Security
Security architecture, data isolation and best practices.
Security principles
- 1
Least Privilege
RDS Management grants the inventory, tag, start, and stop actions required for scheduling. Optional modules add only the read actions selected for that AWS account.
- 2
No key storage
No AWS access keys are stored. Credentials are obtained on demand through AWS STS and expire automatically.
- 3
Mandatory External ID
Each connection uses a unique UUID (External ID) to prevent "confused deputy" attacks. Without this ID, the role cannot be assumed.
- 4
Organization isolation
Each organization has its own AWS accounts, resources and schedules. Data is isolated via Row Level Security (RLS) in PostgreSQL.
No data access
SnoozeDB operates on AWS control-plane metadata and resource state. It cannot connect to your databases or read and modify their contents.
What SnoozeDB can do
- • List RDS and enabled AWS resource metadata
- • Start and stop managed RDS resources
- • Start and stop managed EC2 resources when that module is enabled
- • Read tags, metrics, costs, snapshots, and commitment coverage for enabled modules
What SnoozeDB CANNOT do
- • Read or modify your database data
- • Delete an instance or snapshot
- • Modify database credentials or connect through your VPC
- • Purchase Reserved Instances or Savings Plans
Authentication
User authentication is managed by a dedicated authentication service. Sessions are secured via HttpOnly cookies with JWT tokens.
Multi-factor authentication (MFA) is supported and recommended for admin accounts.
Data storage
SnoozeDB stores the metadata needed to schedule resources, explain findings, and maintain an audit trail:
- Resource identifiers, regions, classes, tags, states, snapshots, and detected findings
- Schedules, locks, operation history, recommendation decisions, and confirmed savings
- The role ARN, External ID, and enabled permission modules for each AWS connection
Row Level Security
All PostgreSQL database tables use Row Level Security (RLS). Each query is automatically filtered to only return data from the connected user's organization. No user can access another organization's data, even in case of an application bug.
Compliance
Application data is encrypted in transit and at rest. Generated cleanup and retention scripts are downloaded for review and run with your own AWS identity. SnoozeDB does not execute those destructive actions.