Security is foundational to Cloudventory’s design. The platform is built to provide visibility into AWS environments without introducing risk.
Permissions
Cloudventory connects to AWS using a read-only IAM role.
The role uses AWS-managed policies only:
Policy | Purpose |
|---|---|
| Read access to security-related configurations |
| Read access to AWS service resources |
No write permissions.
No wildcard (*) actions.
Permissions are fully auditable in your AWS account.
Read-Only Access
Cloudventory cannot create, modify, or delete any AWS resources.
We read resource metadata to build your inventory and generate insights, nothing more.
What We Collect
Cloudventory collects metadata only, including:
-
Resource IDs, names, ARNs, and tags
-
Configuration details (e.g., instance types, bucket policies, security group rules)
-
Relationships between resources
-
Status and timestamp information
What We Never Collect
Cloudventory does not access or store:
-
Secrets Manager or Parameter Store values
-
Environment variables
- Lambda function environment variables: While the AWS Lambda API returns environment variables as part of function metadata, Cloudventory immediately strips the entire environment variable block from API responses before any persistence or logging occurs. Cloudventory never stores, logs, or retains environment variable values, ensuring customer secrets are not collected or handled in any form. This behavior enforces our metadata-only policy and eliminates the risk of storing sensitive keys or credentials.
-
Lambda function code
-
S3 object contents
-
Database contents
-
EC2 UserData
-
Credentials, keys, or tokens belonging to your workloads
Credential Handling
IAM AssumeRole (Recommended)
We store only the role ARN.
Temporary credentials are requested at scan time via AWS STS and expire automatically (typically within 1 hour). No credentials are persisted.
Access Keys
If access keys are used:
-
Keys are encrypted at rest using AES-256
-
Encryption keys are managed via AWS KMS
-
We strongly recommend short-lived credentials or regular key rotation
Infrastructure Security
-
Hosted on AWS
-
TLS 1.2+ enforced for all network traffic
-
Encrypted storage at rest
-
Production access is restricted and logged
Questions?
For security inquiries or documentation requests, contact: security@cloudventory.io