Our service is secure and non-intrusive. We require no access to the data within your accounts. You retain independent control of our access. You create the roles we need, and can remove them at any time you wish.
We use an AWS best practice RBAC, IAM and SCP approach to grant access on a non-intrusive, least-privilege basis. Our access is defined in the following templates which create clearly defined roles to serve the following purposes, each for a single, named Strategic Blue account:
Read data about your payer account:
List accounts and their tags, describe cost and usage report definitions and read the S3 bucket that holds those reports (CloudFormation).
Validate data with Cost Explorer:
Used to verify our optimization actions have been correctly applied by AWS, view usage, billing and savings plan information (CloudFormation).
Commitment-holding account access control:
Any reserved instances or savings plans we purchase to access discounts are registered to “Commitment Holding Accounts” used exclusively by us. We may ask your team to create some AWS accounts, under your payer account that will always remain owned by you. We may also ask you to invite additional accounts that will always be owned by us into your organization. For your convenience and transparency, as our customer, your Portal homepage summarizes the commitments in holding accounts you own.
We have admin access to these accounts so that we can buy, exchange and modify Reserved Instances and Savings Plans. If you prefer you can grant a reduced level of access using this (CloudFormation).
Reserved Instance Marketplace
We can optionally grant our commitment-holding accounts the ability to sell unused Reserved Instances on the AWS RI Marketplace as a further method of improving efficiency if your usage changes (CloudFormation).