Security and Access: How I Work Inside Your AWS Account

Access you create, own and can remove

You create my access in your account: a user in your IAM Identity Center, or an IAM role I assume. You own it and can disable it at any time without asking me.
Least privilege. I start read-only. Anything more is scoped to a named, agreed task.
MFA on every sign-in. Sessions expire on their own after 4 hours at most.
Time-bound: access has an end date that matches the engagement.
Kubernetes access through EKS access entries or your existing mapping, read-only by default.
Everything I do is recorded in your CloudTrail under my own named identity. No shared or root accounts.

I don't copy customer data, database contents, logs with personal data or secrets out of your accounts.
Your data is yours. Analysis happens inside your account and tools. Billing data you choose to send me is used only for your work and deleted when the engagement ends.

No IAM users with static access keys, for me or created by me.
No credentials in email, chat, tickets or notes. Secrets stay in your secret store.
Each client's credentials, keys and cloud configuration are kept separate on my machine, so access to one client can never be used in another client's account.

Changes are infrastructure as code, in your repositories, as pull requests your team reviews and merges.
My commits are signed with a key used only for your work.
I never change anything in your environment on my own. Every change is discussed with you first and made only with your formal written authorization and consent.

Full-disk encryption on the laptop I work from.
1Password for every credential.
YubiKey hardware security keys plus MFA on every account I use for your work: email, Git hosting, cloud.
A separate browser profile per client.

Today I do the work myself.
If another engineer joins your project, I name them to you first. They sign the same confidentiality and security terms, get their own access that you approve, and never share mine.

I'll sign your NDA before you share anything, or send a mutual NDA.
A data processing agreement (DPA) is available on request, or I can sign yours.
Your name, data and architecture stay confidential. I don't name clients or publish their results without written approval.

If I suspect anything that could affect your systems or data, such as a lost device or a credential that may be exposed, I tell you as soon as I know, always within 24 hours, and help you rotate access.