Security
What CostWarden can access
The whole connection is one read-only IAM role in your account, with 5 permissions. This page lists them by name, says what each one is for, and states what is stored afterwards. If any of it is more than you want to grant, that is a reasonable place to stop.
How the connection works
No credentials are exchanged, and nothing we hold is a secret you have to rotate.
You create a role, we never see a key
CostWarden never asks for an access key. You create an IAM role in your own account and paste its ARN. We assume it with AWS STS for the duration of a scan, which issues temporary credentials that expire on their own.
The role only trusts us, for your organization
The trust policy we give you names our AWS account and requires an external ID unique to your organization. Another CostWarden customer who pasted your role ARN into their own account would be denied by AWS, because they cannot present your external ID.
You can revoke it without asking us
Delete the role in IAM and access ends immediately, whatever our software thinks. Disconnecting inside CostWarden stops future syncs and keeps your history; it does not touch anything in AWS.
All 5 permissions, in full
This is the entire policy, not a summary of it. Nothing is granted that is not on this list.
ce:GetCostAndUsage
Daily spend per service. This is the cost trend, the top-services list, and everything the anomaly detector compares against.
compute-optimizer:GetEC2InstanceRecommendations
AWS's own findings on over-provisioned EC2 instances, with their estimated monthly saving.
compute-optimizer:GetEBSVolumeRecommendations
AWS's own findings on idle or oversized EBS volumes.
ec2:DescribeInstances
The type, size and state of your instances — their shape, never anything running inside them. Compute Optimizer will not answer about instances the caller cannot list, so without this the recommendation above does not arrive at all.
ec2:DescribeVolumes
The same shape for volumes: type, size, and what each one is attached to. Never a byte of what is stored on them.
Every one of them is read-only by construction. AWS summarises the policy as three services — Cost Explorer (Read), Compute Optimizer (List) and EC2 (List). The EC2 pair is there because Compute Optimizer refuses to answer without it: it resolves the caller’s instances before it will return a recommendation, so the call fails outright rather than returning less. CostWarden never calls EC2 itself — the only AWS clients in the codebase are Cost Explorer and Compute Optimizer.
What we store
Spend figures and our own analysis of them. Nothing that describes what your infrastructure runs.
Daily spend per AWS service — a date, a service name and an amount. Not per-resource, not per-tag.
The same daily spend broken down by AWS linked account, so you can tell production from a sandbox: an account ID, and whatever name you give it. The ID comes from Cost Explorer; we never ask AWS who the account belongs to, and the permission to do so is not in the list above.
Anomalies we detected: the service, the day, the observed and baseline amounts, and which continuous event they belong to.
Rightsizing findings from Compute Optimizer, which do include resource identifiers — the EC2 instance id or EBS volume id the recommendation is about.
A record of every sync attempt and its outcome, so the app can tell “never synced” from “synced and found nothing”.
Your organization, its members and their roles, and the webhook URLs for the alert channels you connect.
Data belongs to your organization, and every query is scoped to it at the database level rather than in application code. Your cost history stays if you disconnect AWS or if a subscription lapses — we stop collecting new data, we do not delete what you already have.
What it cannot do
No agents, sidecars or daemons. Nothing is installed in your cluster, your VPC or your images.
No write permission of any kind. The role cannot start, stop, resize, tag or delete anything — there is no API call in the policy that mutates state.
No access to your logs, metrics, traces, code or data. Cost Explorer returns spend figures and does not return what produced them; the two EC2 describe actions return the shape of an instance or a volume — type, size, state, attachment — and nothing running on it or stored in it.
No card details. Checkout runs on Lemon Squeezy as Merchant of Record and payment information never reaches CostWarden.
Where we are early
CostWarden is pre-launch and run by one person. Stating that plainly is more useful to you than a compliance page with nothing behind it.
No SOC 2 or ISO 27001 report exists yet. If your procurement requires one, CostWarden is not ready for you — and would rather say so than start a questionnaire it cannot finish.
Alert channel webhook URLs are stored in the database, protected by row-level security and only ever shown back to you masked. They are not encrypted with a separate key today.
Single sign-on (SAML/OIDC) is not supported. Sign-in is email and password or Google, two-factor authentication (TOTP) is available in Settings → Account, and organization roles control who can do what.
The walkthrough shows you the exact policy before you paste it
Both policies are rendered fully filled in, with a copy button, and the connection is verified with a real assume-role before anything is saved.