What Proofline reads from AWS
- Compute: ECS services, tasks and task definitions; EC2 instance types and placement; AWS Batch jobs.
- Data: RDS clusters and instances, from the control plane only; S3 bucket versioning, public access and encryption settings.
- Delivery: ECR image digests; CodeDeploy deployments and rollbacks; Step Functions executions.
- Traffic: load balancer listeners, rules and target health; Route 53 routing and health checks; VPC Reachability Analyzer results.
- Identity: IAM role identity and Cognito user pool configuration.
Each connector reads a defined set of resources. Check the scope of each integration.
When the health check path changes
An illustrative pull request renames an API's health endpoint from /health to /healthz. The code and its tests are correct.
The production target group still checks /health. New ECS tasks fail that check, so the load balancer never routes traffic to them.
The diff has the new path, and the load balancer configuration has the old one. A finding cites both and suggests updating the health check path along with the code.
Read-only access with temporary credentials
Setup supplies an IAM role template with read permissions, a trusted principal, and a connection-specific external ID. Review its trust and permission policies before you create the role.
Proofline assumes the role for short-lived credentials when it needs them. It stores no long-lived AWS keys, and its AWS integrations change nothing in your account.
A missing permission or an unreachable resource makes the review incomplete, and the review names that source. The GitHub and AWS guide covers setup.
Questions
What permissions does Proofline need in AWS?
Proofline needs read permissions in an IAM role you create from the setup template. The role trusts a designated principal and requires a connection-specific external ID.
Which AWS services does Proofline read?
Proofline reads ECS, RDS, ECR, Elastic Load Balancing, EC2, S3, IAM, VPC Reachability Analyzer, CodeDeploy, Cognito, AWS Batch, Step Functions, and Route 53, each within a defined scope.
Does Proofline read data from my RDS databases?
No. Proofline reads RDS configuration from the AWS control plane. It does not connect to the database or read its rows.