How CostGlass accesses your data

Security and data ingestion architecture: how CostGlass reads multi-cloud billing and telemetry through read-only roles and least-privilege permissions.

How CostGlass accesses your data

This is the page to send to whoever has to approve us. It covers exactly what CostGlass can reach in your accounts, how the access is authenticated, where the resulting data is stored, and how you revoke it. The short version: read-only access you create yourself, temporary credentials that expire hourly, and data held in the region you choose.

Blue arrows are connections CostGlass starts, using read-only credentials you create. Green is the one connection your side starts: a small agent in your Kubernetes cluster pushes cost data out over HTTPS, so nothing is opened inbound. Purple dashed is sign-in. Orange dashed is alerts going out. See the detailed diagram.
The one-paragraph summary. Access is a role in your own account that trusts ours, and only when the request carries your External ID. We never hold a long-lived credential — each session is a temporary token that expires after an hour. Everything in transit is encrypted with TLS 1.3; everything at rest is encrypted and partitioned per tenant in the region you selected. Deleting the role ends our access immediately and completely.
Where the boundary sits, end to end
Zero-Write IAM Role

The policy grants cost and billing reads plus Describe and Listactions. There is no Create, Delete, Put or Modify anywhere in it, so CostGlass cannot alter or destroy anything — the one exception being the instance scheduler, which you enable deliberately.

Confused Deputy Defense

The trust policy requires an exact sts:ExternalId match as well as the CostGlass account ID. Without it, anyone who learned your role ARN could ask AWS to assume it through us — the classic confused-deputy problem. With it, a request that does not carry your value is refused by AWS before it reaches your account.

Sovereign Data Residency

Choose 🇬🇧 London (eu-west-2) or 🇩🇪 Frankfurt (eu-central-1) when you sign up. Your data is stored and processed there and does not leave that jurisdiction.

Outbound-Only Push Model

The Kubernetes exporter and SaaS collectors send data outward over HTTPS. Nothing dials in to your network: no inbound firewall rule, no public endpoint, no listening port on your side.

CostGlass authenticates to your AWS environment using short-lived AWS STS session tokens. The role trust policy mandates both the CostGlass Production Account ID and your unique tenant External ID:

AWS IAM Cross-Account Trust Policy (trust-policy.json)
Scoped Read-Only Permission Policy (costglass-readonly-policy.json)