Watchdog — Multi-cloud Observability Control Plane

The Problem

A small multi-cloud fleet can accumulate the operational complexity of a much larger platform without the staff to watch every provider console. Health, cost, container pressure, failed jobs, registry growth, and dead-man coverage were scattered — and any automated cleanup path carried more risk than the storage it might reclaim.

The Challenge

Watchdog needed useful cross-cloud visibility without centralising sensitive payloads or granting a monitoring service broad destructive authority. Cloud adapters therefore emit authenticated, closed-schema operational metadata only. Cleanup remains a separate two-system approval protocol: Watchdog presents an exact plan, a human authorises it, and the actuator independently replans and verifies the digest before deleting only approved image digests.

Architecture & System Design

An AWS serverless hub owns ingestion, incident state, schedules, dead-man checks, and notification outboxes in ap-south-1. Independent collectors in Azure Central India and GCP asia-south1 scrub provider events before forwarding bounded snapshots. Detection-only host agents report container and filesystem signals every five minutes. A Next.js dashboard exposes same-origin control APIs behind owner authentication, while Terraform and pinned deployment scripts keep cloud identities and regional boundaries explicit.

Results

The dashboard and AWS hub are deployed, with independent GCP self-monitoring, Azure collector definitions, host and container telemetry, encrypted incident delivery, and exact deep links back to affected resources. The integrated verification gate records 537 passing tests across the hub, dashboard, GCP, Azure, and onboarding surfaces. Watchdog remains detection-first: it can explain and authorise an action, but it cannot silently clean up infrastructure on its own.

Live Demos