Security sentinel for AWS and Kubernetes
Firekeeper watches your AWS accounts and EKS clusters from inside your own cluster. It reads through read-only roles, keeps a receipt for every read, and reports only what it can prove.
curl -fsSL https://firekeeper.sh/install | shNot released There is no release yet. Today the script prints the status and changes nothing.
Two natures
Firekeeper has two natures. Watch is the default. Defend is optional and in development.
It reads. It does not write.
Read-only. On a schedule, Firekeeper reads your AWS accounts and clusters through read-only roles and keeps a receipt for every read. Rules turn the evidence into findings, and every finding links to the records that prove it.
It acts only when you say so.
Optional runtime defense: a small set of reversible actions, each signed by an operator and recorded. It is not built yet.
How it works
On a schedule, the hub reads each account and cluster through the read-only roles you created. Every read leaves a receipt.
Rules turn evidence into findings. Every finding links to the records that prove it. A run also states plainly what it could not check.
One AI model writes up the findings. A second model, from a different maker, has one job: to refute the first. If that check fails, the report falls back to the rules alone.
Yours to run
Firekeeper runs inside your own cluster under roles you create. Every permission it holds is one you granted.
Your license is a signed file, checked offline when Firekeeper starts. Nothing calls back to us.
An estate is one AWS organization and the EKS clusters in it. One hub watches the whole estate.