STEP 1
Connect AWS
Create the connection and launch the provided CloudFormation stack.
// ~/docs
How PingTraceSSH Cloud Works
A practical guide to AWS discovery, Critical Path assurance, Terraform analysis, and operational alerts.
01
Getting Started
Start with one AWS account, establish a read-only connection, and create a baseline before evaluating change.
STEP 2
Verify the role
Confirm PingTraceSSH can assume PingTraceSSHReadOnlyRole.
STEP 3
Run the first scan
Discover current AWS network configuration and establish a snapshot.
STEP 4
Read the dashboard
Review topology, scan health, changes, and Critical Path results.
02
AWS Discovery
PingTraceSSH calls read-only AWS APIs to discover the network configuration metadata needed to build a model of the connected environment.
- VPCs
- Subnets
- Route tables
- Internet gateways
- NAT gateways
- Transit Gateways
- TGW attachments
- TGW route tables
- VPN connections
- Security groups
The role contains no write actions. See the exact IAM permissions and access boundaries.
03
Network Snapshots
Each completed scan records a point-in-time view of the discovered network configuration. PingTraceSSH compares snapshots to identify configuration changes and reevaluate the paths that matter.
SCHEDULED
Every 15 minutes
Regular scans keep the stored model aligned with the connected AWS environment.
ON DEMAND
Scan Now
Run a fresh discovery scan when you need to verify a recent change immediately.
COMPARISON
Change detected
Successive snapshots reveal network configuration changes and drive post-change assurance.
04
Critical Paths
A Critical Path is a customer-defined reachability expectation from a source VPC to a destination CIDR. It turns network topology into a concrete assurance question.
SOURCE VPC
Where traffic begins
ROUTE EVALUATION
Modeled network hops
DESTINATION CIDR
Expected destination
PASS
Reachable
The modeled path can reach the configured destination.
FAIL
Not reachable
The model cannot establish the configured path through the discovered network state.
Critical Paths focus scans and Terraform analyses on business-relevant connectivity instead of treating every infrastructure change as equally important.
05
Terraform Pre-Change Assurance
PingTraceSSH evaluates proposed AWS network state before infrastructure changes are applied.
- Terraform plan
- Proposed state modeled
- Critical Paths evaluated
- Result classified
- HCP result returned
SAFE
No configured Critical Path becomes newly unreachable.
REGRESSION
At least one currently healthy Critical Path would fail after the proposed change.
INCONCLUSIVE
PingTraceSSH cannot prove the result safely, so the analysis fails closed.
06
HCP Terraform
The HCP Terraform Run Task integration invokes PingTraceSSH automatically at the post-plan stage. No manual plan upload is required for a connected workspace.
ADVISORY
Visible assurance
The result is attached to the run for review without enforcing the apply decision.
MANDATORY
Enforced assurance
A failed result can block apply. REGRESSION and INCONCLUSIVE results fail closed.
Signed requests are verified before a run is processed. Read more about Terraform security.
07
Analysis Details
Every completed Terraform analysis provides the evidence behind the result rather than only a pass or fail label.
- Current and proposed path status
- Affected Critical Path
- Reason for the result
- Changed Terraform resource
- Create, update, delete, or replace action
- Link back to the HCP Terraform run
- Unresolved references for inconclusive results
08
Alerting
Slack and email alerts cover new network regressions, recoveries, scan failures, and Terraform regressions. Alert delivery and history are available in the Cloud product.
STATE-CHANGE DRIVEN
The first observation establishes a baseline. PingTraceSSH alerts when a path changes from PASS to FAIL or later recovers from FAIL to PASS—not on every routine scan.
09
AWS Onboarding
From the Cloud Dashboard, create an AWS connection and select Launch Stack. The provided CloudFormation template creates PingTraceSSHReadOnlyRole with the required read-only actions and customer-specific External ID.
Launch Stack
CloudFormation
PingTraceSSHReadOnlyRole
External ID
Verify
No AWS access keys are requested or stored. Review the AWS access model before connecting an account.
10
Frequently Asked Questions
Is PingTraceSSH available today?
Yes. PingTraceSSH Cloud is live for teams operating AWS network infrastructure, with a 14-day free trial (no credit card required).
What does PingTraceSSH Cloud cost?
$299 USD per month. Founding customers keep that price for 12 months and can cancel anytime.
Does PingTraceSSH make changes in my AWS account?
No. The AWS role contains read-only discovery actions. PingTraceSSH models and evaluates network configuration but does not modify it.
Does PingTraceSSH require AWS access keys?
No. The scanner assumes a customer-managed IAM role with a customer-specific External ID and receives temporary AWS STS credentials.
What happens if an analysis is inconclusive?
PingTraceSSH returns INCONCLUSIVE when it cannot prove the proposed result safely. HCP Terraform receives a failed result so Mandatory enforcement fails closed.
Does Mandatory mode block Terraform applies?
It can. In Mandatory mode, a REGRESSION, INCONCLUSIVE result, or processing failure is returned to HCP Terraform as failed and can prevent the apply from proceeding.
How often does PingTraceSSH scan AWS?
PingTraceSSH Cloud includes scheduled scans every 15 minutes and an on-demand Scan Now control.
What happens if I cancel my subscription?
New paid processing pauses when the subscription becomes inactive. AWS connections, snapshots, Critical Paths, and analysis history are preserved.
Which Terraform resources are supported today?
Current modeling covers AWS VPCs, subnets, routes, route tables and associations, plus Transit Gateways, VPC attachments, routes, route tables, associations, and propagations.
Ready to evaluate your environment?
Start a 14-day free trial, or subscribe to PingTraceSSH Cloud for $299 per month.