Secure by design, read-only by default
You're trusting us with a view into your cloud. Here's exactly how My Desk DevOps protects it.
Read-only access
Monitoring uses a read-only IAM role (or Reader on Azure, Viewer on GCP). We can see — we can't change. Actions like stopping instances need a separate, revocable write credential with spend caps.
Encrypted credentials
Every stored secret is encrypted at rest. Keys are never shown again after you save them.
Tenant isolation
Every query is scoped to your organization, enforced on the server — not just hidden in the UI.
Token-safe sessions
Session tokens live in httpOnly cookies — scripts in the browser can't read them.
Role-based access
Owner, admin, editor and viewer roles, plus per-resource-group access.
SSO and SCIM
Enterprise sign-in with your identity provider and automatic user provisioning and removal.
AI data handling
AI runs in our secure cloud infrastructure. Your data is sent only to answer your request and isn't used to train models.
What we can and can't do in your cloud
| Action | Monitoring role | Write credential (optional) |
|---|---|---|
| Read cost, metrics, logs, configuration | ✓ | ✓ |
| Stop or tag instances (workflows) | — | ✓ with dry run |
| Create resources (provisioning) | — | ✓ with approval and spend cap |
| Delete data or accounts | — | — |
The exact AWS permissions we ask for
This is the complete read-only IAM policy for the monitoring role. Every action is a Get, List or Describe — nothing can create, change or delete anything in your account.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "MyDeskStudioIdentity",
"Effect": "Allow",
"Action": [
"sts:GetCallerIdentity"
],
"Resource": "*"
},
{
"Sid": "MyDeskStudioCompute",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeVolumes",
"ec2:DescribeRegions",
"ec2:DescribeSecurityGroups"
],
"Resource": "*"
},
{
"Sid": "MyDeskStudioMetrics",
"Effect": "Allow",
"Action": [
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics",
"cloudwatch:DescribeAlarms"
],
"Resource": "*"
},
{
"Sid": "MyDeskStudioCost",
"Effect": "Allow",
"Action": [
"ce:GetCostAndUsage",
"ce:GetCostForecast"
],
"Resource": "*"
},
{
"Sid": "MyDeskStudioLogs",
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups",
"logs:FilterLogEvents"
],
"Resource": "*"
},
{
"Sid": "MyDeskStudioTracing",
"Effect": "Allow",
"Action": [
"xray:GetServiceGraph",
"xray:GetTraceSummaries",
"xray:BatchGetTraces"
],
"Resource": "*"
},
{
"Sid": "MyDeskStudioDatabases",
"Effect": "Allow",
"Action": [
"rds:DescribeDBInstances"
],
"Resource": "*"
},
{
"Sid": "MyDeskStudioStorage",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:GetBucketPublicAccessBlock"
],
"Resource": "*"
},
{
"Sid": "MyDeskStudioSecurityPosture",
"Effect": "Allow",
"Action": [
"iam:ListUsers",
"iam:GetLoginProfile",
"iam:ListMFADevices",
"iam:ListAccessKeys",
"iam:GetAccountSummary"
],
"Resource": "*"
},
{
"Sid": "MyDeskStudioLightsail",
"Effect": "Allow",
"Action": [
"lightsail:GetInstances",
"lightsail:GetInstanceMetricData"
],
"Resource": "*"
}
]
}A note on AWS Cost Explorer charges
AWS charges $0.01 per Cost Explorer API request, and because we read cost data through the role in your account, those requests appear on your AWS bill. Cost data refreshes every 6 hours with a single request, the forecast is fetched once a day, and last month's total once — about 150 requests, or roughly $1.50, per connected account per month.
Report a vulnerability
Found a security issue? Email us and we'll respond quickly. Please don't test against other customers' data.