Security and permissions
Least-privilege, keyless-first credential handling, per-tenant isolation, and the role of the ExternalId.
Credential handling
Cloud Integrations is built so that, in the recommended flows, VerOps holds no long-lived secret of yours:
- AWS role assumption. You create a role that trusts VerOps, gated by a per-integration ExternalId. VerOps stores only the role ARN and ExternalId and requests short-lived temporary credentials at poll time.
- Azure app consent. You grant VerOps's application read-only monitoring access. VerOps stores only your tenant/subscription ids.
Where a secret is unavoidable (the static-keys or Service-Principal fallbacks), it is encrypted at rest and never returned to the browser — the UI only ever shows whether a secret is set.
Least privilege
| Provider | Grant | Nothing more |
|---|---|---|
| AWS | CloudWatch read (ListMetrics, GetMetricData, GetMetricStatistics) + tag:GetResources |
Read-only; no write, no data-plane access |
| Azure | Monitoring Reader on the target scope |
Read-only metrics; no resource management |
Isolation
Every integration and every metric it produces is scoped to your organization. One tenant can never see or affect another tenant's integrations or data.
The ExternalId matters
Warning: For AWS, always include the ExternalId condition in your role's trust policy. It ensures only your integration can assume your role, and is the standard defense against the “confused deputy” problem in cross-account access.
Revoking access
You are always in control: delete the integration in VerOps, remove the IAM role / Monitoring Reader assignment in your cloud account, or both. Polling stops immediately when an integration is disabled or removed.