How KloudSense Accesses AWS
A high-level overview of our connection architecture. KloudSense uses standard AWS security protocols—ephemeral STS role assumption, cryptographic External IDs, and strictly read-only policies—to evaluate cost telemetry with zero disruption to your production workloads.
AWS STS AssumeRole Handshake
Industry-standard cross-account role assumption via AWS Security Token Service. No static keys or passwords.
Unique Cryptographic External ID
Guarantees confused deputy immunity via customer-scoped sts:ExternalId conditions in the trust policy.
Temporary Ephemeral Credentials
Tokens are issued by AWS for a maximum duration of 1 hour, auto-expire immediately, and cannot be reused.
Dedicated Read-Only IAM Role
Enforces AWS-managed SecurityAudit policies. Zero write, modification, or deletion privileges.
Encrypted In Transit (TLS 1.3)
All telemetry calls to standard AWS API endpoints run over TLS 1.3 with cryptographic payload signing (SigV4).
CloudTrail Auditability
Every single API call initiated by KloudSense is logged in your AWS account's CloudTrail event history.
High-Level 4-Step Connection Flow
How KloudSense safely accesses your AWS environment without installing any agents or software.
Customer AWS Account Setup
Your team provisions a dedicated, cross-account IAM role in your AWS account. This can be launched using AWS CloudFormation or configured manually in the AWS Console. No software, daemons, or VPC peering are deployed.
AWS STS AssumeRole Handshake
When an audit is initiated, KloudSense contacts AWS Security Token Service (STS) requesting temporary session credentials. AWS verifies the trust relationship and checks that the unique tenant External ID matches before granting access.
Ephemeral Read-Only Telemetry Retrieval
AWS issues temporary credentials valid for a maximum of 1 hour. Using read-only AWS APIs, KloudSense inspects resource specifications and CloudWatch metric summaries. Customer application data, databases, and files are never accessed.
KloudSense Audit Engine & Expiration
Telemetry is processed deterministically in stateless memory to compute rightsizing and waste findings. Once the scan completes, ephemeral credentials expire automatically. Your engineers receive an actionable remediation roadmap.
What KloudSense Accesses vs. Never Touches
Strict isolation ensures your proprietary applications, user data, and production services remain untouched.
Read-Only Telemetry (What We Read)
High-level configuration metadata and aggregate metrics required to calculate cost waste:
- • Resource Inventory: Instance types, volume sizes, database engines, and storage tiers.
- • Utilization Metrics: Aggregate CloudWatch statistics (CPU utilization, IOPS, network transfer).
- • Billing Summaries: AWS Cost and Usage Reports (CUR) and pricing discount coverage.
Strictly Excluded (What We NEVER Access)
Hard boundaries enforced by AWS IAM policy permissions:
- • Customer Data & DBs: Zero access to database records, SQL tables, or query execution.
- • Storage Contents: Zero access to S3 object contents, files, or application code.
- • Secrets & Keys: Zero access to Secrets Manager, KMS customer master keys, or IAM credentials.
- • Modifications: Zero ability to stop, restart, modify, reconfigure, or delete any resource.
CloudTrail Auditability
Every single action performed during the audit is recorded in your AWS account's CloudTrail. Your security and compliance teams can inspect the exact API calls, request timestamps, and IP addresses at any time.
Instant Revocation at Any Time
You maintain full sovereignty over your AWS account. You can revoke KloudSense's access instantly at any moment by deleting the IAM role or CloudFormation stack directly from your AWS Management Console, or via AWS CLI:
aws cloudformation delete-stack --stack-name KloudSenseAuditRole
Request an AWS Audit
Connect read-only in 5 minutes. Receive an evidence-backed engineering roadmap in 24 hours.