See who can get into your cloud.

CloudArq reads the trust policies that let pipelines, partner accounts and sign-ins into your cloud without a password, and tells you in one sentence who each one actually lets in.

Built for platform teams.

Start free Try the explorer

The engine is source available
No cloud credentials
Nothing you paste leaves this tab

Example deploy roles

Open to anyone on the platformOpen to one organisationPinned to one branch

octo-org/deployGitHub Actions, main branchAdmitted by grant 2. Grant 1 rejects it on iss; grant 2 admits it.
111122223333:role/ciAnother AWS accountAdmitted by grant 1. Grant 1 admits it; grant 2 rejects it on aud.
octo-org/infraGitLab CI, main branchNot admitted by any grant. Grant 1 rejects it on iss; grant 2 rejects it on aud.
octo-org/deployGitHub Actions, a pull requestAdmitted by grant 2. Grant 1 rejects it on iss; grant 2 admits it.
octo-org/productionHCP Terraform workspaceNot admitted by any grant. Grant 1 rejects it on iss; grant 2 rejects it on aud.
octo-org-anything/deployAn organisation anyone can registerAdmitted by grant 2. Grant 1 rejects it on iss; grant 2 admits it.
octo-org/deployBuildkite pipelineNot admitted by any grant. Grant 1 rejects it on iss; grant 2 rejects it on sub.
ExampleIdPSAML sign-inNot admitted by any grant. Grant 1 rejects it on iss; grant 2 rejects it on aud.

productionaccount

release-publisherAnyone on GitHub

release-publisherproductionAnyone on GitHub

Anyone on GitHub can assume this role.Coloured lines get in. Grey lines stop at the door. Point at one to see why.

Answered when this page was built; CloudArq answers again in this tab next.

What CloudArq reads

A role’s trust policy says who may use it without a password. One line decides who gets in. Change it, and CloudArq answers again.

The trust policy as written

123456789101112131415161718192021222324252627{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
beyond:           "token.actions.githubusercontent.com:sub": "repo:octo-org*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:role/ci"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

line 15

sub

any subject beginning repo:octo-org

Anyone on GitHub can assume this role.

Who can get in

Everyone a company’s trust policies let in, in five groups, from anyone on the internet to its own people.

Anyone on the internet
Nothing limits who gets in.
Anyone on a platform
Anyone who can sign up to the service this trust relies on, such as any GitHub user.
Outsiders
One account or organisation that isn't yours.
Your pipelines
Your own CI jobs, limited to your repositories.
Your people
People who sign in through your company's own identity provider.

Into what

Each way in, drawn down to the role it opens and the account it is in. Here, 4 of the example’s 23 roles can be assumed from outside the company.

Blue: exactly who the policy names. Orange: more than it names.

Unknown

CloudArq couldn't read this condition, so it assumes the widest answer until it can.

gitlab-runnersandbox
Anyone could assume this role: nothing read shows GitLab.com requires an account.
sso-adminproduction
People VendorSSO signs in can assume this role; who they are is set in VendorSSO.

An example company: the names are made up, the answers are CloudArq’s.

Outside your company

Anyone on the internet

Nothing limits who gets in.

AnyoneAnyoneGitLab CIAnyone · unknown

Anyone on a platform

Anyone who can sign up to the service this trust relies on, such as any GitHub user.

Anyone on GitHubAnyone on GitHubGitHub ActionsAnyone on GitHub · exact

Outsiders

One account or organisation that isn't yours.

111122223333aws:111122223333AWS accountA named outsider · exact
betagithub:betaGitHub accountA named outsider · exact
gammagithub:gammaGitHub accountA named outsider · exact
EXAMPLED539D4633E53DE1B71EXAMPLEissuer:https://oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLEEKS clusterA named outsider · exact

Your company

Your pipelines

Your own CI jobs, limited to your repositories.

acmegithub:acmeGitHub accountYour pipelines · exact

Your people

People who sign in through your company's own identity provider.

VendorSSOsaml:arn:aws:iam::123456789012:saml-provider/VendorSSOSAML sign-inYour people · unknown

gitlab-runnerAnyonesha256 1ee84cb8ecc7
7 rolesonly yours

sandboxAWS account

vendor-auditOutsiderssha256 d06b5cb89a5c
release-publisherAnyone on GitHubsha256 37c6d52ed599
sso-adminYour peoplesha256 ba9c8354c44e
5 rolesonly yours

productionAWS account

terraform-planOutsiderssha256 d496c018be94
eks-workloadsOutsiderssha256 21f0a1dac086
5 rolesonly yours

stagingAWS account

Anyone on the internet
- AnyoneAnyoneGitLab CI
  - gitlab-runnersandbox
Anyone on a platform
- Anyone on GitHubAnyone on GitHubGitHub Actions
  - release-publisherproduction
Outsiders
- 111122223333aws:111122223333AWS account
  - vendor-auditproduction
- betagithub:betaGitHub account
  - terraform-planstaging
- gammagithub:gammaGitHub account
  - terraform-planstaging
- EXAMPLED539D4633E53DE1B71EXAMPLEissuer:https://oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLEEKS cluster
  - eks-workloadsstaging
Your pipelines
- acmegithub:acmeGitHub account
  - 5 roles only yoursproduction
  - release-publisherproduction
  - 5 roles only yoursstaging
  - terraform-planstaging
  - 7 roles only yourssandbox
Your people
- VendorSSOsaml:arn:aws:iam::123456789012:saml-provider/VendorSSOSAML sign-in
  - sso-adminproduction

How to start

See your own map

Sign up, run one command that reads your AWS account on your machine, and drop the file it writes. CloudArq reads it in your browser and draws who can get into which of your roles.

Start free See the command

Paste a policy

Here, now. CloudArq reads it in this tab, and nothing you paste leaves it.

Paste a policy Open the explorer