Sign inGet started
FeaturesHow it worksSelf-hostedPricingDocsContactSign inGet started
single pane of glass · 4 clouds

One console for every cloud.

A new way to live in the cloud. Cushy unifies AWS, Google Cloud, Azure and Alibaba Cloud into a single control room — live inventory, a living network topology map, Terraform-powered change control, cost analytics and alerting. Keyless, auditable, enterprise-ready.

Get started freeRead the docs
AWSGoogle CloudAzureAlibaba Cloud

Built for platform, SRE and FinOps teams

AES-256-GCM at restSecrets, Terraform state and connection payloads are encrypted envelopes under your data key.
Keyless OIDC federationShort-lived credentials minted per operation — no stored cloud keys, ever.
Full audit trailEvery action on every route lands in an org-scoped, queryable audit stream.
SAML SSO + SCIMBring your IdP: SAML 2.0 sign-in, SCIM provisioning and group→role mapping.

How it works

From first connection to governed deploys

The operator journey, end to end: connect an account with keyless federation, watch inventory and topology fill in, ship changes through Terraform, and let cost and alerting keep watch.

clouds · connect account

ProviderAWS · AssumeRole (OIDC)
Role ARNarn:aws:iam::4821…:role/cushy-read
Regionsus-east-1 · eu-west-1
Validate connection● healthy
sts:AssumeRoleWithWebIdentity … ok
ec2:DescribeInstances … ok (no stored keys)
first sync queued ▍

Platform

Everything a cloud team stares at, in one place

Not a dashboard over screenshots — a real control plane. Every capability below is live product, backed by the same APIs you can call yourself.

Inventory · Topology

Unified inventory and a living network map

Every resource across AWS, GCP, Azure and Alibaba in one searchable inventory — and a nested topology map: VPCs, subnets, route tables, gateways, dependency and traffic edges.

  • Nested containers: VPC → subnet → resource, nothing ever dropped
  • Dependency + byte-weighted traffic edges with hover detail
  • Cross-cloud VPN and peering links drawn as first-class edges
cushy · network topology
AWS · vpc-prod · 10.20.0.0/16
subnet-a
VMDBLB
subnet-b
K8SFN
● net-shared (GCP) · 18 resources · s2s vpn up
▲ vnet-eu (Azure) · 1 warning
Terraform

One mutation path: plan → approve → apply

Machine-generated native HCL, policy and cost gates, separation-of-duties approvals, encrypted state with rollback — and a real OpenTofu runner with short-lived, keyless write credentials.

  • Policy must pass before anyone can approve
  • Production changes need a second operator
  • Failed applies never corrupt state — adjust, re-plan, ship
cushy · change control
+ aws_vpc.this · + aws_subnet.this ×2
~ policy: mandatory-tags PASS · Δ +$42/mo
# approved by a second operator → applied
Deployer assistant

Ask for infrastructure in plain language

Describe what you need and the deployer assistant drafts it — choosing from your own blueprint catalog, your connected accounts and your Terraform folders. It proposes; you approve. Nothing reaches a cloud until you have seen the plan.

  • Drafts from YOUR catalog — it can't invent a blueprint you don't have
  • Anything it can't safely infer is handed back as a field to fill
  • The draft opens in the normal wizard: same plan, policy, cost and approval
cushy · ask to deploy
a small web server in eu-west-1, private subnet
＋ aws/ec2-instance · t3.small · eu-west-1
→ folder: web-staging (new) · account: prod (AWS)
# review plan → policy → Δcost → approve → apply
FinOps

Cost analytics that speak FOCUS

Native billing from all four clouds normalized to FOCUS — spend by cloud, service and tag, budgets, and mean+3σ anomaly detection that flags a runaway NAT gateway before finance does.

  • One normalized ledger across AWS, GCP, Azure and Alibaba
  • Budgets with burn tracking per team and tag
  • Anomalies audited and alerted the day they appear
cushy · cost analytics
▲ anomaly: natgw-eu-west-1 +3.4σ vs 28-day baseline

Intuitive by design

Point, click, ship.

The console works the way you already think: direct manipulation on a living map, guided flows everywhere else — and every click still lands in the same governed Terraform path.

A map you can grab
Drag, pan, zoom and resize the nested topology — with Figma-style keyboard shortcuts.
Draw a connector
Drag an arrow between two networks; Cushy provisions the peering or VPN through Terraform.
Click to edit
Click a managed resource, change its parameters — one Save & apply runs plan → approve → apply.
Guided deploys
Cloud → blueprint → variables → plan review → apply, in one wizard straight from Inventory.
Ask about a packet
Type source and destination IPs and see, layer by layer, exactly what allows or blocks the traffic.
One-click import
Adopt any discovered resource into Terraform — the HCL is generated and committed for you.

