Skip to content

English | 简体中文

IAM and Security

Grant only the APIs required by enabled collectors. Keep source-principal permissions and target-role permissions separate.

Configuration write access is credential-use authority. An endpoint override can redirect signed AWS requests, so production config writers require the same trust as credential administrators. Do not use endpoint overrides in production. /metrics is sensitive financial telemetry; expose it only on a private network or behind authenticated TLS and restrict Prometheus access.

Collector permissions

  • Cost totals, dimensions, and forecast: ce:GetCostAndUsage, ce:GetCostForecast.
  • Organizations metadata: organizations:ListAccounts, organizations:DescribeOrganization.
  • Budgets: budgets:ViewBudget.
  • Savings Plans/RI summaries and anomalies: the read operations listed in commitments-anomalies-readonly.json.
  • CUR: Athena start/status/results/stop, scoped Glue catalog reads, CUR input-prefix reads, and Athena result-prefix access.

STS GetCallerIdentity normally requires no explicit allow. A source principal needs sts:AssumeRole only for each exact configured role ARN. Do not grant wildcard role resources.

Use the policies in examples/iam as templates and replace every placeholder with exact account, region, database, table, bucket, prefix, role, and principal values.

Secret handling

  • YAML stores environment-variable names, never access keys, secret keys, session tokens, or ExternalId values.
  • Helm uses config.secretEnvRefs for existing Secrets and awsSharedConfig.existingSecret for mounted Profile files.
  • Docker mounts ${HOME}/.aws read-only or injects environment variables through the runtime.
  • Logs, metrics, debug output, fixtures, issues, and screenshots must not contain credentials, account email, raw AWS responses, or private cost data.
  • Protect optional debug endpoints with an authenticated proxy or NetworkPolicy.

Container and Kubernetes posture

The published container runs non-root with a read-only-compatible filesystem model. Keep the chart at one replica, use a dedicated ServiceAccount, apply the bundled NetworkPolicy where suitable, and avoid mounting Secrets into paths used for logs or Athena results.

Reporting vulnerabilities

Follow the repository Security Policy. Use GitHub's private “Report a vulnerability” flow. Do not put a vulnerability, credential, account identifier, or billing sample in a public issue.

Starting with v1.0.0, the latest two minor releases are supported, with the older minor kept for at least six months after its successor. See the public threat model and SECURITY.md for residual risks and coordinated disclosure.