How We Access Your AWS
Guardian Pro connects to your AWS account through a cross-account IAM role that you deploy and control. You choose what level of access to grant. Here is exactly how it works.
Two Access Modes
You choose which mode to enable during onboarding. Each mode adds permissions on top of the previous — you can upgrade or downgrade at any time by updating the CloudFormation stack.
Monitor
Read-only. Scans and analyses your infrastructure. Cannot change anything.
- Uses AWS managed policies: ReadOnlyAccess and SecurityAudit
- Resource discovery, security scanning, compliance assessment, cost analysis
- Zero write permissions to your account
- Default mode — every account starts here
Protect
Adds scoped remediation. Fix findings with one click, roll back if needed.
- Adds five Guardian Pro managed policies scoped to specific services
- Every change shows a full preview before execution
- Every change captures a pre-change snapshot for rollback
- You upgrade from Monitor when you are ready — not before
What We Can and Cannot Access
We read how things are configured, never what is inside them.
Role of AI in Guardian Pro
The AI has zero direct access to your AWS account.
No direct AWS access
The AI never connects to your AWS account. It has no credentials, no IAM role, and no ability to make AWS API calls on your behalf.
Pre-collected data only
The AI analyses resource configurations that Guardian Pro has already collected and stored. It works from a snapshot, not a live connection.
Cannot make changes
The AI generates recommendations and explanations. It cannot trigger remediations, modify resources, or take any action in your account.
Runs on Amazon Bedrock
All AI processing runs on Amazon Bedrock within AWS infrastructure. Your data is not used to train models and does not leave the AWS region.
Cross-Account Access Model
Guardian Pro never stores access keys. It uses temporary credentials that expire automatically. You deploy and control the IAM role.
No long-lived credentials
Guardian Pro never stores long-lived access keys. Every connection to your account uses temporary credentials that expire automatically.
External ID verification
Every role assumption requires an external ID unique to your account and organisation. This prevents confused deputy attacks — no other AWS account can assume your Guardian Pro role.
You own the role
The IAM role lives in your AWS account, deployed via a CloudFormation template you review before deploying. You can revoke access instantly by deleting the stack.
Full auditability
Every Guardian Pro API call appears in your CloudTrail logs. You can audit exactly what was accessed, when, and by which session.
Remediation Safety
Every fix follows a strict pipeline. Nothing changes without a preview, nothing executes without a snapshot, and every change can be rolled back.
Preview
See exactly what will change before you confirm
Snapshot
Pre-change resource state captured automatically
Execute
Fix applied with real-time progress tracking
Verify
Automated verification that the fix was applied
Rollback
One-click revert using the captured snapshot
Dependency analysis
Rollback checks downstream resources before reverting
Approval gates
High-impact rollbacks require manual approval
Automatic compensation
If a fix fails mid-way, partial changes are cleaned up automatically
Authentication and Access Control
Every Guardian Pro account is protected by mandatory multi-factor authentication with a full audit trail.
- Mandatory multi-factor authentication on every account — cannot be disabled
- Brute-force and credential stuffing protection
- Invitation-only access — no self-registration
- Tenant isolation enforced at every layer
- Full audit trail of authentication events, permission changes, and security actions
- Role-based access control with scoped permissions per user
Questions about security?
If you need more detail about how Guardian Pro handles access, data, or compliance — get in touch.
Contact Us