Security & Trust

AWS access that you can review

CloudBudgie connects through a cross-account IAM role in your AWS account, using AWS Security Token Service to obtain temporary credentials. The role’s trust policy uses an external ID associated with your CloudBudgie account. You review and create the role during onboarding, rather than supplying a long-lived AWS access key.

Permissions depend on the capabilities you use. Start read-only if you only need analysis; grant write actions only for the features you intend to authorize. Scans read supported AWS resource information during refreshes and scheduled evaluations. Write permissions are used for authorized operations, such as changing a configuration, deleting an unused resource, or stopping and starting a scheduled workload.

To revoke AWS access, remove the role’s permission for CloudBudgie to assume it, or delete the role in AWS IAM. Disconnect the account in CloudBudgie as well. Revocation prevents future access as AWS credentials expire; it does not undo completed changes.

Choose how changes happen

Direct remediation changes AWS; IaC remediation creates proposals for review. Preview mode simulates actions. Off Hours schedules can also stop and start workloads automatically once configured.

Review enabled policies and schedules before granting write access. Disable automation you no longer want, and revoke provider access if you need to prevent future operations. Disabling a policy or disconnecting an account does not reverse changes already made.

GitHub access through BudgieBot

Install the BudgieBot GitHub App and choose the repositories it can access in GitHub. CloudBudgie synchronizes repository information and indexes supported IaC so it can match AWS resources to their code. For an IaC optimization, it reads relevant source, prepares a change on a branch, and opens a pull request after validation succeeds.

Contents — read and write

Read repository files and commit proposed changes to a branch.

Pull requests — read and write

Create optimization pull requests and track their status.

Metadata — read

Read basic repository information needed for the integration.

These are repository permissions, not an IaC-only access restriction enforced by GitHub. Limit the installation to the repositories you intend to connect. Review the permissions GitHub displays when installing or updating the App. You can change repository selection, suspend, or uninstall the App in GitHub’s installation settings. Removing access does not remove branches, pull requests, or changes already deployed through your own workflow.

Validation before a pull request

Supported Terraform and CloudFormation changes are checked in a separate container task against a pinned repository commit. The validation workspace is cleaned up when the task exits. Terraform checks run initialization with the backend disabled and then validation; they do not run Terraform apply or require access to your Terraform state. CloudFormation templates are checked with cfn-lint.

Validation can catch configuration errors; it does not prove a change is suitable for your workload or guarantee a successful deployment. Review the diff and run your own CI, planning, and deployment checks before merging.

Data, source code, and AI

CloudBudgie processes AWS account and resource identifiers, names, configurations, tags, utilization measurements, and operational status to evaluate savings opportunities. Connected repository metadata, IaC indexes, generated diffs, and validation results are stored to support the IaC workflow. Source files are fetched for analysis and validation; code processing is part of the service.

Retention and deletion

Retention depends on the data involved, the account or integration lifecycle, and applicable operational, legal, and security requirements. The Privacy Policy’s retention and deletion section describes the current policy, exceptions, and how to request deletion. Disconnecting an integration does not itself delete previously retained data. Contact support to discuss source-code and IaC artifact retention for your organization.

Security practices and contact

AWS role validation checks the external ID requirement. The GitHub integration verifies webhook signatures, and the IaC workflow checks that the installation is active before opening a pull request. These controls work alongside the permissions and automation settings you choose.

For security questions, suspected issues, data-handling details, or deletion requests, email support@cloudbudgie.com.

Read our Privacy Policy and Terms of Service for the applicable policies and responsibilities.