Engineered for
Least Privilege.
Foundry is built on a read-only-by-default architecture with audited, JIT-based overrides for remediation. We treat trust as a transient resource, not a permanent state.
The Security Fabric
Infrastructure-level isolation and OIDC-based identity propagation.
Cross-Account IAM
Foundry utilizes cross-account assume-role chains with external-ID enforcement. No long-lived credentials are ever stored in the platform state.
Condition: StringEquals: { "aws:PrincipalAccount": "TRUSTED_ID" }
OIDC-Based Trust
Direct identity federation between your AWS environment and Foundry services. Session tokens are scoped to specific resource operations and TTL-bound.
- STS Federation
- JWT Payload Validation
Split Archetypes
Complete separation of Collector and Provisioner roles. Collectors are restricted to 'Describe*' and 'List*' actions in all contexts.
Permission Logic
Compare the immutable Read-Only policy against our ephemeral Just-In-Time Remediation set. Auditing is mandatory for any elevation event.
Zero Persistent Write
Standard agents have 0% mutation capability.
Blast Radius Isolation
IAM actions are restricted by VPC and Tag boundaries.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "StandardCollector",
"Effect": "Allow",
"Action": [
"ec2:Describe*",
"rds:List*",
"s3:GetBucketTagging"
],
"Resource": "*"
},
{
"Sid": "JITRemediator",
"Effect": "Allow",
"Action": [
"ec2:RevokeSecurityGroupIngress",
"iam:DeactivateMFADevice" // BLOCKED
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": { "StringEquals": { "foundry:audit": "active" } }
}
]
}
Data Integrity & Encryption
Your metadata is your own. We just help you manage it.
/state_storage
PostgreSQL State Storage
High-availability RDS cluster with synchronous replication. Every row is encrypted using AWS KMS with customer-managed keys (CMK) support.
/nightly_sync
Nightly S3 Snapshots
Immutable S3 buckets with Object Lock enabled. 99.999999999% durability with cross-region replication for disaster recovery scenarios.
Encrypted at Rest
AES-256 standards for all block storage and database volumes.
mTLS 1.3 Transit
Mandatory Mutual TLS for all internal microservice communication.
Metadata Masking
PII and secrets are automatically redacted from logs before storage.
Audited Overrides
The 'safety gate' philosophy. Foundry recognizes that cloud infrastructure requires occasional emergency intervention. We facilitate these through high-friction, fully audited workflows.
force_cidr Overrides
Requires secondary approval from a designated security lead. Automatically reverts after 4 hours.
Blast-Radius Dismissals
Security events can be suppressed, but only with a cryptographic signature and a link to a Jira/ServiceNow ticket.