AWS Access
The access model
Read-only, granted by you, federated with no stored credential, time-boxed to a date you set, and revocable by deleting one stack.
Five properties define how GovIntel reaches your AWS account. Each is enforced by the role you create, not by GovIntel's good behaviour.
| Property | How it is enforced |
|---|---|
| Read-only | The role holds no permission to create, modify or delete anything. Configuration reads only |
| No stored credential | Access is federated through GitHub OIDC. No access key exists, so there is none to leak, rotate or forget |
| Granted by you | The role is created in your account, by you, from a CloudFormation template you can read first |
| Time-boxed | The trust policy refuses to issue a session after the expiry date you set, and a second rule denies every action after it |
| Revocable | Delete the stack and the access is gone. You do not need to ask |
What GovIntel holds
A role identifier, which grants nothing on its own, and your 12-digit account number, which is not a secret and not a credential.
There is no standing access. Between assessments GovIntel can do nothing in your account at all, and during one it can only assume the role from a single workflow in a single repository on a single branch.
No inbound access
Nothing is installed. No agent, no collector process, no network path into your environment. The assessment runs on GovIntel's side and reads outward.
What this costs
A read-only boundary that genuinely denies data-plane reads cannot run the checks that need them. GovIntel publishes which ones. See What the boundary costs in coverage.
Verify it rather than trust it
Every claim above is visible in your own IAM console. See Verify the access boundary.