AWS access you can revoke
Connect an IAM role with an External ID or supported access keys. Grant only the permissions needed for your collection scope. Revoke the role trust or deactivate the keys in AWS to stop future access.
ACCESS & SECURITY
Know what you connect. Stay in control.
CloudYield reads AWS evidence and helps your team review it. Infrastructure changes remain your responsibility.
Credential protection
Stored AWS credentials are encrypted with AES-256-GCM. This protects credential fields; it is not a claim that the entire database or every stored record is encrypted.
Workspace permissions
Data and invitations belong to the workspace. Server-side role checks govern access and changes; switching workspaces clears browser query data.
What collection includes
Depending on permissions and available data: AWS cost and usage, services and regions, supported resource configuration, tags, utilization metrics, forecasts and optimization evidence.
What CloudYield does not inspect
CloudYield does not use SSH or SSM to inspect your instance files, processes or application contents. EC2 memory and application latency are not collected automatically. Business volume and health evidence are supplied by your team.
Before connecting production data
Review the granted AWS policy, who can access the workspace, the deployment hosting location and agreed retention. No certification, contractual service level or guaranteed savings is claimed by this page.
Read about data and privacy →Give the next decision a shared record.
Read-only AWS access. Optional AI. Clear ownership.