Hi Product Hunt 👋 I built Infrarails because "are we EU AI Act ready?" kept turning into a scramble through Terraform, screenshots, and Slack threads, with no straight answer. Infrarails reads your AWS Bedrock infrastructure-as-code (Terraform and CloudFormation) and tells you exactly which Article 9 and Article 12 controls pass, fail, or can't be verified, each one cross-referenced to the EU AI Act, NIST AI RMF, and ISO 42001 control it maps to. It runs entirely on your .tf files and CFN templates. Nothing is deployed and no AWS credentials are touched. The thing I care most about: it's honest. It's not an LLM guessing. It's deterministic static analysis, and when it genuinely can't see something (a value behind a variable, a resource in a remote module), it says INCONCLUSIVE instead of a false PASS. For a compliance tool, "we couldn't verify" is the only answer I trust. A few things people seem to like: - One command: npm i -g infrarails, then infrarails ./infra/ - Terraform + CloudFormation through the same rules. Mixed directories just work. - Auditor-ready PDF/HTML, plus SARIF that drops straight into GitHub Code Scanning. - A --plan mode that resolves variables and remote modules for an audit-grade verdict in CI. It's free and Apache-2.0 licensed. SageMaker scanning and a drift-attestation feature (signed, write-once evidence that what you scanned is still running) are next, and there's a waitlist link in the repo. I'd genuinely love feedback, especially from anyone wrestling with AI Act readiness right now. What would make this a no-brainer for your team? I'll be around all day to answer questions.

Infrarails

Catch EU AI Act gaps in your AWS infra before you deploy

Catch EU AI Act gaps in your AWS infra before you deploy