AWS Access
The access model
Read-only, granted by you, federated with no stored credential, time-boxed to a date you set, and revocable by deleting one stack.
Five properties define how GovIntel reaches your AWS account. Each is enforced by the role you create, not by GovIntel's good behaviour.
| Property | How it is enforced |
|---|---|
| Read-only | The role holds no permission to create, modify or delete anything. Configuration reads only |
| No stored credential | Access is federated through GitHub OIDC. No access key exists, so there is none to leak, rotate or forget |
| Granted by you | The role is created in your account, by you, from a CloudFormation template you can read first |
| Time-boxed | The trust policy refuses to issue a session after the expiry date you set, and a second rule denies every action after it |
| Revocable | Access ends on its expiry date on its own. You can remove it sooner yourself, once you have checked what else relies on the role. See Revoking GovIntel access |
What GovIntel holds
A role identifier, which grants nothing on its own, and your 12-digit account number, which is not a secret and not a credential.
There is no standing access. Between assessments GovIntel can do nothing in your account at all, and during one it can only assume the role from a single workflow in a single repository on a single branch.
No inbound access
Nothing is installed. No agent, no collector process, no network path into your environment. The assessment runs on GovIntel's side and reads outward.
What this costs
A read-only boundary that genuinely denies data-plane reads cannot run the checks that need them. GovIntel publishes which ones. See What the boundary costs in coverage.
Verify it rather than trust it
Every claim above is visible in your own IAM console. See Verify the access boundary.