Before you grant AWS access, we want to be explicit: what 6WAF accesses, what it stores, and why your infrastructure stays safe.
No stored credentials
IAM Role + External ID. We never store keys.
Read-only by default
The Audit Role is read-only. It never changes your infrastructure.
External ID
Protects against the Confused Deputy attack.
Instant revocation
Delete the IAM Role → 6WAF loses access immediately.
You deploy the IAM Roles into your own AWS account. 6WAF never holds AWS credentials directly — we use STS AssumeRole with a unique per-tenant External ID.
FinOpsAuditRoleSecurity scan, cost data read, AI Correlation evidence
✓ Can do
✗ Cannot do
FinOpsSchedulerRoleStop/Start EC2 and RDS on schedule
✓ Can do
✗ Cannot do
FinOpsCleanupRoleDelete orphaned resources (only when Cleanup is enabled)
✓ Can do
✗ Cannot do
🔒 FinOpsAuditRole's 3-layer security model
AWS SecurityAudit (Managed Policy)
An AWS-managed policy built for security scanners such as Prowler and AWS Config. It lets us read the configuration metadata of 57+ AWS services — but never the actual content (no GetSecretValue, GetObject, GetParameter).
FinOpsDenyDataAccess (DENY Policy — hard firewall)
A DENY policy is evaluated before any Allow policy by AWS IAM — DENY always wins. It hard-blocks the 8 most dangerous actions:
✗ secretsmanager:GetSecretValue
✗ secretsmanager:BatchGetSecretValue
✗ ssm:GetParameter
✗ ssm:GetParameters
✗ ssm:GetParametersByPath
✗ ssm:GetParameterHistory
✗ s3:GetObject
✗ s3:GetObjectVersion
Even if AWS expands SecurityAudit in the future, these 8 actions stay permanently blocked by the DENY policy.
FinOpsAuditExplicit (Additional permissions)
Adds Cost Explorer (13 actions), CloudTrail, GuardDuty and the Well-Architected Tool — permissions that are not in SecurityAudit but are needed for the FinOps and AI Correlation features.
External ID mechanism: every tenant has a unique External ID (UUID). The IAM trust policy requires it to match on AssumeRole — even if an attacker knows your Role ARN, they cannot impersonate 6WAF without the correct External ID. This is the AWS-recommended defence against the Confused Deputy attack.
Why do we need CloudTrail and GuardDuty?
6WAF has an AI Cost-Security Correlation feature: when AWS spend rises abnormally, it checks CloudTrail and GuardDuty to determine whether the spike is tied to a security incident (e.g. cryptomining, data exfiltration, account takeover).
CloudTrail (3 actions)
LookupEvents — reads recent API events. DescribeTrails / GetTrailStatus — checks whether a trail is enabled. Read-only: cannot create, delete or stop trails.
GuardDuty (3 actions)
ListDetectors / ListFindings / GetFindings — reads existing HIGH/CRITICAL findings. Cannot archive, dismiss or create findings.
If GuardDuty isn't enabled in your account or has no findings, Correlation still works normally — CloudTrail and GuardDuty are supplementary evidence sources, not requirements.
AWS Well-Architected Tool — 11 actions (optional, your decision)
The Well-Architected Review (WAR) feature lets 6WAF create a workload and pre-fill notes on each WAT question from your scan results — replacing 2–3 hours of manual interviews with an SA. It is optional: it only runs if you open the Well-Architected Review page yourself.
6 WAF READ actions
GetWorkload— read workload detailsListWorkloads— list existing workloadsListAnswers— read questions and answersGetLensReview— read review results per pillarListMilestones— list milestonesGetConsolidatedReport— read the consolidated report5 WAF WRITE actions
CreateWorkload— create a new workload (idempotent)AssociateLenses— attach the WAF lens to the workloadUpdateAnswer— fill NOTES into WAT questionsCreateMilestone— create a point-in-time snapshotTagResource— apply the CreatedBy=6WAF tagImportant: 6WAF only fills in the Notes field on WAT questions — it never ticks the "best practice in place" checkbox. Confirming each best practice is the reviewer's / consultant's decision. The workload is created in your own AWS account, not 6WAF's — you stay fully in control and can delete it at any time.
✓ We STORE
✗ We do NOT store
Data residency note: scan data is stored in AWS ap-southeast-1 (Singapore). If you need data to stay inside your own account (data sovereignty), contact us about the BYOC deployment mode — the entire stack is deployed into your account.
The 6WAF team is AWS-certified, ensuring deep knowledge of the Well-Architected Framework, security best practices and cost optimization.
Solutions Architect Associate
AWS Certified
Developer Associate
AWS Certified
SysOps Administrator Associate
AWS Certified
Well-Architected Framework Expert
AWS Certified
Encryption in Transit
All API calls use HTTPS/TLS 1.3. The JWT lives in an httpOnly cookie and is never exposed to JavaScript.
Encryption at Rest
DynamoDB tables use AWS-managed encryption keys (SSE-AES256).
Least Privilege
6WAF Lambda functions can only access the DynamoDB tables they need — no wildcard IAM policies.
Audit Trail
Every scan action is logged in CloudWatch with tenant_id. You can verify it through CloudTrail in your own account.