Overview

You have connected your AWS accounts to CloudFix and want to know the data that is stored and transmitted by CloudFix.

Information

The CloudFix Finder IAM role collects the following data:

• Cost & Usage Reports are read by CloudFix in order to analyze costs and create savings estimates.
• CloudWatch metrics are used to collect usage data. You can see the APIs called by CloudFix using CloudTrail.
• The CloudTrail entries are annotated with a CloudFix role, identifying them as CloudFix-originated access. Where relevant, the logs will identify the originating user.

The finder role's permissions are read-oriented — the vast majority are Describe, List, and Get actions that make no changes to your resources. It also holds a small set of non-destructive write permissions required for normal operation: resource tagging (ec2:CreateTags, ec2:DeleteTags, tag:TagResource), and, for a small number of finders, Athena queries. (CloudWatch Logs writes and SNS notifications belong to the separate execution role used only after you approve a fix, not to the finder role.)

CloudFix cannot read the bulk contents of your data: it has no access to secrets, Parameter Store values, log event contents, database records, queue messages, or EBS snapshot block data. Eg: CloudFix can read metrics about your S3 bucket to see how much it costs, but it cannot access any of the objects stored in the bucket.

The one exception is narrow and purpose-specific: a small number of finders require a targeted read beyond configuration metadata to do their job — for example, reading CloudWatch Logs Insights result rows to right-size a Lambda function. Each such permission is granted only when the corresponding finder is enabled for your subscription, so a tenant with fewer finders enabled receives a strictly narrower policy.

The CloudFix Permission Model article provides information on how these strict permission boundaries are maintained and hence, allows you control of what CloudFix Fixers can do. For the full, current permission breakdown by role, see the CloudFix Trust Center Security page.

Security & compliance resources

For CloudFix's current certifications, security architecture, data-handling and sub-processor commitments, see the CloudFix Trust Center:

• Security architecture and IAM roles
• Certifications and audit reports (SOC 2)
• Data collection, retention and deletion