Get Started
Free.

plainfra needs a read-only IAM role to query your infrastructure. Every permission is listed explicitly — no write access, no secrets, no application data can be read. An explicit Deny block prevents reading your data under any circumstances.

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  plainfra — Read-Only Cross-Account Infrastructure Role.
  Every permission is explicitly listed. An explicit Deny block
  prevents reading S3 objects, DynamoDB rows, log events, secret
  values, parameter values, queue messages, and encrypted data.

# Role can only be assumed by plainfra account + your unique ExternalId.
# MaxSessionDuration: 1 hour.

# POLICY 1 — Infrastructure Discovery (Allow)
# Grouped by service. Covers EC2, Lambda, ECS, EKS, S3 (metadata only),
# RDS, DynamoDB (metadata only), ElastiCache, Redshift, CloudWatch,
# CloudWatch Logs (structure only), IAM (metadata only), CloudTrail,
# Config, GuardDuty, SecurityHub, AccessAnalyzer, KMS (metadata only),
# Secrets Manager (list only), SSM (parameter names only), CloudFront,
# Route53, ACM, WAF, SNS, SQS (no message retrieval), EventBridge,
# Kinesis (no record retrieval), CloudFormation, Cost Explorer,
# Trusted Advisor, AWS Health, Organizations, Resource Tags.

# POLICY 2 — Explicit Data Access Denial (Deny — always wins)
# s3:GetObject / GetObjectVersion        — cannot read file contents
# dynamodb:GetItem / Query / Scan        — cannot read table data
# secretsmanager:GetSecretValue          — cannot read secret values
# ssm:GetParameter / GetParametersByPath — cannot read secure strings
# logs:GetLogEvents / FilterLogEvents    — cannot read log content
# kms:Decrypt / GenerateDataKey          — cannot decrypt anything
# kinesis:GetRecords                     — cannot read stream data
# sqs:ReceiveMessage                     — cannot read queue messages
# lambda:InvokeFunction                  — cannot execute functions
# ec2:GetConsoleOutput / GetPasswordData — cannot access VM consoles
# rds-data:ExecuteStatement              — cannot run SQL queries

Want to verify? Paste the template into ChatGPT or Claude and ask it to explain exactly what this role can and cannot do.