Overview

You would like to know information related to how secure CloudFix is. This article provides information on the various measures that CloudFix has taken to maintain a high level of security in the product.

Information

No integration can honestly claim to introduce zero risk. Instead, CloudFix is engineered to minimize risk at every stage of connecting to your AWS account, through scoped permissions, a hard approval boundary before anything changes, and independent auditability. Here's how:

• Scoped, least-privilege IAM roles. Connecting your account deploys a small set of purpose-built IAM roles via a CloudFormation template — not a single broad "Finder and Fixer" role. The cloudfix-finder-role discovers optimization opportunities using overwhelmingly read-only (Describe/List/Get) permissions, plus a narrow set of non-destructive writes (resource tagging, CloudWatch Logs, Athena, SNS) scoped to the finders your subscription has enabled. A separate cloudfix-athena-query-execution-role queries your Cost and Usage Report. Remediation is split across two more roles: cloudfix-ssm-update-role (assumable by CloudFix, authors the proposed fix) and cloudfix-ssm-assumed-role (the role that actually executes the change) — and CloudFix cannot assume the execution role at all; it is invoked only by AWS Systems Manager inside your own account. In the spirit of transparency, we're happy to share the CloudFormation templates that create these roles so the exact permissions can be reviewed.
• An explicit approval boundary. No change to your resources (EC2, EBS, S3, RDS, etc.) is executed until you approve the change template in AWS Systems Manager. In the default deployment, the cloudfix-fixer-approver-role that grants approval trusts your account alone, so CloudFix has no path to approve its own changes — that only changes if you separately opt in to centralized approval at onboarding.
• Independent CloudTrail auditability. Every API call CloudFix makes into your account is recorded in your own AWS CloudTrail and tagged with the CloudFix IAM role that made it, giving you a complete audit trail that doesn't depend on CloudFix's own logs.
• CloudFix queries, securely transmits and stores some resource usage pattern data in its own secure AWS environment in order to perform analysis and make the recommendations. CloudFix only uses AWS API calls which are HTTPS (encrypted in transit). Data is then encrypted in storage in the CloudFix system.
• CloudFix doesn't store any of your AWS credentials — access is via IAM role assumption (STS AssumeRole) only, not stored keys or passwords.
• In order to make the recommendations, CloudFix doesn't need to read any content of your databases or any other stored data.
• CloudFix operates a responsible-disclosure programme for security researchers, with acknowledgement of reports within 24 hours and a 90-day coordinated-disclosure window before any public disclosure. See the Trust Center vulnerability management page for details.

Security & compliance resources

For CloudFix's current certifications, security architecture, data-handling and sub-processor commitments, see the CloudFix Trust Center:

• Security architecture and IAM roles
• Certifications and audit reports (SOC 2)
• Data collection, retention and deletion