Security and access model
What CloudIQ can access, what it cannot access, what it cannot do, what runs in your environment, how the read-only model is enforced, and how you verify and revoke it.
Security is usually the first question. Under the standard deployment, CloudIQ uses read-only access to analyze resource metadata, utilization, pricing and billing data. It does not access customer data-plane content, and it does not make changes in your environment.
The boundary#
| Question | Answer |
|---|---|
| What can CloudIQ access? | Resource configuration and metadata, utilization metrics, billing and pricing exports, BigQuery job history and reservation timelines, and the cloud providers' own recommendations |
| What can it not access? | Customer data-plane content. Explicit denies block S3 objects, DynamoDB items, log contents, Lambda invocations and Bedrock model invocations |
| What can it not do? | Create, modify or delete resources under the standard deployment. Changes are delivered as code or runbooks for your engineers to apply |
| What runs in your environment? | Nothing. No agents, collectors, sidecars, VPC peering, firewall changes or network path into your accounts |
| How is read-only enforced? | Four controls: a code-level API allow-list, read-only IAM permissions, explicit data-plane denies, and CI tests that fail if any of those controls change |
| How do you verify activity? | A preflight check tests permissions before the first scan. Every call is in your CloudTrail or Cloud Audit Logs |
| How do you revoke access? | Delete the IAM role in AWS, or remove the grant in Google Cloud. Access ends immediately. There is no access key to revoke |
What you create#
- AWS: one read-only IAM role per account, from a CloudFormation quick-create link. The role trusts only Finitizer's scanner identity using short-lived tokens rather than stored keys. No IAM users, no stored access keys.
- Google Cloud: read-only roles for a dedicated Finitizer reader identity, scoped to projects or a folder. No software, service accounts or keys in your environment.
- Permissions follow the modules you enable, with a list of every permission and its purpose. A BigQuery-only deployment starts with five read-only roles and four APIs.
Connect your cloud accounts walks through the setup.
Data handling#
- Isolation. Each customer's findings are stored in a separate dataset with independent access controls.
- Identity. Self-service single sign-on with your identity provider (OIDC), multi-factor authentication, five product roles, and an audit log your administrators can read.
- AI controls. AI features run within customer-specific scopes and budgets. Assistant API keys can be revoked within seconds. Your cost data is never used to train AI models.
- SOC 2. The SOC 2 technical requirements are complete and the governance requirements are in progress. Finitizer states its status plainly rather than claiming a report it does not yet hold.
The one optional exception#
BigQuery reservation automation can change reservation settings, and only if you enable it. It is off by default and outside the standard read-only deployment. When it is on:
- it works within scopes and change limits you define
- it starts in dry-run mode
- it never reduces capacity without approval
- it writes a rollback command for every change, and keeps two audit logs
Next#
Try this against your own spend
A free savings analysis runs the checks described in these docs against your AWS or Google Cloud account and returns a ranked list of priced findings.