Security, Trust & Access Architecture
KloudSense is engineered from the ground up for technical leaders who demand absolute control, least-privilege security, and zero production risk.
Trust Boundary & Ephemeral STS Handshake
Dedicated Read-Only IAM Role
Deployed via inspectable CloudFormation stack. Attached to AWS-managed SecurityAudit policies. Zero write permissions.
Temporary STS AssumeRole
KloudSense passes your cryptographic External ID. AWS issues short-lived session credentials valid for maximum 1 hour.
Read-Only Audit Engine
Ingests metadata and CloudWatch metrics. Calculates factual findings. Zero access to databases, S3 contents, or customer PII.
Complete Control: You can revoke access at any second by deleting the IAM Role or CloudFormation stack from your AWS console.
Strict Read-Only & Least Privilege
Our CloudFormation template grants strictly read-only visibility using AWS-managed policies (SecurityAudit, AWSBillingReadOnlyAccess, and CloudWatchReadOnlyAccess). KloudSense does not have, and will never request, permissions to write, modify, stop, or delete any resource in your cloud environment.
IAM Role & Temporary STS Tokens
Access is established using cross-account IAM role assumption via AWS Security Token Service (STS). Instead of static credentials, our engine uses ephemeral session tokens that automatically expire within 1 hour. No permanent keys exist to be leaked or compromised.
Cryptographic External ID
To protect against the AWS "Confused Deputy" problem, every KloudSense audit role requires a customer-unique, cryptographically random External ID condition. The role can only be assumed when our engine explicitly provides your unique secret token.
No Root Credentials, No Static Keys
We never ask for root account credentials, IAM user passwords, or long-lived secret access keys. You never share private credentials with us, eliminating the credential exposure surface entirely.
Zero Automated Modifications
Black-box automated tools that execute remediation scripts can cause catastrophic downtime. KloudSense never modifies your infrastructure. We provide prioritized blueprints, CLI commands, and safety checklists so your own engineers retain 100% control over deployment timing.
1-Click Instant Revocation
You remain in total control at all times. When your audit is delivered, or at any moment during the engagement, you can revoke access instantly by deleting the CloudFormation stack or IAM role in your AWS console. Access terminates immediately.
Data Handling & Strict Data Minimization
We operate under a strict principle of zero payload data ingestion.
✓ What We Collect (Read-Only Metadata)
- • AWS resource types, instance families, and generation classes
- • Resource status (running, stopped, unattached)
- • CloudWatch utilization summaries (CPU, memory, IOPS, network)
- • Cost & Usage Reports (CUR) billing line items and commitment terms
- • Storage tier configurations and lifecycle rule states
✗ What We NEVER Access
- • Database contents, tables, records, or query payloads
- • S3 bucket object data, files, or payload contents
- • Application source code, secrets, or environment variables
- • Customer personal data (PII) or confidential business records
- • Private keys, TLS certificates, or credential stores
Want to inspect the exact CloudFormation template?
Review the raw CloudFormation YAML, IAM trust policies, allowed vs blocked actions, and CloudTrail audit verification commands.
Ready to get your evidence-backed audit?
24-hour delivery • 100% read-only • Actionable savings guarantee
Request an AWS Audit →