for builders shipping to AWS with coding agents — no devops team required
Your agent deploys. Waypointer verifies — before apply and after. Independent, read-only, no migration.
Waypointer scans your AWS, you confirm the map once — and every plan your agent writes is checked against it.
Read-only IAM role · nothing to migrate · five minutes to connect
The problem
The code it writes is just plumbing — you never read it. Waypointer turns every change into a plain verdict: what, where, which app, what’s untouched.
The plan is checked against what is actually running — not against a state file that may already be wrong. The verdict is in plain words: app, environment, what’s affected — no Terraform to read.
Valid Terraform aimed at the primary instance stops here.
“Apply complete” doesn’t mean reality matches — timeouts, half-applied changes and silent defaults happen. Waypointer reads AWS after every apply and shows what actually landed.
Two resources promised, one created — you hear it from us, not from the bill.
You don’t start from zero — even a month later. The map is waiting: every resource, its app, its environment, and the history of what changed while you were away.
“What did we do to billing last week?” — answered before you finish typing it.
How Waypointer knows what your agent is touching
Repo, application, environment, cloud account — joined once and kept joined. Your agent works across the top; Waypointer runs underneath and checks every link it touches.
“What if I already have a cloud full of resources — and nothing linking them?”
That’s the default, and that’s what the Sherlock skill is for: your agent deduces which resource belongs to which app and environment — and shows you the evidence. You just confirm.
Security
Cross-account role with a least-privilege policy: describe/list only, no data-plane reads, no PassRole, scoped by ExternalID.
No create, modify, or delete permissions exist on the role. Blocking happens in your agent — Waypointer only returns the verdict.
Deploys run with your agent’s credentials on your machine. Waypointer never holds write access to your AWS.
“If Waypointer is read-only — how does it stop anything?”
It doesn’t need write access to stop a mistake: your agent checks with Waypointer before it applies, and a “do not apply” verdict is the stop. Waypointer never writes to AWS — deploys run with your agent’s credentials, on your machine.
$ npx @waypointer/cli connect
Read-only IAM role · nothing to migrate · private beta