verified_userSecurity Posture v4.2

Engineered for
Least Privilege.

Foundry is built on a read-only-by-default architecture with audited, JIT-based overrides for remediation. We treat trust as a transient resource, not a permanent state.

SOC2 TYPE II COMPLIANT
GDPR READY

The Security Fabric

Infrastructure-level isolation and OIDC-based identity propagation.

account_tree

Cross-Account IAM

Foundry utilizes cross-account assume-role chains with external-ID enforcement. No long-lived credentials are ever stored in the platform state.

// Boundary Policy
Condition: StringEquals: { "aws:PrincipalAccount": "TRUSTED_ID" }
fingerprint

OIDC-Based Trust

Direct identity federation between your AWS environment and Foundry services. Session tokens are scoped to specific resource operations and TTL-bound.

  • STS Federation
  • JWT Payload Validation
gif

Split Archetypes

Complete separation of Collector and Provisioner roles. Collectors are restricted to 'Describe*' and 'List*' actions in all contexts.

Collector: ReadOnlyProvisioner: WriteOnly

Permission Logic

Compare the immutable Read-Only policy against our ephemeral Just-In-Time Remediation set. Auditing is mandatory for any elevation event.

Zero Persistent Write

Standard agents have 0% mutation capability.

Blast Radius Isolation

IAM actions are restricted by VPC and Tag boundaries.

iam_policy_diff.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "StandardCollector",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "rds:List*",
        "s3:GetBucketTagging"
      ],
      "Resource": "*"
    },
    {
      "Sid": "JITRemediator",
      "Effect": "Allow",
      "Action": [
        "ec2:RevokeSecurityGroupIngress",
        "iam:DeactivateMFADevice" // BLOCKED
      ],
      "Resource": "arn:aws:ec2:*:*:security-group/*",
      "Condition": { "StringEquals": { "foundry:audit": "active" } }
    }
  ]
}

Data Integrity & Encryption

Your metadata is your own. We just help you manage it.

/state_storage

PostgreSQL State Storage

High-availability RDS cluster with synchronous replication. Every row is encrypted using AWS KMS with customer-managed keys (CMK) support.

/nightly_sync

Nightly S3 Snapshots

Immutable S3 buckets with Object Lock enabled. 99.999999999% durability with cross-region replication for disaster recovery scenarios.

lock

Encrypted at Rest

AES-256 standards for all block storage and database volumes.

vpn_lock

mTLS 1.3 Transit

Mandatory Mutual TLS for all internal microservice communication.

visibility_off

Metadata Masking

PII and secrets are automatically redacted from logs before storage.

Audited Overrides

The 'safety gate' philosophy. Foundry recognizes that cloud infrastructure requires occasional emergency intervention. We facilitate these through high-friction, fully audited workflows.

force_cidr Overrides

Requires secondary approval from a designated security lead. Automatically reverts after 4 hours.

Blast-Radius Dismissals

Security events can be suppressed, but only with a cryptographic signature and a link to a Jira/ServiceNow ticket.

PENDING_OVERRIDE_REQUEST
Requested By:ops_admin_04
Target Action:security_group_ingress_open
Risk Score:CRITICAL (0.84)