Governance Concepts
Read-only assurance
The property that GovIntel can observe configuration and cannot alter anything or read data-plane content, enforced by IAM rather than by policy.
What it is
The guarantee that an assessment observes without changing, and reads configuration without reading content.
Why it is enforced rather than promised
A promise not to write is worth what the promiser's discipline is worth. A role with no write permission cannot write regardless of what any code attempts, and an explicit deny cannot be overridden by any allow.
How GovIntel applies it
The role grants describe and list operations only, and separately denies object and record content, secrets, cryptographic operations, log and stream content, code retrieval, function invocation, and role assumption.
What it costs
Three families of scanner check cannot run, because the actions they need are denied. GovIntel publishes which.
What it does not mean
It does not mean nothing leaves your account. Control results, posture, cost figures and configuration all do, because that is the assessment. What it means is that no data-plane content is read.