Security

How Drizzle Cloud connects to AWS, isolates tenant data, and handles disclosure.

Read-only access, a unique external ID per connection, isolation enforced at every layer, and an audit trail you can read.

Read-only access, by default

The collection role is read-only. Future remediation capability will use a separate role with explicit, per-action approval — never bundled into the same permission set as collection.

Never permanent credentials

Drizzle Cloud connects through AWS STS AssumeRole with a cryptographically random external ID, unique per connection and never reused across tenants. We never ask for or store long-lived AWS access keys.

Tenant isolation, enforced in depth

Tenant context comes from trusted authentication claims, never a client-supplied ID. Isolation is enforced in API authorization, database queries, row-level security, background jobs, storage prefixes, cache keys, and logs — not just one layer.

Encryption in transit and at rest

Data is encrypted in transit and at rest using AWS KMS-managed keys. External IDs, tokens, and secrets are classified as restricted data with the strictest handling rules we apply.

Least-privilege, versioned onboarding

The customer-deployed CloudFormation role uses a documented, least-privilege policy. Missing permissions are reported by capability, not as an opaque failure, so you know exactly what to grant.

Auditable by design

Authentication events, permission-denied events, and administrative actions are recorded as an immutable audit trail scoped to your tenant.

The role you deploy

Every permission is a read, and you can read every permission.

The onboarding template is versioned and published. Its trust policy names one principal and your connection’s external ID — two during a rotation, so a rotation never breaks collection; its permissions policy is a custom document with no managed policies attached.

drizzle-cloud-read-only-role.yamlTrust policy excerpt

AssumeRolePolicyDocument:
  Statement:
    - Effect: Allow
      Principal:
        AWS: arn:aws:iam::[DRIZZLE ACCOUNT]:root
      Action: sts:AssumeRole
      Condition:
        StringEquals:
          sts:ExternalId: [UNIQUE PER CONNECTION]
ManagedPolicyArns: []   # none — custom read-only policy only

Data handling

What we store, and what we never collect.

We do not collect resource content: no S3 object contents, database records, Lambda environment secrets, or EC2 filesystem data.
Only configuration metadata required for inventory, cost, security, and compliance is stored.
Raw AWS API responses are classified confidential and retention-controlled; nothing raw is logged unredacted.
Tenant offboarding includes retention expiry and verifiable deletion.

Responsible disclosure

Found something? Tell us directly.

Report a vulnerability to security@jeyad.ai. Security reports never queue behind support requests. We acknowledge every report and will work with you on disclosure timing.

See your AWS estate clearly.

Onboarding a first AWS account takes minutes, and access stays read-only.