Skip to main content
Answers to the most common questions about InfraAudit. For self-hosting issues specifically, see the Troubleshooting page.
InfraAudit supports AWS, Google Cloud Platform, Microsoft Azure, and Kubernetes. You can connect multiple accounts per provider — for example, multiple AWS accounts — and manage them all from the same InfraAudit workspace.For setup instructions, see the Integrations section.
Yes. The Community edition is free, MIT-licensed, and self-hosted. It includes every feature in the documentation: unlimited connected cloud accounts, all cloud providers, all compliance frameworks, AI recommendations (requires a Gemini API key), and full API and CLI access.SaaS editions (Starter, Professional, Enterprise) add managed hosting, longer data retention, and commercial support. See the Editions table for a comparison.
The features are identical across all editions. The differences are operational:
CommunityStarterProfessionalEnterprise
HostingSelf-hostedManagedManagedManaged or self-hosted
ResourcesUnlimitedUp to 50Up to 200Unlimited
SupportCommunity (GitHub)EmailPriority emailDedicated + SLA
Enterprise SSONoNoNoYes
If you’re evaluating InfraAudit, the Community edition gives you the full feature set with no time limit.
Your cloud credentials (AWS access keys, GCP service account JSON, Azure service principal secrets) are encrypted at rest using AES-256-GCM before being stored in the database. The encryption key (ENCRYPTION_KEY) is never written to the database — only to your environment configuration.All scanning is read-only. InfraAudit never modifies your cloud resources during discovery, drift detection, vulnerability scanning, or compliance assessment. Changes only happen through remediation actions, and only when you explicitly approve and execute one.See Secrets and encryption for more detail on how the encryption works.
No. All discovery, scanning, and assessment operations are strictly read-only. InfraAudit can propose remediation actions, but it will not execute them without your explicit approval (controlled by the REMEDIATION_REQUIRE_APPROVAL setting, which defaults to true).
Yes. InfraAudit runs entirely on your infrastructure and only needs outbound network access to reach your cloud provider APIs. The AI recommendation feature requires outbound access to Google’s Gemini API, but if you don’t set GEMINI_API_KEY, it falls back to rule-based recommendations that run fully offline.For Kubernetes deployments in air-gapped environments, you can also configure a custom Trivy database mirror via TRIVY_DB_REPOSITORY.
The default schedule for each background job:
JobDefault schedule
Resource inventory syncEvery 6 hours
Drift detectionEvery 4 hours
Vulnerability scanDaily at 02:00
Cost syncDaily at 03:00
Compliance assessmentDaily at 04:00
You can change any of these by setting the corresponding JOB_*_SCHEDULE environment variable to a cron expression. You can also trigger any scan manually from the dashboard or CLI.
InfraAudit includes built-in support for:
  • CIS AWS Foundations Benchmark
  • CIS GCP Foundations Benchmark
  • CIS Azure Foundations Benchmark
  • SOC 2 (Type II control mapping)
  • NIST SP 800-53
  • PCI-DSS
  • HIPAA
Compliance assessments produce a score and per-control results, with PDF and CSV report export.
Yes, for development and small single-user deployments. Set DB_DRIVER=sqlite and SQLITE_PATH=./infraudit.db. SQLite is not recommended for production — it does not support concurrent writes well and lacks managed backup tooling.
Supabase provides the authentication layer: JWT signing, OAuth with Google and GitHub, and user session management. InfraAudit does not maintain its own user database.A community PR to support an alternative auth backend (e.g. Keycloak or a native user table) would be welcome. See the Contributing guidelines.
Stored cloud credentials become permanently unreadable. You will need to disconnect and reconnect every provider. The credentials themselves (the cloud provider keys) are unaffected — only the copies stored in InfraAudit’s database are inaccessible.Back up your ENCRYPTION_KEY in a secrets manager before going to production.