Methodology: exactly what we read from your account

Why we publish this

Granting access to a company's AWS account is a security decision, and a security decision needs verifiable detail rather than a promise. This page lists every call we make. Neither list below is written by hand: both are read from the same code that performs the calls — the role's CloudFormation template and the open-source CLI's action list — so they cannot drift from what the product actually does.

Path 1: assumed role

You deploy a read-only role via CloudFormation and we assume it with an ExternalId unique to your account. These are the permissions that role grants, grouped as they appear in the template. Every action is List, Read or Describe, enumerated one by one — there is no wildcard anywhere.

• CostExplorerRead

  Cost Explorer — commitment coverage / spend (rule COMMIT-C001).

  • ce:GetCostAndUsage
  • ce:GetReservationUtilization
  • ce:GetReservationCoverage
  • ce:GetSavingsPlansUtilization
  • ce:GetSavingsPlansCoverage

• EC2Read

  EC2 inventory — idle instances, orphan volumes, snapshots, EIPs, NAT. DescribeRegions lets us scan every enabled region, not just one.

  • ec2:DescribeRegions
  • ec2:DescribeInstances
  • ec2:DescribeVolumes
  • ec2:DescribeAddresses
  • ec2:DescribeSnapshots
  • ec2:DescribeNatGateways
  • ec2:DescribeRouteTables

• RDSRead

  RDS inventory — idle databases, snapshots, reservations.

  • rds:DescribeDBInstances
  • rds:DescribeDBSnapshots
  • rds:DescribeReservedDBInstances

• S3Read

  S3 — bucket list + lifecycle config only (never object contents).

  • s3:ListAllMyBuckets
  • s3:ListBucket
  • s3:GetLifecycleConfiguration
  • s3:ListBucketMultipartUploads
  • s3:ListMultipartUploadParts

• CloudWatchRead

  CloudWatch — utilization metrics for "idle resource" rules.

  • cloudwatch:GetMetricData
  • cloudwatch:GetMetricStatistics

• LambdaRead

  Lambda — function inventory.

  • lambda:ListFunctions

• CloudFrontRead

  CloudFront — cross-check before recommending an S3 bucket removal (never suggest deleting a bucket that serves a live distribution).

  • cloudfront:ListDistributions

• ELBRead

  Load balancers — detect idle ALB/NLB with no healthy targets.

  • elasticloadbalancing:DescribeLoadBalancers
  • elasticloadbalancing:DescribeTargetGroups
  • elasticloadbalancing:DescribeTargetHealth

• LogsRead

  CloudWatch Logs — log groups with no retention accumulate forever.

  • logs:DescribeLogGroups

• DynamoDBRead

  DynamoDB — provisioned tables sitting idle versus their capacity.

  • dynamodb:ListTables
  • dynamodb:DescribeTable

• Route53Read

  Route 53 — hosted zones billing a flat fee while hosting nothing.

  • route53:ListHostedZones

• SelfPolicySimulation

  Self-diagnosis of a missing permission, scoped to this role only.

  • iam:SimulatePrincipalPolicy

Path 2: open-source CLI

If you would rather not create a role at all, the CLI runs on your machine with credentials you already hold, collects a snapshot, and uploads only the snapshot. The source is open and auditable, and these are the only calls it makes.

• ce:GetCostAndUsage
• ec2:DescribeRegions
• ec2:DescribeInstances
• ec2:DescribeVolumes
• ec2:DescribeSnapshots
• ec2:DescribeAddresses
• ec2:DescribeNatGateways
• ec2:DescribeRouteTables
• rds:DescribeDBInstances
• rds:DescribeDBSnapshots
• s3:ListAllMyBuckets
• s3:GetBucketLocation
• s3:GetLifecycleConfiguration
• s3:ListBucketMultipartUploads
• s3:ListMultipartUploadParts
• cloudfront:ListDistributions
• cloudwatch:GetMetricStatistics
• elasticloadbalancing:DescribeLoadBalancers
• elasticloadbalancing:DescribeTargetGroups
• elasticloadbalancing:DescribeTargetHealth
• logs:DescribeLogGroups
• dynamodb:ListTables
• dynamodb:DescribeTable
• redshift:DescribeClusters
• route53:ListHostedZones
• sts:GetCallerIdentity

Why the two lists are not identical

They are different access paths with different capabilities, and the difference is deliberate. The assumed role can query reservation and savings plan data through Cost Explorer, which feeds the commitment coverage analysis; the local CLI does not request those permissions. The CLI, in turn, needs to identify itself and resolve bucket regions, which the role obtains by other means. Listing them separately is more honest than presenting a union that matches neither case.

What we never do

• No write, modify or delete action — on either path.
• We do not read the contents of your objects, databases or logs: configuration metadata and usage metrics only.
• We do not run the fix commands for you. The report shows the command; running it is your call.

See also the security guarantees and access model