Security

Safe to let into your organization

Dormeto runs in your AWS accounts. It stays out of the request path once a workload is awake. It acts only through roles you create and can read line by line.

In your account

The manager, its data and the routers run in your AWS accounts. Nothing is sent to Dormeto: no telemetry, no call home. The release is downloaded once, at terraform init, from releases.dormeto.com, with the SHA-256 checksum of every file.

Out of the request path

Awake, your load balancer forwards every request to your application and the waker is not invoked. Waking never depends on the manager: a router wakes its workloads even if the manager is down.

Never CloudFormation

Dormeto creates no stack and no StackSet, and has no quick-create link. You install the manager with Terraform. You create the roles in your accounts with a Terraform module or an AWS CLI script. A StackSet of yours also works, if that is how your organization deploys roles. The manager installs its routers by API calls you can audit in CloudTrail.

Health alerts

Every 5 minutes the manager checks what each router reports. A router that stops reporting, or reports a problem, is an alert to your email or any channel of its SNS topic. CloudWatch watches the watchdog itself.

Roles you create, checked at every run

Dormeto never creates its own access to your accounts. The manager supposes its roles are there and checks both in every account at each discovery run. It disables only what a missing role prevents, saying why and linking to the procedure.

Role	What it may do
`DmtDiscoveryRole`	Read only: load balancers, listeners, rules, target groups and their health, Auto Scaling groups, ECS services, EKS clusters, the instances behind a target group. Also request metrics, CloudTrail trail settings, its own role's tags.
`DmtCommandRole`	Installs, upgrades and removes routers in their own namespace only. That is `dmtr-*` functions, tables, queues and rules, and roles under `/dormeto/router/` that must carry the `DmtRouterBoundary` permissions boundary. It cannot touch anything else, nor widen what the routers may do.
The delegation policy	In the management account: lets the manager's discovery role list the accounts, organizational units and account tags. Read only.
The forwarder	Optional (event-driven refresh): one role and one rule per region, installed by the manager through the command role. They send only load balancer changes to the manager.

The roles trust only the manager's two roles, by name in the manager's account, and optionally only from within your organization.
The manager never assumes another role, an administrator role included, unless you name it in its Terraform.
An account can be set up for discovery only: the manager reads it, and refuses to onboard there.

The roles, the policy and the check in detail →

People

Sign-in

Amazon Cognito in your account, with an authenticator app as a second factor. It is required for administrators and operators by default: they keep viewer rights until they set it up. It can be optional or required for everyone, at your choice. Administrators invite colleagues and reset a lost authenticator. Keep two administrators who have one: the last administrator's is reset with the AWS CLI. There is no self sign-up.

Three roles

Viewers read. Operators nap, wake, onboard and run discovery. Administrators also install routers, set the perimeter and manage users.

Audit and protection

Every change is recorded with its author and result. Deletion protection keeps the users and the manager's table from a mistaken destroy.