Security
Security architecture, data isolation and best practices.
Security principles
- 1
Least Privilege
The base template grants RDS management and EKS permissions for all current and future clusters in the connected AWS account. Choose Manage or Protect after syncing. Optional modules add permissions for the other selected features.
- 2
No key storage
No AWS access keys are stored. Credentials are obtained on demand through AWS STS and expire automatically.
- 3
Mandatory External ID
Each connection uses a unique UUID (External ID) to prevent "confused deputy" attacks. Without this ID, the role cannot be assumed.
- 4
Organization isolation
Each organization has its own AWS accounts, resources and schedules. Data is isolated via Row Level Security (RLS) in PostgreSQL.
No data access
SnoozeDB operates on AWS control-plane metadata and resource state. It cannot connect to your databases or read and modify their contents.
What SnoozeDB can do
- • List RDS and enabled AWS resource metadata
- • Start and stop managed RDS resources
- • Start and stop managed EC2 resources when that module is enabled, and scale the managed node groups of managed EKS clusters to zero and back
- • Read tags, metrics, costs, snapshots, and commitment coverage for enabled modules
What SnoozeDB CANNOT do
- • Read or modify your database data
- • Delete an instance or snapshot
- • Modify database credentials or connect through your VPC
- • Purchase Reserved Instances or Savings Plans
Authentication
User authentication is managed by a dedicated authentication service. Sessions are secured via HttpOnly cookies with JWT tokens.
Multi-factor authentication (MFA) is supported and recommended for admin accounts.
Data storage
SnoozeDB stores the metadata needed to schedule resources, explain findings, and maintain an audit trail:
- Resource identifiers, regions, classes, tags, states, snapshots, and detected findings
- Schedules, locks, operation history, recommendation decisions, and confirmed savings
- The role ARN, External ID, and enabled permission modules for each AWS connection
Row Level Security
All PostgreSQL database tables use Row Level Security (RLS). Each query is automatically filtered to only return data from the connected user's organization. No user can access another organization's data, even in case of an application bug.
Compliance
Application data is encrypted in transit and at rest. Generated cleanup and retention scripts are downloaded for review and run with your own AWS identity. SnoozeDB does not execute those destructive actions.