Read every permission before you sign.
NxSCORE asks to read configuration, and nothing else. Everything it can do is written in files you deploy, keep in your own change control, and can delete at any time.
What NxSCORE can and cannot do.
- Read the configuration of your resources, identities and policies
- List the accounts in your organisation and their tags
- Read findings from the CNAPP you connect
- Read operating-system benchmark results, only if you switch it on
- Create, change or delete anything in your cloud
- Read your data: storage objects, secrets, parameters, table items, logs, function code or container images
- Decrypt anything with your keys
- Hold access keys, client secrets or service-account keys
- Log in to your instances or start scans on them
Access, cloud by cloud.
The excerpts are from the files you deploy. Read them in full before you connect anything, and change them if your policies ask for it.
ManagedPolicyArns:
- arn:aws:iam::aws:policy/SecurityAudit
- arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
Policies:
- Sid: DenyDataPlaneReads
Effect: Deny
Action:
- s3:GetObject
- s3:GetObjectVersion
- secretsmanager:GetSecretValue
# ...parameters, table items, logs, function code
AssumeRole:
Condition:
StringEquals: { sts:ExternalId: <issued to you> }- Identity
- A read-only role, assumed only by NxSCORE’s scanner role with your external ID
- Keys
- None. Sessions last at most one hour
- Scope
- Every account in the organisation units you choose, new accounts included
- To revoke
- Delete the stack
No access keys. Delete the stack and access ends.
No secrets to hand over.
In Azure and Google Cloud, NxSCORE signs in with a short-lived token instead of a stored secret. Your cloud accepts it only when all three checks pass.
- 1
Issuer
The token comes from NxSCORE’s own account, and nowhere else.
- 2
Subject
It was issued to NxSCORE’s scanner role, and no other identity.
- 3
Audience
It names your workspace, so one customer can never have another’s cloud scanned.
Choose how far NxSCORE reaches.
Keep every role inside your own accounts if you prefer, and know exactly which checks NxSCORE leaves out on purpose.
Run the scanner in your own account.
Prefer that nothing outside your cloud holds a role into it? Run the NxSCORE scanner in your own account. Your NxSCORE analyst still works from the results.
- Runs once a day, at the hour you choose
- Outbound HTTPS only; no inbound rules
- Uploads findings, and nothing else
- NxSCORE holds no role into your accounts
Less access, even when a check needs it.
Some scanner checks would need permissions that could reveal secrets, such as listing web app keys in Azure. NxSCORE does not ask for them. Those checks report Not evaluated, and an account NxSCORE cannot reach reads Not scanned, never Pass.
- Listing Azure web app keys, which would reveal secrets
- Reading objects, secrets or parameters, even where a check could use them
- Starting scans on your instances or changing scan settings
- Any write permission, in any cloud
Read-only in your cloud. Your people decide.
Decisions stay with your people.
Software finds and drafts. People decide, and every decision has two keys.
Maker-checker on every verdict
Anything that changes a verdict is prepared by one person and approved by another, and the person who returned an item cannot approve it.
Only your team accepts a risk
Your analyst can propose an exception. Only your security team can approve it, with an owner and an expiry.
Every change is run by your engineers
Fixes and guardrails reach your cloud through your own pipeline and change window. NxSCORE never runs them.
The record is kept
Who proposed, who approved, who ran it and when, filed with the finding as evidence.
Your data, on your terms.
Where it lives
Findings, evidence and account data stay in the region you choose, India included.
How long it is kept
You set how long findings and evidence are kept.
Taking it with you
Export your findings and evidence at any time, including when you leave.
Start with one account.
Connect one account with the read-only role above. Your NxSCORE analyst shows you what is open, what keeps coming back, and the guardrail that would stop it.