Platform Architecture
A detailed look at the data flow, integrations, and secure execution mechanisms that power CloudRelo's zero-trust SaaS engine.
1. Ingestion Flow & API Configuration
CloudRelo acts as the central intelligence hub for vulnerability management. When a vulnerability is detected, your scanner forwards the event to our platform in real-time. Here is exactly how that connection is made:
- Wiz: Configure an "Action" in Wiz to send an HTTP POST request to
api.cloudrelo.com/v1/ingest/wiz. Authenticate using a CloudRelo API Key in the Authorization header. - AWS Security Hub: Set up an Amazon EventBridge rule that listens for Security Hub findings and routes them to an EventBridge API Destination pointing to our ingest endpoint, utilizing a secure EventBridge Connection to store the API key.
- GCP Command Center: Configure a Pub/Sub topic for findings with a Push Subscription that pushes real-time events directly to our GCP ingest endpoint.
Real-time Processing Pipeline
When the message first reaches our SaaS app, the API Gateway instantly validates the signature. A serverless ingestion worker normalizes the disparate JSON payloads from Wiz/AWS/GCP into a standard format, and pushes it onto an internal high-throughput message queue (Kafka/PubSub) to trigger the Policy Engine without dropping alerts during traffic spikes.
2. Policy & Guardrail Enforcement
Before taking action, CloudRelo validates the proposed remediation against your uploaded organization policies. Policies are mapped to specific VM groups or the general organization.
Sample Guardrail Rules
- Environment Lock: Only apply automated updates to lower and dev environments.
- Maintenance Windows: Do not update production instances during active business hours.
- Impact Awareness: Only apply simple, non-disruptive patches to production that do not affect the running application.
- Restart Prevention: Do not update production if a kernel restart is required; automatically escalate and request team approval instead.
3. Human-in-the-Loop & Validation
If a guardrail is triggered, the automated loop pauses. A rich notification is sent to Microsoft Teams or Slack channels where security engineers can review the context and click "Approve" or "Reject". Once an action is executed, the agent validates that the target VM is fully up and running, generates a post-remediation report, and logs the evidence.
4. Intelligent Agent Execution
The SaaS relies on an advanced LLM paired with a specialized Vector database to achieve deep contextual awareness before making any changes. Through Retrieval-Augmented Generation (RAG), we continuously feed the vector database with records of previous incidents, actions taken, and the outcomes. We also ingest deep-level security studies, OS documentation, and best practices.
When a vulnerability is detected, the AI Agent pulls related historical incidents and OS-specific precautions. This means when the LLM decides to update a package, it actively avoids known bad patches and respects deep technical nuances, ensuring the generated fix is highly accurate and safe.
To execute changes in AWS without needing open inbound ports, you configure an IAM Role in your AWS Organization or Account that trusts the CloudRelo SaaS AWS Account. The CloudRelo agent uses AWS STS to securely assume this role and receive short-lived credentials. Using these credentials, the agent issues the required patch commands securely via AWS Systems Manager (SSM) Run Command.
CloudRelo acts as an OIDC Identity Provider. You configure a Workload Identity Pool in your GCP Organization or Project that trusts the CloudRelo OIDC issuer. The SaaS maps its identity to a specific GCP Service Account. The agent exchanges its OIDC token for short-lived GCP credentials to access VMs, run patch jobs, and apply updates securely.