Security model · AWS specifics in full
The least access that could possibly work.
Connecting a cloud account to a cost tool should not mean handing over the keys. VeriKost reads through access you create, inspect before you grant, and can withdraw at any moment. These principles hold for every provider; the specifics on this page are AWS — the cloud that is live today.
Six commitments, none of them optional.
Read-only, by construction
The permissions we ask for contain describe, list, and get calls only. There is no write, no delete, no terminate, and no way for a bug or a bad actor on our side to change your infrastructure. This does not loosen when a new provider is added.
No long-lived credentials
VeriKost never receives a static access key from you. On AWS it assumes a role you created, receiving short-lived STS credentials scoped to that role for the duration of a scan.
External ID per connection
Every connection issues a fresh external ID that must be presented on assume. It is never reused across customers or across connection attempts, which closes the confused-deputy hole in cross-account roles.
Scoped to one identity
The trust policy names VeriKost's specific IAM principal, not the whole VeriKost AWS account — tighter than the console wizard can express, and free to get right at creation time.
Revocable in one step
Delete the role, or detach its policy, and access stops at the next call. Nothing needs to be coordinated with us, and nothing keeps working on a cached credential.
Metadata, not payloads
Scans read resource configuration, tags, utilization metrics, and cost figures. VeriKost does not read the contents of your buckets, databases, volumes, or logs.
The entire permission set, in public.
Everything here is a read. Discovery needs to know what exists, enrichment needs utilization and spend, and attribution needs tags. Nothing in the pipeline needs the ability to change a resource, so nothing in the policy grants it.
Each future provider gets the same treatment: its full permission set published here before it goes live.
Cost
- ce:GetCostAndUsage
- ce:GetCostAndUsageWithResources
- ce:GetCostForecast
- ce:GetDimensionValues
- ce:GetTags
- ce:DescribeReport
Inventory
- ec2:Describe*
- rds:Describe*
- elasticache:Describe*
- memorydb:DescribeClusters
- kafka:ListClustersV2
- airflow:ListEnvironments
- airflow:GetEnvironment
- es:ListDomainNames
- es:DescribeDomains
- es:DescribeDomainConfig
- es:ListTags
- eks:ListClusters
- eks:DescribeCluster
- eks:ListNodegroups
- eks:ListFargateProfiles
- eks:DescribeClusterVersions
- dms:DescribeReplicationInstances
- dms:DescribeReplicationTasks
- elasticmapreduce:ListClusters
- elasticmapreduce:DescribeCluster
- elasticmapreduce:ListInstanceGroups
- elasticmapreduce:ListInstanceFleets
- redshift:DescribeClusters
- workspaces:DescribeWorkspaces
- workspaces:DescribeWorkspacesConnectionStatus
- sagemaker:ListEndpoints
- sagemaker:DescribeEndpoint
- sagemaker:DescribeEndpointConfig
- elasticloadbalancing:Describe*
- elasticfilesystem:Describe*
- application-autoscaling:Describe*
- ecs:List*
- ecs:Describe*
- lambda:List*
- lambda:GetFunction
- iam:ListRoles
Storage
- s3:ListAllMyBuckets
- s3:GetBucketLocation
- s3:GetBucketTagging
Utilization
- cloudwatch:GetMetricData
- cloudwatch:ListMetrics
Attribution
- tag:GetResources
- organizations:DescribeAccount
Three ways in, none of them a standing key.
Direct API
VeriKost calls your provider directly using access you granted. On AWS that is role assumption through STS — nothing to install, nothing to run, and nothing inbound to your network.
VeriKost Collector
A lightweight agent you run inside your own environment, pushing inventory and cost data out over HTTPS. No inbound connectivity, no cross-account trust, and it registers once with a token that is shown exactly once.
Billing export
Ingest cost exports in CUR or FOCUS format for historical spend, daily usage, and long-term trends. FOCUS is the vendor-neutral billing standard, which is precisely why the framework speaks it.
You create it. You own it. You can end it.
You start the connection
In Clouds → Connect Account → AWS, VeriKost generates an external ID unique to that connection attempt and shows you the exact trust and permissions policies to create.
You create the role
In your own AWS account, using your own credentials. VeriKost has no involvement in this step and no ability to create anything on your behalf.
VeriKost verifies the assume
The connection is only marked usable once an STS AssumeRole against the role you created actually succeeds with the external ID.
Each scan assumes fresh
Every scan takes new short-lived credentials. Nothing persistent is held between runs.
What we hold, and what we refuse to.
What we store
Resource identifiers and configuration, tags, CloudWatch metric aggregates, cost figures, and the findings derived from them — plus your login (email and a bcrypt password hash). That is the inventory of a scan, not the contents of your workloads.
What we never hold
Your AWS keys. Access works by assuming the role you created, with short-lived STS credentials that expire after the scan. There is no stored secret of yours for an attacker to steal from us.
In transit
TLS on every hop — browser to site, app to API, API to AWS. There is no plaintext path.
At rest
Scan data and accounts live in a managed Postgres store that is encrypted at rest and accepts connections only from the API host. We say exactly this much because it is exactly what we have verified.
Deletion
Disconnect an account and its scan history stops accumulating; ask us to delete and the data is removed. In early access this is a person actually doing it, and confirming to you when it is done.
Subprocessors
Four: Amazon Web Services (compute and infrastructure), Supabase (managed Postgres, itself hosted on AWS), Cloudflare (DNS, CDN, and the web application), and Google’s Gemini API, which writes the plain-English explanation of a finding from that finding’s details — resource ID, metrics and cost figures, never your credentials, and never a number of its own. No analytics trackers, no data brokers.
Found something? Tell us. We answer.
Report vulnerabilities to security@verikost.com. Include what you found, where, and how to reproduce it. You will get a human acknowledgement within 48 hours and a status answer within 7 days — in early access the person replying is the person fixing it.
We commit to not pursuing legal action against research that stays in scope: testing against your own VeriKost account and the public site, no access to other customers’ data, no denial of service, no social engineering, and a reasonable window for us to fix before public disclosure. If you reach data that is not yours, stop and report — that report is welcome too.
In scope
- app.verikost.com — the product
- api.verikost.com — its API
- www.verikost.com — this site
- the IAM policy and role-assumption flow
Out of scope
- denial of service / volumetric testing
- social engineering, phishing, physical
- third-party services we run on
- reports from automated scanners alone
Ready when you are.
In early access we do the role-creation walkthrough with you, on a call — the connection is only marked usable once the assume actually succeeds.