FAQ

How Do I Install Hava?

In most instances, you don't need to.

Hava is a cloud-based SaaS, so you just need to enter your read-only credentials generated in your cloud accounts and you're good to go.

Can I Self-Host hava?

Yes - Enterprise clients can host their own copy of hava in the situation where company policy or security requirements prevent 3rd party cloud account access.

How does hava work?

Hava connects to your AWS, GCP and Azure Accounts using a cross-account role or set of read-only credentials. It then polls your configuration settings and renders new diagrams every time your cloud configuration changes.

What Cloud Providers does hava support?

Currently hava will diagram and monitor AWS, GCP and Azure.  As other cloud vendors gain market share, they may be added in the future.

You can now connect stand alone K8s Clusters too.

What account access does Hava need?

We need an AWS cross-account role or a set of Azure or GCP read-only credentials to securely connect hava to your cloud config data. 

We store these using AES Encryption.

You can also apply policy rules to these credentials to restrict access to anything you don't want hava to document.

What Data does hava interrogate?

Hava reads resource configuration data only via the cloud provider APIs. 

We pull the minimum amount of data to establish what resources are configured and how they are connected. 

Hava does not read user data or database content.

Any ultra-sensitive data you want to deny access to can be blocked via custom IAM policies. 

You can chat to our security team on what you do & don't want to visualize on your network diagrams.

What data do you store?

Hava stores metadata related to each running service such as resource ids, config values and current metrics that are required to build current up to date diagrams. We also store snapshots to build historical "Versions" history so you can see the state of your cloud infrastructure at any point in time.

Hava does not read or store any data from within user services or resources.

Any access you wish to deny can be configured within custom IAM/Credential policies of the various cloud provider data sources. 

Do you encrypt data stored in hava?

Of course.

RDS is configured to store all data at rest.

Column level encryption of credential key pairs are also encrypted separately to ensure the cannot be read without a private key from the application server.

This protects against any potential packet injection attacks at an SQL level.

Can you add/remove resources?

No.

Hava provides 100% accurate interactive diagrams.

Once you have the ability to add or remove resources, the resulting diagram and documentation no longer represent the truth.

Because hava diagrams are generated for the source of truth they stand up to any scrutiny and compliance audit process.

Can I style the hava diagrams?

Yes and No!

The interactive diagrams within the application are not editable to ensure the integrity of the diagrams.

You can adjust the spacing and diagram layout via the diagram controls menu.

You can however export the diagrams as images, pdfs, Visio drawings, CSV and even cloudformation JSON.

If you really want to go to town, the hava API will allow you to pull your hava config data to build your own diagrams and reports.

How often should I import?

On Teams and enterprise subscriptions, hava takes care of everything.

Your environments are polled continuously. If a change is detected a new set of diagrams is produced and the previous config is archived.

You can also invoke a sync manually if you have just made infrastructure changes and want to see them visualized prior to the next scheduled sync.

How do I see changes to my infrastructure?

Hava maintains a version history, so you can open interactive diagrams from any point since you connected your cloud accounts.

This allows you to compare now to then and see what changed, which could be invaluable if a problem crops up in your network.

Does hava have API access?

Yes.

The hava API is available on the teams and self hosted enterprise plans.

API documentation is available for subscribers on the eligible subscription levels.

With API access you can use the Hava CLI integrations in your CI/CD pipelines.

Can I tailor the hava dashboard?

When you are part of a large organisation, sometimes your team just needs to focus on one account or network segment containing your project.

Hava allows you to pin environments to the top of the dashboard and switch off the data sources you're not interested in.

You may also assign environments to projects and grant access for specific team members to these projects as well as filter environments showing by cloud provider, project, favourites etc.

How do you keep the diagrams readable?

When you connect your cloud, hava visualizes the major resources, logically laid out by VPC or Virtual Network.

Instead of flooding the infrastructure diagrams with all the metadata, network cards, rule sets and security groups, hava makes that data contextual to the resource you select on the diagram.

You can view the config  minutiae in the attribute panel, so you always have the data you need without a cluttered unreadable diagram.   

How can hava help my security team?

Hava visualizes the security layer of your cloud infrastructure. 

Both Azure and AWS have a unique security view that shows all the security groups, all the open ports and the ingress/egress data so your security team can see at a glance exactly what is going on.

Our Policies don't allow 3rd party connections. Can we still use hava?

Yes. We have a fully self-hosted solution for enterprise clients that delivers a fully functional service without external connections to or from the hava SaaS platform.

Can we get a one on one demo?

Yes, speak to one of our friendly customer success managers to arrange a suitable time to run through hava with your team.

You can reach us via live chat, email or phone.

Can't find the answer you're looking for?

Feel free to drop us a message. We're ready to help answer your questions.