Cloud remediation output
Every cloud finding ships with its concrete, resource-specific fix: the exact aws / gcloud / az command that removes the exposure, built from the finding's own evidence, with a guardrail to check before you apply it.
Last updated Jul 16, 2026
What it is
Finding a problem is half the job. Umbra does the other half: every cloud finding (across every detectable type on AWS, Google Cloud, and Azure) ships with the concrete change that makes it go away. Not “apply least privilege”: the actual command, built from the finding’s own evidence (its real ARN / resource-id / member / CIDR), ready to copy.
What each remediation carries
- A one-line summary of what the fix does.
- The concrete change: a specific CLI command (
aws/gcloud/az), a policy edit, or a Terraform patch, using the resource’s real identifiers. - A guardrail: what the fix does not do, and what to confirm before applying it (“confirm no legitimate workflow depends on this access first”). A fix that breaks production is worse than none.
For an attack path, the remediation goes further: it gives the exact command for each breakable link (require IMDSv2 on that instance; remove that public IP; scope that role’s read of the named data) so you can choose the cheapest cut.
Read-only: you stay in control
Remediations are generated as output, never applied. Umbra doesn’t touch your cloud. You review the command and the guardrail and run it yourself, so there is no auto-remediation that changes production behind your back.
Honest about the hard cases
A wrong fix is worse than no fix. It’s a false all-clear a team will act on. So where a finding’s evidence can’t yield a precise, copy-pasteable command (for example a resource policy whose full JSON isn’t captured, or a change that needs a maintenance window like re-encrypting a database), Umbra says so and gives the exact next step, never a plausible-looking but wrong command.
Why it matters
The gap between “here’s a critical finding” and “it’s fixed” is where security work stalls. Handing the owning engineer the precise command (with the caveat of what to check first) collapses that gap from a research task to a paste.
How to use it
Open any finding; the remediation is in the drawer with a copy button and the guardrail, and it’s included inline in the PDF posture report so the fix travels with the finding to whoever owns the resource.