The whole security policy fits on your screen.
plainfra answers plain-English questions about your AWS account. You install one read-only IAM role to connect it. For OzBargain we built a lite version of that role with exactly one permission: ec2:Describe*. Read it in ten seconds, install it, ask away. No card, no sales call.
Prefer the full read-only role (costs, security posture, every service)? Start with full read-only instead.
{
"TrustPolicy": {
"Version": "2012-10-17",
"Statement": [{
"Sid": "AllowPlainfraAssumeWithExternalId",
"Effect": "Allow",
"Principal": { "AWS": "arn:aws:iam::921514166437:root" },
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": { "sts:ExternalId": "<your-unique-id>" }
}
}]
},
"PlainfraEc2DescribeOnly": {
"Version": "2012-10-17",
"Statement": [{
"Sid": "Ec2MetadataOnly",
"Effect": "Allow",
"Action": [ "ec2:Describe*" ],
"Resource": "*"
}]
}
}
What that policy actually allows
You are the audience that reads the terms before clicking. Good. Here is the honest breakdown, and yes, paste the policy into your own AI assistant and check us.
What it can see
EC2 metadata only: instances and their types, volumes, snapshots, AMIs, security groups, VPCs, subnets, NAT gateways, Elastic IPs. The stuff you'd see on the EC2 console pages.
What it cannot see
Everything else. No S3, no databases, no IAM, no billing, no logs, no secrets, no file contents. ec2:Describe* matches metadata calls only; console output and password data are separate permissions we did not ask for.
Why it can't be assumed by anyone else
The trust policy restricts the role to plainfra's AWS account AND a unique ExternalId generated for you at signup. Both must match. Sessions last at most an hour and are issued on demand.
How you get rid of it
Delete the plainfra-ReadOnly CloudFormation stack in your console. Access ends immediately. No email, no support ticket, no retention period.
What you can ask on the lite role
Trial is 48 hours and 50K tokens, no card. Plenty to prove it works against your real account.
"What's actually running?"
Every instance, its type, state, and AZ, in one answer. Handy when the console shows you one region at a time and you've forgotten what's in the other one.
"What's sitting there unused?"
Stopped instances still holding EBS volumes, unattached volumes, idle Elastic IPs. The quiet leftovers that turn into line items.
"Any security groups open to the world?"
Security group rules are EC2 metadata, so the lite role can spot 0.0.0.0/0 on port 22 just fine. Full IAM and S3 posture checks need the full role.
The honest catch: the lite role cannot answer cost questions ("what's my bill?") or audit anything outside EC2. That is the trade you are making for a one-line policy. Upgrading later re-deploys the same CloudFormation stack with the full read-only template, in place, nothing to uninstall.
How it works
Sign up with your email
Verify a code, enter your AWS account ID, and pick the EC2-only lite option. No card, no phone number.
Install the one-permission role
One CloudShell command or a pre-filled CloudFormation link. You can read the full template on S3 before you run anything.
Ask your account questions
Plain English in, real answers from your real infrastructure out. All processing in AWS Sydney, ap-southeast-2.
Read-only. Always.
plainfra can inspect but never modify, delete, or create anything. That's true on the lite role and the full role alike.
Australian-hosted
Built in Melbourne, runs in Sydney (ap-southeast-2). Your infrastructure data does not leave Australian jurisdiction.
From $20/mo
After the trial, Scout covers one AWS account for less than a takeaway lunch a fortnight. Cancel any time from the billing portal.
One permission. Ten-second read. Free trial.
48 hours, 50K tokens, no card. If it's not useful, delete the stack and walk away with nothing owed and nothing installed.
No card for trial • Delete the stack any time • Sydney-hosted