundaryGuard

    ### Release packages

    Release artefacts must not contain secrets, debug files or wrong build paths.

## Where it fits

1.  Your AI

    Writes or edits Terraform, an IAM policy or a network rule.

2.  QWED

    Proves what the change allows, who can reach what, and what it will cost.

3.  Your systems

    Your pipeline applies only changes that passed.

Good to know

-   QWED Infra currently focuses on AWS and Terraform. Kubernetes and Azure are on the roadmap.
-   NetworkGuard does not model NAT gateways, VPC peering, network ACLs or Transit Gateway. When they are present it returns UNVERIFIABLE instead of guessing.

## Get started

-   ### [QWED Infra](https://qwedai.com/platform/infra)

    v0.3.0 Status not declared

    Terraform, IAM and cloud cost. Results can be exported as signed Verification Context documents.

    ```
    $ pip install qwed-infra
    ```

### Bringing AI into cloud infrastructure?

Tell us what your AI does and where a mistake would hurt.

[Contact](https://qwedai.com/contact)

## Other fields

-   [Banking and payments](https://qwedai.com/solutions/banking)
-   [Legal](https://qwedai.com/solutions/legal)
-   [Tax](https://qwedai.com/solutions/tax)
-   [AI agents](https://qwedai.com/solutions/ai-agents)
-   [Software delivery](https://qwedai.com/solutions/software-delivery)