Reachability analysis

Ask whether web-a reaches db-1 on tcp/5432 — the verdict per layer, with the exact rule that allows or blocks, on any of the four clouds.

Monitoring & incidents

Deduplicated alerts over real metrics, auto-resolved on recovery, correlated into incident timelines with every change event.

SSO, RBAC & audit

OIDC + SAML 2.0 SSO, SCIM provisioning with group→role mapping, capability checks on every route and a full audit trail.

Pipelines

App and infra pipelines drive the real Terraform lifecycle — production runs pause until a second operator approves.

AI assistant

Answers grounded in your org's real inventory, connections and cost — retrieval-augmented, org-scoped, honest when it can't know.

In-console editing

Edit a managed resource's parameters right in the console; the change ships through plan → approve → apply.

Deployer assistant

Ask for infrastructure in plain language. It drafts the deployment from your own blueprint catalog — you review the plan, policy and cost before anything is created.

Enterprise

Security posture, not security theater

Encrypted at restSecrets, Terraform state, attachments and connection payloads are AES-256-GCM envelopes under your data key.
Keyless cloud federationConnections use OIDC role federation — short-lived credentials, minted per operation. No stored cloud keys, ever.
RBAC + audit trailCapability-checked on every route, recomputed per request. Every action lands in an org-scoped audit stream.
SAML · SCIM · approvalsBring your IdP: SAML 2.0 and SCIM 2.0 with group→role mapping. Production changes need a second operator.

Self-hosted

Or run the whole console inside your own perimeter

Cushy also ships as software you deploy yourself — a Docker Compose stack in your own VPC or datacenter. Same console, same engines, same four clouds. Your data never leaves your infrastructure, and the licence is verified offline, so the console never needs to reach us to run.

  • Your infrastructure, your perimeterDeploy into your own VPC, datacenter or lab. The console reaches your clouds with the same keyless OIDC federation — from inside your network — and everything it stores (inventory, Terraform state, audit trail, secret envelopes) lands in your Postgres, encrypted under your own data key.
  • Offline licence verificationThe licence is a signed key your deployment verifies locally. There is no activation server to call, no phone-home check and no usage telemetry leaving your network — the console does not need to reach us to run.
  • Built for air-gapped and egress-restricted networksBecause nothing calls home, the stack runs where outbound internet is blocked or absent. Renewing or upgrading a licence is a new key file dropped into the deployment, not a network round trip.
  • One compose file, the tiers you wantA single bring-up starts the console, Postgres 17, the realtime tier and an internal object store. Opt-in profiles add the async Terraform runner, the application deploy agent, HTTPS on your own domain and a local model server for the AI assistant.
Talk to us about self-hostingSee the free tier limits

Runs free with no licence key at all — a real deployment with hard quotas (1 user, 1 cloud account, 15 inventory resources). A licence lifts them and unlocks SSO, custom roles and multi-org. How Cushy reaches your clouds · Security model

Pricing

Start free. Hosted or self-hosted.

Every tier runs the same console — they differ in where it runs, and in scale, identity and support.

HostedWe run it. Sign up, connect a cloud account, and the console fills with your real data.
Trial
Free
no credit card
Start free
  • 1 cloud account connected
  • Live inventory + topology map
  • Cost dashboard
  • Reachability checks
  • Community docs + support
Most popularPro
Let's talk
priced per org
Talk to us about Pro
  • Everything in Trial
  • All four clouds, unlimited accounts
  • Terraform engine: plan → approve → apply
  • FinOps: FOCUS costs, budgets, anomalies
  • Monitoring, alerts + incident timelines
  • API tokens + pipelines
Enterprise
Custom
annual agreement
Contact us
  • Everything in Pro
  • SAML 2.0 SSO + SCIM provisioning
  • RBAC with audit exports
  • Production approval policies
  • Priority support + SLA (S1–S4)
Self-hostedYou run it, in your own infrastructure. Licensed with a signed key verified offline — no phone-home, air-gap friendly.
Free
$0
no licence key required
Talk to us about self-hosting
  • 1 user
  • 1 cloud account
  • 1 Terraform workspace
  • 15 inventory resources
  • 1 Git connection
  • Runs entirely in your own network
  • SSO, SAML and SCIM
  • Application deploy agents
Lifts every quotaLicensed
Talk to us
signed licence key
Contact sales
  • Everything in Free, quotas lifted
  • More users, workspaces and cloud accounts
  • Unlimited inventory
  • SSO: OIDC, SAML 2.0 + SCIM provisioning
  • More than one organization in your deployment
  • Application deploy agents
  • Support from the team that builds it

Compare all plans → every feature, row by row — quotas, identity, platform and operations.

Cushy — one console for AWS, GCP, Azure & Alibaba Cloud