Read-only access. Zero blast radius.
CoreFinOps connects to AWS through a customer-created read-only IAM role. It cannot stop, start, delete, or modify any resource in your accounts.
This page describes the V1 technical security boundary. CoreFinOps is not a SOC 2, HIPAA, PCI, or FedRAMP certified product.
IAM security boundary
The read-only boundary is enforced at the IAM policy level — not by convention.
Read-only cross-account role
CoreFinOps assumes a customer-created IAM role with only read permissions. The role ARN and ExternalId are defined by the customer.
STS AssumeRole with ExternalId
The ExternalId prevents confused-deputy attacks. Only CoreFinOps with the matching trust policy can assume the role.
No long-lived credentials
Temporary STS credentials, rotated per-session. No IAM access keys stored in CoreFinOps systems.
No write permissions
The CoreFinOpsReadOnly policy grants list and describe access only. CoreFinOps cannot stop, start, delete, or modify any AWS resource.
No agents in your VPC
CoreFinOps does not install agents, sidecars, or network sensors in your accounts. All data collection is through read-only API calls.
Customer-confirmed execution
When a recommendation is approved, your team implements the change using your own access and tooling. CoreFinOps records confirmation and verifies the outcome.
Platform architecture
Frontend
- S3 static hosting
- CloudFront CDN
- No servers to patch
API
- API Gateway (REST)
- AWS Lambda (Node.js)
- No persistent compute
Auth
- Amazon Cognito Hosted UI
- PKCE OAuth 2.0 flow
- No passwords in CoreFinOps DB
Data
- PostgreSQL via Supabase
- Row-level security (RLS)
- Encrypted at rest and in transit
Data handling
CUR 2.0 export files remain in your S3 bucket. CoreFinOps reads them via the ingestion role.
Normalized cost records are stored in the CoreFinOps PostgreSQL database with row-level security per tenant.
No raw AWS billing data is stored in CoreFinOps beyond what is needed for the active period.
Authentication tokens are managed by Cognito. No session secrets are stored in CoreFinOps application code.
The following certifications and compliance frameworks are not provided by CoreFinOps. Do not represent CoreFinOps as being certified or assessed under these frameworks.
Walk through the AWS onboarding.
Book a demo and we'll show the exact IAM policy, the ExternalId trust setup, and the CUR export configuration needed to connect CoreFinOps to your accounts.