Security & Trust

How GetInfraDesk connects to your AWS account

GetInfraDesk connects via a read-only IAM role. We scan. We suggest. We document. Nothing changes in your AWS account until your team explicitly approves it.

✓ Read-only IAM scan
✓ CloudFormation setup — no credential sharing
✓ External ID protected
✓ No changes during scan
✓ Approval required before every fix
✓ Revoke in 60 seconds
👁️
Read-only IAM access
🚫
No production changes during scan
✋
Approval required before every fix
🗑️
Revoke access anytime from AWS Console
Read-only by default

GetInfraDesk scans. Your team decides. Nothing changes without approval.

During every scan, GetInfraDesk uses read-only AWS permissions. It reads resource metadata, cost data, CloudWatch metrics, and tag information to build your waste report. It does not modify, stop, delete, or change any AWS resource during scan.

Supported cleanup actions are presented as a fix plan in your Waste Inbox. Each action requires your explicit approval before anything is executed. You decide what to act on and when.

Data access

What GetInfraDesk reads

EC2
Instance state, type, launch time, tags
EBS
Volume state, size, attachment status, tags
RDS
Instance state, engine, size, tags
Elastic Load Balancing
Load balancer state, target group health
Elastic IPs
Allocation and association status
Cost Explorer
Monthly and daily cost and usage data
CloudWatch
CPU and network metrics for idle detection
Resource Groups Tagging
Tag keys and values for owner gap analysis
IAM (read-only)
GetCallerIdentity to verify role assumption
Organizations (optional)
Account list for multi-account org discovery

What GetInfraDesk never reads

✗Application source code or repositories
✗S3 bucket contents or object data
✗Secrets Manager or Parameter Store values
✗Database contents or query data
✗CloudTrail log contents
✗VPC traffic or network packet data
✗IAM user passwords or access keys
✗KMS key material
✗Personal data or PII stored in AWS
AWS access

How AWS access works

1
You deploy a read-only CloudFormation stack
A one-click CloudFormation template creates a read-only IAM role in your AWS account. The template is open-source on GitHub — review every permission before you deploy a single resource.
2
GetInfraDesk assumes the role with External ID
GetInfraDesk uses AWS STS AssumeRole with a unique External ID embedded in your role trust policy. This prevents any other AWS account from assuming your role — even if they know the role ARN.
3
Scan runs with read-only access
GetInfraDesk reads resource metadata, cost data, and CloudWatch metrics. No credentials are stored. The temporary session expires automatically.
4
You review the waste report
Your Waste Inbox shows idle resources with evidence, monthly cost, and risk level. Supported fix plans require your explicit approval before anything executes.
The CloudFormation template is open-source. Review it on GitHub →
External ID — Confused Deputy Protection

What is the External ID?

When GetInfraDesk assumes your IAM role using AWS STS, it must provide a unique External ID that matches the one embedded in your role trust policy. This is a security mechanism that prevents the confused deputy attack.

How confused deputy protection works:
1
Without External ID — any AWS account that knows your role ARN could potentially assume it.
2
With External ID — even if someone knows your role ARN, they cannot assume it without the secret External ID that only GetInfraDesk knows.
3
Your External ID is unique to your GetInfraDesk account and is embedded in the CloudFormation template during setup.
✓ The External ID is generated uniquely per GetInfraDesk account. You cannot use one customer's External ID to access another customer's AWS account.
IAM Policy — Read-only Scan Role

The exact permissions GetInfraDesk requests

Every permission in the read-only scan role is listed in the open-source CloudFormation template. Here is the scope of what GetInfraDesk can read during a scan:

