AWS SECURITY & PERMISSIONS

Verify the AWS access before you trust it.

OpsChugex V1 uses a read-only cross-account IAM Role model for AWS intelligence. You do not paste a customer AWS access key or secret access key into OpsChugex.

View raw IAM policy Back to trust overview

WHAT OPSCHUGEX STORES

Connection metadata, not customer access keys.

Cross-account IAM Role ARN
Optional External ID
Optional AWS region

WHAT OPSCHUGEX DOES NOT STORE

No customer static AWS credentials.

No customer AWS access key ID field
No customer AWS secret access key field
No customer AWS session token field

WHAT THE ROLE CAN DO

The V1 permission set is read-only.

These are the AWS actions used by the current OpsChugex V1 inventory and security implementation. The downloadable JSON below is generated from the same permission set published with this release.

ec2:DescribeInstancesec2:DescribeSecurityGroupsrds:DescribeDBInstancess3:GetBucketPolicyStatuss3:GetBucketPublicAccessBlocks3:ListAllMyBucketssts:GetCallerIdentity

{
    "Version":  "2012-10-17",
    "Statement":  [
                      {
                          "Sid":  "OpsChugexReadOnlyInventoryAndSecurity",
                          "Effect":  "Allow",
                          "Action":  [
                                         "ec2:DescribeInstances",
                                         "ec2:DescribeSecurityGroups",
                                         "rds:DescribeDBInstances",
                                         "s3:GetBucketPolicyStatus",
                                         "s3:GetBucketPublicAccessBlock",
                                         "s3:ListAllMyBuckets",
                                         "sts:GetCallerIdentity"
                                     ],
                          "Resource":  "*"
                      }
                  ]
}

WHAT IT CANNOT DO

No resource modification or deletion permissions.

✓ Cannot create AWS resources✓ Cannot delete AWS resources✓ Cannot start or stop EC2 instances✓ Cannot modify security groups✓ Cannot change RDS databases✓ Cannot write objects to S3

CONNECTION MODEL

You keep control in your AWS account.

Your AWS Account→Read-only IAM Role→AWS STS AssumeRole→OpsChugex Intelligence

The role can be disabled or removed from your AWS account at any time. AWS connectivity remains an early V1 capability while real-user validation is underway.