Security

How access works

You create an IAM role called FramzCostAuditReadOnly in your account, using our CloudFormation template or your own Terraform. Its trust policy allows only our auditor account to assume it, and only when presenting your unique ExternalId, which is the standard defence against confused-deputy attacks. Sessions use temporary STS credentials capped at an hour. We never ask for access keys and there is no password to hand over.

What the role cannot do

• Read S3 object contents. It sees bucket names, sizes and lifecycle settings
• Read database contents. It sees instance metadata and utilisation metrics
• Read Secrets Manager values or KMS key material. It sees counts and metadata
• Read CloudWatch log contents. It sees log group names, sizes and retention
• Create, modify, stop or delete anything at all
• Reach your account once you have deleted the role

The exact permissions

The role carries the AWS managed policy ViewOnlyAccess. We chose that over ReadOnlyAccess on purpose, because ViewOnlyAccess cannot read S3 object contents. On top of it sits this inline policy, covering the cost and lifecycle APIs that ViewOnlyAccess misses:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CostAndBilling",
      "Effect": "Allow",
      "Action": [
        "ce:Get*", "ce:Describe*", "ce:List*",
        "cur:Describe*",
        "budgets:View*", "budgets:Describe*",
        "account:GetAccountInformation",
        "billing:Get*",
        "pricing:Get*", "pricing:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OptimizationServices",
      "Effect": "Allow",
      "Action": [
        "compute-optimizer:Get*", "compute-optimizer:Describe*",
        "trustedadvisor:Describe*", "trustedadvisor:List*",
        "support:DescribeTrustedAdvisor*",
        "servicequotas:Get*", "servicequotas:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "MetricsAndLogsMetadata",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "logs:DescribeLogGroups",
        "logs:DescribeSubscriptionFilters"
      ],
      "Resource": "*"
    },
    {
      "Sid": "LifecycleAndConfigDetails",
      "Effect": "Allow",
      "Action": [
        "s3:GetLifecycleConfiguration",
        "s3:GetBucketVersioning",
        "s3:GetIntelligentTieringConfiguration",
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets",
        "dlm:Get*",
        "backup:List*", "backup:Describe*",
        "organizations:Describe*", "organizations:List*"
      ],
      "Resource": "*"
    }
  ]
}

And the trust policy:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::<our-auditor-account>:root" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "<unique-per-customer>" } }
  }]
}

Revocation

Delete the FramzCostAudit CloudFormation stack, or the role itself, and access ends that second. You do not need to email us or raise a ticket.

Data handling

• •Findings and metadata are stored encrypted at rest; sensitive connection values (your ExternalId) carry an extra AES-256-GCM application layer.
• •Findings are deleted automatically 90 days after your audit closes, or 90 days after the scan if you never buy the audit.
• •Your scan results are shown to you and to the auditor. No third parties, no resale, no training datasets.