ARCHITECTURE

Read-only access, isolated vaults, Australian data residency

How an Appware audit reaches your account, what it can and cannot do, and where your data lives. Everything on this page can be checked from your side.

01 / CROSS-ACCOUNT READ-ONLY IAM

One role, one named principal, one hour

1
You create the role
Deploy the CloudFormation stack in your account. It creates one role named AppwareReadonlyAuditRole-<your account id>.
2
Appware assumes it
A single named Appware principal calls sts:AssumeRole with your ExternalId. Account root cannot be trusted.
3
One-hour read session
STS returns credentials that expire within 3600 seconds. The seven read actions are the only ones the role grants.
4
Findings and dossier
Cost, volume, ECS and logging metadata become the FinOps and Well-Architected dossier. Remediation is yours to run.

Hover or focus a zone for detail.

Read-only by construction

The role policy lists 7 read or list actions (ce, cloudwatch, ec2, ecs, bedrock). There is no write, delete, IAM, S3 or secrets action, so Appware cannot change your account even if it wanted to.

Check: IAM console, role policy

192-bit ExternalId

The ExternalId is appw_ plus 32 URL-safe base64 characters: 32 x 6 bits = 192 bits of entropy, issued server-side and enforced by the stack's AllowedPattern.

Check: CloudFormation parameter pattern

Bounded sessions

MaxSessionDuration is 3600 seconds, so a leaked session credential is useless after one hour.

Check: Role setting

Every access is logged by you

Each assume-role call appears in your own CloudTrail as AssumeRole with the Appware principal and your ExternalId condition.

Check: Your CloudTrail

Instant revocation

Delete the stack or the role and the trust is gone immediately. No Appware action is needed.

Check: CloudFormation delete-stack

02 / ONBOARDING TEMPLATE

The AppwareAuditEngine CloudFormation template

This is what you deploy. Read it before you do. The actions below are the complete list: ce:GetCostAndUsage, cloudwatch:GetMetricData, ec2:DescribeVolumes, ecs:ListClusters, ecs:ListServices, ecs:DescribeServices, bedrock:GetModelInvocationLoggingConfiguration.

appware-audit-engine.yaml Download

AWSTemplateFormatVersion: '2010-09-09'
Description: >-
  Appware Pty Ltd (ACN 674 815 297) read-only audit role. Grants read and list verbs only.

Parameters:
  AppwareExternalId:
    Type: String
    Description: Unique ExternalId issued by Appware at kickoff. Do not create your own.
    AllowedPattern: '^appw_[A-Za-z0-9_-]{32}$'
    MinLength: 37
    MaxLength: 37
  AppwareAuditorPrincipalArn:
    Type: String
    Description: Named Appware auditor role or user supplied at kickoff. Account root is rejected.
    AllowedPattern: '^arn:aws:iam::\d{12}:(role|user)/[\w+=,.@-]+$'

Resources:
  AppwareAuditEngine:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub 'AppwareReadonlyAuditRole-${AWS::AccountId}'
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref AppwareAuditorPrincipalArn
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref AppwareExternalId
      Policies:
        - PolicyName: AppwareReadonlyFinOpsInspection
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: CostExplorerGlobalReadOnly
                Effect: Allow
                Action:
                  - 'ce:GetCostAndUsage'
                Resource: '*'
              - Sid: RegionalReadOnlyInspection
                Effect: Allow
                Action:
                  - 'cloudwatch:GetMetricData'
                  - 'ec2:DescribeVolumes'
                  - 'ecs:ListClusters'
                  - 'ecs:ListServices'
                  - 'ecs:DescribeServices'
                  - 'bedrock:GetModelInvocationLoggingConfiguration'
                Resource: '*'
      Tags:
        - Key: ManagedBy
          Value: Appware

Outputs:
  RoleArn:
    Description: ARN of the Appware audit role
    Value: !GetAtt AppwareAuditEngine.Arn

You receive the ExternalId and the auditor principal ARN by email at kickoff. Never reuse an ExternalId across accounts, and never create your own.

03 / SOVEREIGN AIR-GAP

POSIX 0700 partitions between audit work and operator data

Tenant vault directories use mode 0700 (rwx------). Only the owning user can enter them. Any other process receives PermissionError from the kernel, not a filtered view.

Hover or focus a node for detail.

04 / KMS TENANT VAULTS

One key per Sovereign Retainer tenant

Dedicated key per tenant

Each Sovereign Retainer tenant vault is encrypted under its own KMS key, so one tenant's key cannot decrypt another tenant's data.

Check: KMS key alias per tenant

Pinned to ap-southeast-2

Keys and ciphertext both live in the Sydney region. A single-region KMS key cannot be used from another region.

Check: KMS console, key region

Attributable key use

KMS records Decrypt and GenerateDataKey calls in CloudTrail, so every use of a tenant key can be traced to a principal.

Check: CloudTrail event history

05 / AUSTRALIAN DATA SOVEREIGNTY

ap-southeast-2 Sydney, delivered through the Brisbane edge

Data	Location	Detail
Customer data at rest	ap-southeast-2 (Sydney)	Audit inputs, dossiers and tenant vaults are stored in the Sydney region.
Encryption keys	AWS KMS, ap-southeast-2	Each Sovereign Retainer tenant vault is encrypted under its own KMS key in the same region.
Public website	CloudFront, including the Brisbane edge	Only public static pages are cached at the edge (Brisbane Edge BNE50-P3). No customer data is served from the edge.
Legal entity	Appware Pty Ltd, Queensland	An Australian company (ACN 674 815 297) subject to Australian law.

Trust and compliance See a sample dossier