CBX Guard
The Verdict Console for infrastructure change — a clear merge verdict on every IaC pull request, before it reaches your cloud.
CBX Guard
Coming soon. CBX Guard is announced and in active development — it is not yet generally available. This guide describes how the product works so you can plan your rollout. Want early access? Talk to us.
CBX Guard is the Verdict Console for infrastructure change. It reviews the Terraform and IaC changes in your pull requests before they reach your cloud, and returns a single, clear merge verdict — Critical, High, Watch, or Clean — on every change.
No new dashboard to babysit, no rule DSL to maintain. CBX Guard reads your repositories and your cloud accounts (read-only by default), understands what a change actually does to your live infrastructure, and tells you — right where you review code — whether it's safe to merge.
The problem it solves
The dangerous infrastructure change rarely looks dangerous in the diff. A one-line edit to a
security group, a flipped publicly_accessible flag, a removed trust condition on an IAM role — each
is a few characters in a .tf file, and each can expose production to the open internet. Generic
linters flag patterns; they don't know whether this change, against your live state, opens
something that was closed.
CBX Guard answers the only question that matters at merge time:
Does this change move something from safe to dangerous, on a resource that is actually reachable, in an account that actually matters?
If the answer is yes, you hear about it loudly. If it isn't, you hear nothing — silence is a feature.
How it works
Connect your repositories
Link GitLab or GitHub. CBX Guard indexes your Terraform, Helm, and GitOps config for context — read-only.
Connect & scan your cloud accounts
Launch a read-only cross-account role and scan it. The captured landscape is what each change is resolved against.
Enable the PR gate
Turn on the optional merge check. It posts a verdict on every PR/MR — opt-in, and the only thing that ever writes to your repo.
Read your verdicts
Understand the four tiers, resolved-effect, and the read-only-first model behind every verdict.
Two lanes review every change. An offline CI gate blocks a dangerous diff inside your pipeline; an independent, server-side account-aware review resolves the same change against your live account and posts its own verdict — sharper, because it sees what's already there. See Two lanes.
What makes it different
- A verdict, not a feed. Most tools bury you in findings. CBX Guard returns one tiered verdict per change, and reserves its loudest signal — Critical — for changes where every condition for real danger is satisfied with facts. The goal is that when it interrupts you, you agree it was worth it.
- Resolved-effect, not pattern-matching. Before judging, CBX Guard resolves the change against your live cloud state — is the resource reachable from the internet? is this a production account? — so the verdict reflects real exposure, not a keyword in a file. See Concepts.
- Read-only by default. Every connection starts from the least privilege that works. CBX Guard reads your repos and assumes a read-only role in your cloud. The only thing it ever writes is the PR check — and that is a separate, explicit opt-in.
- Never silent on real risk. A change CBX Guard can't fully resolve isn't quietly passed — it's surfaced as Watch for a human to look at. Unknown context is reported, never guessed.
Who it's for
CBX Guard is built for the team that owns production infrastructure-as-code and reviews changes through pull requests — platform and DevOps engineers, SREs, and the security engineers who back them. If your Terraform changes go through GitLab or GitHub and land in AWS, CBX Guard sits exactly where you already work: the code review.