Skip to content
DrillProof
All documentation

CLI quickstart

The DrillProof CLI answers one question without asking you to sign up for anything: are the backups you already have actually recoverable? It reads your existing backup metadata, checks whether each restore point has ever been test-restored, and prints a Recoverability Score.

It is read-only. It creates nothing, deletes nothing, and never copies data out of your account.

Before you start

  • AWS credentials on your machine with read access to the services you want to scan — describe/list/get on EKS, EBS, RDS, S3, DynamoDB, and EFS is enough.
  • A region to scan. Start with the one your production workloads run in.

1. Install

Works today — the source is public, so Go can build it for you:

go install github.com/drillproof/audit/cmd/drillproof@master

That gives you a drillproof binary — the same name Homebrew and the release archives install, so every command below reads the same however you got it.

Once the first release is tagged, these become the normal routes:

# Homebrew
brew install drillproof/tap/audit

# Docker — `audit` is already the entrypoint, so it is not repeated
docker run --rm -v ~/.aws:/root/.aws:ro drillproof/audit:latest scan --region ap-southeast-1

# Go, at a tagged version
go install github.com/drillproof/audit/cmd/drillproof@latest

Check what you have:

drillproof audit version

Homebrew and Docker are not published yet — the go install line above is the only live download today. The source is at github.com/DrillProof/audit; you can also book an audit and we will run the same scan with you.

2. Scan a region

drillproof audit scan --region ap-southeast-1

The scan walks every backup-capable resource it can see and reports six columns: what the resource is, whether a backup exists, how old the newest one is, whether it is immutable, and — the column that matters — whether a restore from it has ever been verified.

$ drillproof audit scan --region ap-southeast-1

RESOURCE                TYPE       BACKUP   AGE   IMMUTABLE  RESTORE
payments-db (RDS)       database   ok       6h    no         untested
orders-pv (EKS/EBS)     volume     ok       3h    yes        verified
etcd (prod-cluster)     k8s-state  none     -     -          failed

Recoverability Score: 61/100  (3 critical gaps)
  x etcd for prod-cluster has NO backup
  ! 4 restore points never test-restored ("backed up" != "recoverable")

Fix free: https://drillproof.com/audit

3. Read the result

The three restore states are the whole point of the tool:

  • verified — a restore from this point completed and was checked. This is the only state that means recoverable.
  • untested — a backup exists and has never been restored. Most infrastructure lives here, which is why most recovery plans are theoretical.
  • failed — either no backup exists, or the last restore attempt did not complete.

A score of 61 with three critical gaps is a normal first result. The common findings are cluster state nobody captured, databases with backups that predate the last schema migration, and volumes whose snapshots have never been mounted.

Useful flags

# Scan several regions at once
drillproof audit scan --region ap-southeast-1,us-east-1

# Restrict to one service while you are getting oriented
drillproof audit scan --region us-east-1 --only rds

# Machine-readable, for a CI job or a ticket
drillproof audit scan --region us-east-1 --output json

# Fail a pipeline when recoverability regresses
drillproof audit scan --region us-east-1 --fail-under 80

What the CLI cannot tell you

A scan reads metadata. It can prove a restore point has never been verified, but it cannot prove one would work — only an actual restore does that, which is what a drill is for.

That is the line between this command and the product: the CLI finds the gaps, and scheduled drills close them with dated evidence.

Next

Would rather we ran it?

We will test-restore your latest backups and send the report.

Get a free audit