Security & Access Model
What Wring can see, what it can never touch, and how that is enforced.
Wring's access to your AWS accounts follows one principle: read your cost data, and nothing else. Nothing is written, modified, or deleted in your account at any point.
What gets deployed in your account
Connecting an account deploys a small CloudFormation stack — reviewable before you launch it — that creates:
| Component | Purpose |
|---|---|
| IAM role | Cross-account role that Wring assumes to read cost data |
| Allow policy | Four audited, read-only API actions for billing/cost data and (for management accounts) listing your organization's member accounts |
| Explicit deny policy | Always active — blocks access to secrets, databases, logs, source code, and user identity data |
| EventBridge rule | Notifies Wring when the stack is created or deleted, so your account activates automatically — from whichever AWS Region you create the stack in |
In AWS IAM, an explicit deny always wins over any allow. Even if permissions were ever misconfigured, the deny policy makes sensitive data unreachable. The complete permission-by-permission breakdown — including the trust policy and the full deny list — is on IAM Permissions in Detail.
How Wring authenticates
- No credentials, ever. The role has no password and no access keys — there is nothing that could leak. Access happens exclusively through short-lived STS sessions that expire after at most one hour.
- External ID. Only Wring's platform account can assume the role, and only with a per-customer external ID — the standard protection against confused-deputy attacks.
- Full auditability. Every session is tagged and every access appears in your own CloudTrail. You can verify at any time exactly what Wring did.
Opt-in levels
The Base level described above is pure cost & usage reading. Optional capabilities ship as separate stacks with their own narrowly scoped, read-only roles:
| Level | Adds read access to | For |
|---|---|---|
| Security checks | configuration and audit metadata (EC2, IAM, RDS, S3, CloudTrail, CloudWatch) — never content | security findings and compliance scores |
| Wring Bedrock | two CloudWatch metric actions | per-model Bedrock token usage and cost |
| Observability | CloudWatch metrics | latency, error and throughput questions in Ask Werner |
You decide per account which levels to enable, and you can review each level's permissions before launching it. Each level is a separate stack, so deleting one revokes exactly that capability and leaves the rest working.
Billing is a payment relationship, not access
Moving your billing to Wring changes who pays AWS — it grants no additional technical access to your accounts. The read-only model above stays exactly the same.
Revoking access
You stay in control: deleting the CloudFormation stack in your AWS account removes the role and cuts Wring's access immediately — no ticket required.