CLI quickstart

The DrillProof CLI answers one question without asking you to sign up for anything: are the backups you already have actually recoverable? It reads your existing backup metadata, checks whether each restore point has ever been test-restored, and prints a Recoverability Score.

It is read-only. It creates nothing, deletes nothing, and never copies data out of your account.

Before you start

AWS credentials on your machine with read access to the services you want to scan — describe/list on EKS, EBS, and RDS is enough.
A region to scan. Start with the one your production workloads run in.

1. Install

# Homebrew
brew install drillproof/tap/drillproof

# or with curl
curl -fsSL https://get.drillproof.com | sh

drillproof --version

Distribution channels are still being set up. The commands above are the intended interface rather than a live download today — book an audit and we will run the same scan with you.

2. Scan a region

drillproof audit scan --region ap-southeast-1

The scan walks every backup-capable resource it can see and reports six columns: what the resource is, whether a backup exists, how old the newest one is, whether it is immutable, and — the column that matters — whether a restore from it has ever been verified.

$ drillproof audit scan --region ap-southeast-1

RESOURCE                TYPE       BACKUP   AGE   IMMUTABLE  RESTORE
payments-db (RDS)       database   ok       6h    no         untested
orders-pv (EKS/EBS)     volume     ok       3h    yes        verified
etcd (prod-cluster)     k8s-state  none     -     -          failed

Recoverability Score: 61/100  (3 critical gaps)
  x etcd for prod-cluster has NO backup
  ! 4 restore points never test-restored ("backed up" != "recoverable")

Fix free: https://drillproof.com/audit

3. Read the result

The three restore states are the whole point of the tool:

verified — a restore from this point completed and was checked. This is the only state that means recoverable.
untested — a backup exists and has never been restored. Most infrastructure lives here, which is why most recovery plans are theoretical.
failed — either no backup exists, or the last restore attempt did not complete.

A score of 61 with three critical gaps is a normal first result. The common findings are cluster state nobody captured, databases with backups that predate the last schema migration, and volumes whose snapshots have never been mounted.

Useful flags

# Scan several regions at once
drillproof audit scan --region ap-southeast-1,us-east-1

# Restrict to one service while you are getting oriented
drillproof audit scan --region us-east-1 --only rds

# Machine-readable, for a CI job or a ticket
drillproof audit scan --region us-east-1 --output json

# Fail a pipeline when recoverability regresses
drillproof audit scan --region us-east-1 --fail-under 80

What the CLI cannot tell you

A scan reads metadata. It can prove a restore point has never been verified, but it cannot prove one would work — only an actual restore does that, which is what a drill is for.

That is the line between this command and the product: the CLI finds the gaps, and scheduled drills close them with dated evidence.

Get a free Restore-Assurance Audit — we test-restore your latest backups and send you the report.
How drills work — the restore, verify, teardown, evidence loop.
Security and access — what the cross-account role can and cannot do.