// Read-only scan role — selected actions
"ec2:Describe*", // instance state, volumes, IPs, SGs
"rds:Describe*", // instance state, engine, size
"elasticloadbalancing:Describe*", // LB state, target groups
"cloudwatch:GetMetricStatistics", // CPU, network — idle detection
"ce:GetCostAndUsage", // cost data only
"tag:GetResources", // tag key/value pairs
"sts:GetCallerIdentity", // verify role assumption
"organizations:ListAccounts", // multi-account discovery (optional)
// No s3:GetObject, no secretsmanager:*, no iam:* write actions
View full policy on GitHub →View IAM permissions doc →
Cleanup / Remediation Role

The cleanup role is separate — and approval-gated

The read-only scan role cannot make any changes. If you choose to use GetInfraDesk's approval-based fix plans, a separate, scoped cleanup role is deployed with only the minimum permissions needed for the specific actions you approve.

✓The cleanup role is opt-in — you deploy it only if you want to use fix plans.
✓Fix actions only execute after your explicit approval in the GetInfraDesk dashboard.
✓The cleanup role is scoped to the minimum permissions needed — not a broad admin role.
✓Every action taken via the cleanup role is logged in your audit trail with timestamp and approver.
⚠ The scan role and the cleanup role are completely separate IAM roles. Deploying the scan role does not give GetInfraDesk any write access.
Revoke access

Remove GetInfraDesk access anytime

You can remove GetInfraDesk access to your AWS account at any time by deleting the CloudFormation stack.

1
Open AWS Console → CloudFormation → Stacks
2
Find the stack named InfraDeskAccess-* (or the name you chose)
3
Select the stack → click Delete
4
Confirm deletion — the IAM role is removed immediately
✓ Revoking access does not delete or modify any AWS resource. Your existing reports remain in GetInfraDesk.
Full revoke instructions →
Data handling

What GetInfraDesk stores

AWS credentials
Never stored. Role-based access only.
Resource metadata
Stored to generate your waste report (instance IDs, sizes, tags, state).
Cost data
Monthly and daily spend stored for reporting.
CloudWatch metrics
Used for idle detection. Not stored long-term.
S3 contents
Never accessed or stored.
Database data
Never accessed or stored.
Secrets or keys
Never accessed or stored.
FAQ

Security questions

Can GetInfraDesk delete my AWS resources?
No. During scan, GetInfraDesk uses read-only permissions only. For supported cleanup actions, GetInfraDesk shows you a fix plan. You must explicitly approve each action. Nothing is executed without your approval.
Does GetInfraDesk store my AWS credentials?
No. GetInfraDesk never stores AWS access keys, secret keys, or permanent AWS credentials. AWS access is handled through a cross-account IAM role with External ID and temporary STS credentials. The temporary session expires automatically after use. We store only the minimum metadata required to show cost, resource, usage, evidence, and action history.
What is the External ID and why is it required?
The External ID is a unique string added to your IAM role trust policy. It prevents the confused deputy attack — ensuring only GetInfraDesk can assume the role, not any other AWS account that might guess the role ARN.
How do I revoke GetInfraDesk access?
Delete the CloudFormation stack named InfraDeskAccess-* from your AWS Console. This removes the IAM role immediately. GetInfraDesk cannot access your account after the role is deleted.
Does revoking access delete my data or reports?
No. Revoking access only removes GetInfraDesk ability to scan your account going forward. Your existing waste reports remain accessible in your GetInfraDesk dashboard.
Can I review the CloudFormation template before deploying?
Yes. The full CloudFormation template is open-source and available on GitHub. You can review every permission before deploying.
Does GetInfraDesk access my S3 data or database contents?
No. GetInfraDesk reads resource metadata only — instance state, volume size, tags, cost data. It never reads S3 object contents, database data, secrets, or application code.
What happens if I approve a fix and something goes wrong?
For supported actions, GetInfraDesk shows pre-action context before execution. Some actions support snapshot-based recovery where available. All approved actions are logged in your audit trail. GetInfraDesk does not guarantee rollback for all resource types — review the pre-action context before approving.

Ready to connect your AWS account?

Read-only access. No production changes during scan.

Scan My AWS Account Free →View IAM permissions →