Security
How CloudFix protects your AWS environment and data.
Finder-Fixer Lifecycle
CloudFix uses a secure four-step lifecycle to analyze and optimize your AWS infrastructure. At every stage, you maintain full control over your data and changes.
Connect via CloudFormation StackSet
You connect your AWS account to CloudFix through a CloudFormation StackSet provided by CloudFix. This creates carefully scoped IAM roles with only the permissions needed for analysis and approved optimizations.
Metadata Collection (Read-Only)
The Finder role collects resource metadata using standard AWS tools — AWS Cost and Usage Reports (CUR), CloudWatch metrics, and read-only instance metadata. No application data or content is accessed. Only Describe, List, and Get actions are performed.
Optimization Recommendations
75+ automated finders analyze the collected metadata to identify cost savings opportunities. Recommendations appear in your CloudFix dashboard with estimated savings, effort, and risk for each finding.
Approved Execution via AWS Systems Manager
When you approve a fix, CloudFix executes it through AWS Systems Manager (Change Manager and Automation runbooks). You must explicitly approve the change template before any changes are made. Changes are executed by a role on your account that CloudFix creates but cannot itself assume or access.
IAM Role Architecture
CloudFix creates a set of minimally-scoped IAM roles in your AWS account. Each role follows the principle of least privilege and is limited to specific service areas.
Core Functionality Roles
cloudfix-athena-query-execution-role — Queries AWS Cost and Usage Reports via Amazon Athena. Manages AWS Organizations data and CloudFormation stack operations. This role processes billing data, not infrastructure data.
Finder Role
cloudfix-finder-role — Discovers optimization opportunities across your AWS services. The vast majority of permissions are Describe, List, and Get — passive read operations that make no changes to your resources. The role also holds a small set of non-destructive write permissions required for normal operation: resource tagging (using a cloudfix: prefix), writing to CloudWatch Logs, querying Athena, and publishing SNS notifications. No permissions to read, modify, or delete application data, S3 object contents, or database records are included.
Fixer Roles (Require Approval)
Fixer roles are created for executing approved optimizations. Critical security property: these roles are created by CloudFix in your account, but CloudFix cannot assume or access them. All fixer actions require explicit approval of central automation runbooks in AWS SSM Automation.
Helper & Cleanup Roles
Auxiliary roles support housekeeping functions like resource cleanup after completed operations. These roles also follow least-privilege principles with account-level and resource-level permissions where possible.
CloudFormation Templates
All CloudFix infrastructure is deployed via CloudFormation. You can review the exact templates before deployment:
| Template | Purpose | Link |
|---|---|---|
| Onboarding Stack | Main org stack — deploys all resources and roles required by CloudFix | cloudfix-onboarding.yaml |
| CUR Stack | Sets up Cost and Usage Report, Glue Crawler, Athena workspace | cloudfix-cur.yaml |
| CUR Role | IAM role for CUR and Athena query execution | cloudfix-cur-role.yaml |
| Resource Account Roles | Finder and fixer IAM roles deployed to resource accounts via StackSets | cloudfix-resource-account-roles.yaml |
Templates are also available at cloudfix-templates.s3.amazonaws.com — these are the same templates used during onboarding.
Infrastructure Security
- CloudFix runs on AWS infrastructure (us-east-1) with VPC isolation and security groups
- No public endpoints for data processing
- Customer onboarding via CloudFormation StackSet — fully auditable IaC
- All fixes implemented via AWS Systems Manager (Change Manager / Automation) with explicit customer approval
- All data encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Dashboard delivered via Amazon CloudFront (AWS CDN) — no third-party CDN providers
AWS-Native Footprint
CloudFix deploys no user agents or third-party code into your AWS account. The only AWS services used within your account are:
CloudTrail Auditability
Every API call made by CloudFix into your AWS account is logged in AWS CloudTrail and annotated with the CloudFix IAM role, identifying it as CloudFix-originated access. Where relevant, logs also identify the originating user. This gives you a complete, independent audit trail of all CloudFix activity — without relying on CloudFix's own logs.
Application Security
- SOC 2 Type 2 certified
- Regular security assessments and penetration testing
- HTTPS enforced on all endpoints
- Session management with secure cookies
- Role-based access control (RBAC) for multi-account setups
- SSO/SAML available on Scale+ plans
Access Control
- Principle of least privilege — every IAM role is scoped to only the actions it needs
- Customer data isolation — per-account isolation ensures data separation
- Audit logging — all fix operations are logged and auditable
- No credential storage — CloudFix uses AWS IAM role assumption, not stored credentials
Encryption Standards
- Data in transit: TLS 1.2 minimum enforced on all endpoints. HTTPS enforced; HTTP connections are redirected.
- Data at rest: AES-256 encryption on all AWS storage services (S3, RDS, EBS).
- API authentication: All API calls use token-based authentication transmitted over TLS. Tokens are scoped and rotatable.
- No credentials stored: CloudFix uses AWS IAM role assumption (STS AssumeRole) — no long-lived credentials are stored.
Network Connectivity Requirements
CloudFix operates entirely over standard HTTPS. There are no requirements for dedicated network links, VPNs, or firewall tunnels.
Outbound from Customer Account
- CloudFix IAM roles in your AWS account call back to CloudFix over HTTPS (port 443) — standard AWS STS and SSM Automation traffic.
- No inbound connections are made into your VPC or private subnets.
- CloudFormation StackSets are deployed from AWS-managed infrastructure.
Webhooks (Optional — for ITSM and other integrations)
CloudFix supports outbound webhooks for integrating with external platforms such as service desk and ITSM tools. When configured, CloudFix sends HTTPS POST requests to the webhook endpoint you specify.
- Webhooks originate from CloudFix infrastructure hosted in AWS
us-east-1. - If your ITSM platform requires IP allow-listing, contact CloudFix support to obtain the current egress IP range.
- Webhook payloads are JSON over HTTPS. No customer AWS data payload beyond recommendation metadata (resource IDs, savings amounts, status).
IP Allow-listing
CloudFix does not require customers to whitelist specific IPs for inbound access to their AWS accounts — IAM role trust relationships govern access. For outbound webhook allow-listing requirements, contact the CloudFix support team.
Architecture Diagrams
Visual data flow diagrams covering the core CloudFix architecture and ITSM / service desk integration.
View Architecture Diagrams →API Documentation
CloudFix provides a REST API for programmatic access to recommendations, approval workflows, and reporting. This is the primary integration surface for ITSM and service desk platforms.
Endpoint Summary
Full list of available endpoints, parameters, and response schemas.
View Endpoints →Workflows & Examples
Example flows for listing, approving, and tracking recommendations via API.
View Examples →Incident Response & Vulnerability Management
- Documented incident response plan aligned with SOC 2 requirements
- Customer notification within 24 hours for confirmed security incidents
- Post-incident review and remediation process with root cause documentation
- Regular security assessments and third-party penetration testing (results available under NDA)
- Vulnerability disclosure: report security issues via the contact form — acknowledged within 1 business day