The portal does not collect credentials#
This is a static documentation site. Planner selections and access-request fields stay in the current browser page. Only optional checklist completion flags and display preferences are stored locally. There are no credential fields, analytics SDKs, contact-form submissions, or backend installers here.
Generated access requests contain only the non-secret fields you choose to include. Review the file before sharing it. An email address identifies an engineer; it is not a secret transport or proof of approval.
Three distinct trust boundaries#
| Boundary | Identity | Approval and revocation |
|---|---|---|
| AWS assessment connector | Dedicated role with approved Modal OIDC trust | Customer controls role, trust conditions, and policies. Delete the stack or revoke the dedicated role/trust. |
| Azure assessment connector | Dedicated, single-tenant Entra application | Customer controls scoped Azure roles, tenant-wide API consent, and app credential. Remove app and residual assignments. |
| Optional engineer access | Individually approved human identity | Customer controls IdP/Identity Center invitation, MFA, account assignments, session limits, and offboarding. |
The source onboarding documents describe the Managed Compliance connector. Moving this website to Cloudflare does not migrate a connector runtime, replace an OIDC issuer, or change the organization that can assume a role.
Read-only does not mean low sensitivity#
Inventory can expose network layout and identities. Logs may contain personal data. Broad AWS ReadOnlyAccess may expose service data. Azure App Configuration Data Reader can read configuration values. Key Vault Reader is for metadata, not secret values. Approve the evidence required for the use case and document exclusions.
AWS offboarding#
For the stack-based path, delete only the verified customer stack. The documented template removes its dedicated role and registration resources and sends a disconnect callback. The shared OIDC provider is intentionally retained: do not remove it until you have checked other dependencies. For a manual setup, revoke/remove the dedicated role and its policies, then confirm disconnected status and that a new collection cannot authenticate.
Handle active AWS sessions according to your security policy; changing a role or deleting a password does not imply every previously issued credential is immediately unusable.
Azure rotation and offboarding#
The current installer creates a one-year client secret. Record expiry and an owner. Rotate via the approved connection workflow before expiry; verify a new successful collection before retiring the old credential. Do not rerun or improvise secret-reset commands without checking the effect on the existing integration.
To offboard, remove the dedicated app registration/service principal, remove any residual Azure RBAC assignments, and verify the integration is disconnected and subsequent authentication fails. Request a reviewed tenant-scoped uninstall command if using the installer’s uninstall path.
Keep secrets out of support channels#
Never email or paste a client secret, ConnectToken, session token, password, or AWS access key. The Azure credentials JSON is secret-bearing even if its filename looks like a normal report. The installation manifest is non-secret, but still inspect it before sharing. Use only the secure handoff channel supplied for your organization.