Connecting an account

Finitizer needs to read your cloud accounts. It does not need to change anything, and the access model is built so that it cannot.

The access model

AWS

Access is granted through an IAM role that Finitizer assumes, not through long-lived access keys handed over by email. The role's trust policy names the Finitizer principal and an external ID unique to your organisation, so the role cannot be assumed by anyone else who learns its ARN.

The permissions attached are read-only: describe and list operations across the services being analysed, plus Cost Explorer and CloudWatch metrics. There are no write, delete, or modify permissions of any kind, on any service.

You create the role. You can read the policy before you attach it, you can see every call it makes in CloudTrail, and you can delete it at any time, which revokes access immediately and completely.

Google Cloud

Access is granted to a service account with read-only roles on the projects in scope, plus the BigQuery job and metadata permissions needed to analyse query patterns.

The same properties hold: read-only, visible in audit logs, revocable by you.

What it can see, and what it cannot

Finitizer reads metadata and metrics, not data.

It sees that a table exists, how large it is, how often it is queried and how much each query scans. It does not read the rows. It sees that an S3 bucket holds 40 TB in Standard storage with no access in 90 days. It does not read the objects.

That distinction is what makes the read-only role sufficient. If the platform needed your data, it would need permissions it deliberately does not have.

What happens next

1. Scoping. Which accounts, projects and regions are in scope, and which should be excluded. Excluding is easy at the start and awkward later, so it is worth ten minutes.
2. Access. You create the role or service account from the policy document provided, and share the identifier back.
3. First collection. The platform runs its collectors across the scoped accounts. How long this takes depends on how much is there.
4. First findings. Findings appear ranked by estimated saving, each with its evidence and proposed change.

Connecting an account is handled together with the Finitizer team rather than as an unattended signup. That is a deliberate choice for now: scoping decisions made badly at step 1 produce a findings list nobody trusts, and a short conversation prevents it.

Removing access

Delete the IAM role, or remove the service account's role bindings. Access ends at that moment — there is no key to rotate out and no agent left behind, because neither existed.

If you want the collected data removed as well, that is a separate request, and it is honoured.

---

Once an account is connected, see From finding to fix for what happens to a finding you decide to act on.