Your AWS account outgrew human attention years ago. Polylane keeps watch on all of it.
Polylane pulls your AWS resources into one graph, reads CloudWatch, and fixes what breaks.
Get started for freeEverything Polylane picks up.
What Polylane reads from your AWS account.
Lambda Function Lambda Layer 
EC2 Instance 
VPC Subnet Security Group Internet Gateway NAT Gateway Route Table Network ACL EBS Volume Elastic IP 
S3 Bucket 
DynamoDB Table 
RDS Instance 
CloudFront Distribution 
API Gateway REST API API Gateway v2 API API Gateway Custom Domain 
SQS Queue 
SNS Topic 
ECS Cluster ECS Service ECS Task Definition 
ElastiCache Cluster 
App Runner Service App Runner Connection 
IAM Role 
KMS Key 
Kinesis Stream ElastiCache Replication Group RDS Cluster RDS Proxy Service Discovery Service 
Secrets Manager Secret 
EventBridge Rule EventBridge Bus 
Step Functions State Machine 
Redshift Cluster 
Kinesis Firehose 
Neptune Cluster 
Cognito User Pool Cognito Identity Pool 
Athena Workgroup 
Glue Database Glue Crawler Glue Job 
Batch Job Queue Batch Compute Environment 
Amazon MQ Broker 
MSK Cluster 
DocumentDB Cluster MemoryDB Cluster 
CloudTrail Trail GuardDuty Detector 
WAF Web ACL 
ACM Certificate 
EKS Cluster EKS Node Group EKS Fargate Profile EKS Addon EKS Access Entry EKS Identity Provider EKS OIDC Provider 
Elasticsearch Domain OpenSearch Domain EventBridge Pipe 
Amplify App 
Application Load Balancer Network Load Balancer Gateway Load Balancer Target Group Load Balancer Listener Listener Rule Glue Table Too big to watch by hand.
Every Lambda, queue and VPC
Lambda, ECS, RDS, DynamoDB, SQS, SNS, EventBridge, Step Functions, VPCs and EKS all land in one graph, with how they connect, how they're configured and what changed. When one fails, Polylane already knows what depends on it.
Read-only, by construction
Connecting is one CloudFormation stack that creates an IAM role with the AWS-managed ReadOnlyAccess policy. No write, delete or modify permissions, only Polylane's account can assume it, and you can read the template before you create it.
Alarms that investigate themselves
Point your CloudWatch Alarms at Polylane. When one fires, Polylane starts investigating immediately, so the alarm arrives with an explanation attached.
CloudWatch, read for you
Polylane reads your metrics, logs and X-Ray traces around the clock and judges them against how each resource normally behaves. No thresholds to tune.
What changed, and when
Polylane records what appeared, changed or disappeared across the account. When something breaks minutes after an infrastructure change, the investigation starts from that change.
The fix, on the right repo
When the root cause is a line of code, Polylane writes the fix on the repo behind the service, with the evidence attached.
These prompts already work. Copy one, swap your own service name in, and run it.
Give it to your coding agent and let it cook.
“Review PR #241 against production: what does it deploy to, and what breaks if it merges?” “If checkout-api goes down, what goes down with it? Walk the graph and rank by traffic.” 
“We're renaming the orders table tonight. Which services, queries, and crons touch it?” 
“P99 on checkout-api doubled at 14:10. Find the cause and show the evidence.” Use AWS with any coding agent. Polylane connects them.
Connect your agent to Polylane once and it can query AWS alongside the rest of your stack.
Guides and fixes for AWS
- Blog Turn your app into a context graph Agents that run software need a context graph of the app: every resource, what it connects to, the repository that deploys it and the team that owns it. How we built one on Durable Objects, keep it fresh across every provider without polling AWS, decide what counts as a change, and delete from it safely.
- Guide Amazon Bedrock Managed Agents (OpenAI preview): setup and limits Amazon Bedrock Managed Agents, powered by OpenAI, entered preview on 29 Sep 2026. What it is, how to run a first session, and the preview limits to plan for.
- Guide How to attach Vercel Sandbox to a Secure Compute network Vercel Sandbox now supports Secure Compute. Attach a sandbox to your network for static egress IPs and VPC peering, with steps, costs and gotchas.
- Guide Is It Safe to Give an AI SRE Read Access to Production? Read access for an AI SRE is a sound first step if you scope it. The risks are secrets, customer data and exfiltration. Here are the controls and a checklist.
Common questions.
Is Polylane an AI SRE for AWS?
It does that work, though we call it self-operating software. Polylane keeps your Lambda functions, ECS services and RDS databases in one graph, investigates what breaks and fixes it with your approval, so the account looks after itself.
How does Polylane connect to my AWS account?
Through a CloudFormation stack: enter your account ID and region, review the pre-loaded template, create it. The stack sets up a read-only IAM role, and your resources show up within minutes.
Is it really read-only?
Yes. The role carries AWS's managed ReadOnlyAccess policy and nothing else, and only Polylane's account can assume it. The template is open, so you can read it first.
What AWS resources does Polylane sync?
Lambda, EC2, VPC, S3, DynamoDB, RDS and Aurora, ECS, EKS, SQS, SNS, EventBridge, Step Functions, CloudFront, API Gateway, load balancers, and more. The full list is on this page.
What happens when a CloudWatch alarm fires?
Opt in when you connect and Polylane subscribes to the account's alarms. When one fires, Polylane investigates it against recent changes and everything connected to the resource.
Does it work with my observability provider?
Yes: Datadog, Sentry, Honeycomb, Axiom, Grafana Cloud, Logfire, Better Stack and OpenStatus. Forward their alerts and Polylane triages each one.
What does it cost?
There's a free plan, and paid plans start at $80 a month. On Scale and above you can switch on pay-as-you-go beyond the included credits. Every limit is published at polylane.com/pricing.