Home / Deployment
Three ways to run Infracast
Choose where collection runs and where data lives: hosted SaaS, SaaS with an on-premises relay, or a standalone disconnected install.
Deployment models
Model 1
SaaS
Hosted on AWS in us-east-1. Connectors reach your cloud accounts through read-only roles. Nothing to install for cloud-only estates.
Model 2
SaaS with on-premises relay
A relay inside your network collects from on-premises systems and sends results out over outbound port 443. No inbound ports are opened.
Credentials for on-premises systems are kept in memory by the relay and never written to disk.
Model 3
Disconnected / air-gapped
A standalone install with no connection to the internet or to the SaaS service. Available as an add-on:
How a disconnected install works
- License: an offline signed license file, imported by an administrator.
- Feed bundles: daily feed bundles are built outside and imported by hand.
- Upgrades: container images are exported with image save and loaded with image load.
What is affected offline
- Threat-intelligence refresh: updates when you import a feed bundle.
- Cloud discovery: cloud connectors need to reach provider APIs, so they do not run in an enclave without that access.
Other functions run locally.
Terraform export boundary
The export generates Terraform from discovered infrastructure for you to review and apply. How far you can trust it to apply cleanly depends on the resource type.
- Apply-grade: core AWS resources: VPC, subnet, security group, EC2, S3, ALB, internet gateway, NAT gateway and Route 53.
- Best-effort output: Azure, Google Cloud and on-premises resources. Anything the export cannot represent is listed in an
UNMANAGED.mdfile.
Review every plan before you apply it.
See it on your own questions
Look at the sample-data demo, run a 14-day trial, or ask for a technical walkthrough with an engineer.