Run it in your own AWS account.

Our access role. It trusts only our service, only with your connection’s external ID, for at most an hour per session.

Everything our access role is refused, such as deleting disks, changing logs, alerts or backups, or opening a session. It’s attached as the role is created, and the role can’t change it.

More refusals for our access role: changing this stack or any IAM role, passing any role but the computers’ own, copying or exporting disks and images, reading parameters or logs, opening the network, and running the stack’s security collector.

Support access. Created only if you set SupportAccess to limited or full and a SupportAccessUntil time, and it stops working then. Only our audited staff console can use it.

Only if you turn it on

Your current support access level and expiry. Support commands and sessions check it before starting and refuse missing, expired or revoked grants. Persistent Compute’s access, support and computer roles cannot change it.

Memory, disk, uptime, out-of-memory count and setup status.

Whether our service, the network client and SSH are running.

Recent log lines from our service, the network client and SSH.

Private network state and outbound HTTPS.

The only way Full support access can run a command. It writes the whole script to your security log first and refuses to run it if that write fails.

The only Session Manager session Full support access can open. It streams the whole session to your security log and closes if its opening entry can’t be written.

The computer’s own role: Systems Manager, its own setup key, and adding to the security log, including support session recordings.

Attaches the computer role to each cloud computer.

The only launch template our role can launch from: the computer role and required instance metadata tokens, with no user data.

Encrypts each computer’s one-time network key. Owned by your account, rotated yearly.

Kept if you delete the stack

Report which version of our software is installed.

Check the computer image has what setup needs.

Install our background service and network client, checked against fixed checksums.

Report whether setup finished.

Join the computer to your private network with a one-time key.

Check that the background service is connected.

Install git, Python, ripgrep or jq.

Same as the approved key list below, kept so the switch to this stack version never drops a key change.

Grow the file system after a disk is resized.

Check whether the computer is idle.

Update our background service and network client, checked against fixed checksums. Only signed releases unless you turn signature checks off, and only releases you accept, by the full digest of every file, if you pin them.

Set which SSH keys can sign in to the computer, keeping only keys your admin signed if you add an approval key.

Install our background service and network client from the computer image, checked against fixed checksums. Only images whose files we signed unless you turn signature checks off.

The same update, carrying your admin’s signature. If you add an approval key, both update actions refuse any release your admin didn’t sign, digest by digest, even one we signed.

The same first install, carrying your admin’s signature. If you add an approval key, every first install refuses a release your admin didn’t sign, even one we signed.

Names the current version of these documents and your release and device settings. An older version refuses to run, and our role can’t change this value.

Holds the output of our named actions for one day, encrypted, with public access blocked. Our role reads only this bucket’s named-actions folder.

Refuses any access to that bucket that isn’t over HTTPS.

CloudWatch log group for every action and snapshot. Kept for 365 days unless you choose otherwise.

Kept if you delete the stack

Records installed software, launch settings, SSH keys and SSH logins.

Runs that record on every cloud computer every 30 minutes.

Records read and write management events across Regions, with log file validation. Data events are not enabled by this template.

Holds the trail’s logs, encrypted and versioned, with public access blocked.

Kept if you delete the stack

Lets only this trail write to the bucket, over HTTPS.

Sends the alerts.

Delivers them to SecurityAlertEmail, once you confirm the subscription.

Lets only the stack’s alert rules publish.

Our role attaching, detaching or replacing a disk, or trying to change a computer's attributes. Disks move only for resizes and replacements.

Our role launching a computer with its own user data. We never send it, and our images ignore it.

Our role or the disk custodian removing a computer, deleting a disk or touching a snapshot.

Anyone deleting a backup or changing a backup vault, its lock or a backup plan.

Anyone updating or deleting this stack. Our role can’t, so this tells you when someone on your side changed a setting.

Anyone adding or changing an inbound rule on the computers’ security group, which needs none.

Holds the backups. Its lock refuses to delete one before BackupRetentionDays (14 by default), and its policy refuses every change from our roles. Choose compliance in BackupVaultLockMode to make the lock permanent after three days.

Kept if you delete the stack

Lets AWS Backup take and restore the snapshots, with AWS’s own backup policies.

A backup of every disk once a day at 05:00 UTC, kept for BackupRetentionDays.

Only if you turn it on

Picks every disk tagged to this connection. Our role can’t remove those tags.

Only if you turn it on

Removes a computer only after setting every disk to survive it, and deletes a detached disk only once a backup taken after the request is in your vault. Our role can call it and nothing else about it.

Lets the custodian delete and tag only your team’s disks, remove your team’s computers and start backups.

The custodian’s log: each call’s action and outcome.

Kept if you delete the stack

Every 15 minutes, finishes deletions whose backup has completed.

Lets only that rule start the custodian.

Denies our access role attaching any disk itself and lets it call only the approval function.

Attaches a disk only to one of the two computers an admin signed for, before the approval expires, once each.

The function's role: attach your team's tagged disks and record each use.

Records each approval's use so it can't be replayed.

A dedicated VPC, 10.88.0.0/16.

Outbound internet access.

Attaches the gateway to the VPC.

One subnet, 10.88.0.0/20, in one Availability Zone.

Routes for that subnet.

Sends outbound traffic to the internet gateway.

Links the subnet to its routes.

No inbound connections. All outbound traffic.