Connect your cloud accounts

CloudIQ needs to read your cloud accounts. It does not need to change anything, and the access model is built so that it cannot. We guide setup on a call. You get the exact permissions beforehand, so your security team can review them.

Before the call#

What you create#

AWS#

One read-only IAM role per account, created from a CloudFormation quick-create link we provide. Its trust policy allows only Finitizer's scanner identity to assume it, using short-lived tokens rather than stored keys. There are no IAM users and no stored access keys.

The permissions are read-only: describe and list operations across the services being analyzed, plus Cost Explorer and CloudWatch metrics. Explicit denies block the contents of your data, such as objects, rows and logs. You can read the policy before you create the role, see every call it makes in CloudTrail, and delete the role at any time.

Google Cloud#

Read-only roles granted to a dedicated Finitizer reader identity. No software, service accounts or keys are created in your environment. Access can be scoped to individual projects or to a folder, and a folder grant covers projects created later.

A BigQuery-only deployment starts with five read-only roles and four APIs. Analysis queries run in your dataset and are logged there.

Permissions follow what you turn on#

Each solution is made of modules, one per service area. Access is tailored to the modules you turn on. You receive a list of every required permission and its purpose. A preflight check validates the permissions before the first scan, so a missing one is found before it leaves a gap in the findings.

What it can see, and what it cannot#

CloudIQ reads metadata and metrics, not data. It sees that a table exists, how large it is, and how much each query scans. It does not read the rows. It sees that a bucket holds 40 TB in Standard storage with no access in 90 days. It does not read the objects. The security and access model sets out the boundary in full.

What happens next#

1. Scoping. Which accounts, projects and regions are in, and which are out. Excluding is easy at the start and awkward later, so it is worth ten minutes.
2. Access. You create the role or the grant from what we send, then send us the role ARN (AWS) or confirm the grant (Google Cloud). On one guided call of under an hour.
3. First audit. The checks run across the scoped accounts. Ranked, priced findings follow within two business days.
4. First review. Findings arrive ranked by estimated saving, each with its evidence, risk and proposed fix. The first changes are prepared for review the same day.

From then on, audits run daily, and each one shows what changed since the last.

Removing access#

Delete the IAM role, or remove the grant in Google Cloud. Access ends at that moment. There is no key to rotate and no agent to uninstall, because neither existed. If you want the collected data removed as well, ask us and we will delete it.

Next#

• Security and access model
• How CloudIQ works
• From finding to fix