Buyer-facing disclosure for the Autonoma AWS Marketplace listings (BUILD, OPERATE, SECURE, PLATFORM), which deploy a data plane into your own AWS account via AWS Marketplace Quick Launch.
This file is generated by scripts/marketplace/generate-resource-disclosure.py from the CloudFormation templates that are actually published. Do not edit it by hand — edit the generator.
Every resource below is created inside your AWS account, in the single AWS Region you launch the stack in, by a CloudFormation stack you own. Autonoma has no credentials in your account and cannot access these resources — see §2 and §6.
Counts are per product listing; you deploy one product.
| AWS service | Resource type | BUILD | OPERATE | SECURE | PLATFORM |
|---|---|---|---|---|---|
| AWS Cloud Map | AWS::ServiceDiscovery::PrivateDnsNamespace |
1 | 1 | 1 | 1 |
| AWS Cloud Map | AWS::ServiceDiscovery::Service |
14 | 15 | 9 | 22 |
| AWS CloudFormation | AWS::CloudFormation::CustomResource |
2 | 2 | 2 | 2 |
| AWS IAM | AWS::IAM::Role |
5 | 5 | 5 | 5 |
| AWS Lambda | AWS::Lambda::Function |
2 | 2 | 2 | 2 |
| AWS Secrets Manager | AWS::SecretsManager::Secret |
19 | 20 | 14 | 27 |
| AWS Secrets Manager | AWS::SecretsManager::SecretTargetAttachment |
1 | 1 | 1 | 1 |
| AWS::S3 | AWS::S3::Bucket |
1 | 1 | 1 | 1 |
| AWS::S3 | AWS::S3::BucketPolicy |
1 | 1 | 1 | 1 |
| AWS::WAFv2 | AWS::WAFv2::WebACL |
1 | 1 | 1 | 1 |
| AWS::WAFv2 | AWS::WAFv2::WebACLAssociation |
1 | 1 | 1 | 1 |
| Amazon CloudWatch | AWS::CloudWatch::Alarm |
2 | 2 | 2 | 2 |
| Amazon CloudWatch Logs | AWS::Logs::LogGroup |
4 | 4 | 4 | 4 |
| Amazon ECS (AWS Fargate) | AWS::ECS::Cluster |
1 | 1 | 1 | 1 |
| Amazon ECS (AWS Fargate) | AWS::ECS::Service |
14 | 15 | 9 | 22 |
| Amazon ECS (AWS Fargate) | AWS::ECS::TaskDefinition |
16 | 17 | 11 | 24 |
| Amazon EFS | AWS::EFS::AccessPoint |
2 | 2 | 2 | 2 |
| Amazon EFS | AWS::EFS::FileSystem |
1 | 1 | 1 | 1 |
| Amazon EFS | AWS::EFS::MountTarget |
2 | 2 | 2 | 2 |
| Amazon ElastiCache for Redis | AWS::ElastiCache::ParameterGroup |
1 | 1 | 1 | 1 |
| Amazon ElastiCache for Redis | AWS::ElastiCache::ReplicationGroup |
1 | 1 | 1 | 1 |
| Amazon ElastiCache for Redis | AWS::ElastiCache::SubnetGroup |
1 | 1 | 1 | 1 |
| Amazon RDS for PostgreSQL | AWS::RDS::DBInstance |
1 | 1 | 1 | 1 |
| Amazon RDS for PostgreSQL | AWS::RDS::DBSubnetGroup |
1 | 1 | 1 | 1 |
| Amazon SNS | AWS::SNS::Subscription |
1 | 1 | 1 | 1 |
| Amazon SNS | AWS::SNS::Topic |
1 | 1 | 1 | 1 |
| Amazon VPC / EC2 networking | AWS::EC2::EIP |
1 | 1 | 1 | 1 |
| Amazon VPC / EC2 networking | AWS::EC2::InternetGateway |
1 | 1 | 1 | 1 |
| Amazon VPC / EC2 networking | AWS::EC2::NatGateway |
1 | 1 | 1 | 1 |
| Amazon VPC / EC2 networking | AWS::EC2::Route |
2 | 2 | 2 | 2 |
| Amazon VPC / EC2 networking | AWS::EC2::RouteTable |
2 | 2 | 2 | 2 |
| Amazon VPC / EC2 networking | AWS::EC2::SecurityGroup |
6 | 6 | 6 | 6 |
| Amazon VPC / EC2 networking | AWS::EC2::SecurityGroupEgress |
1 | 1 | 1 | 1 |
| Amazon VPC / EC2 networking | AWS::EC2::SecurityGroupIngress |
9 | 9 | 9 | 9 |
| Amazon VPC / EC2 networking | AWS::EC2::Subnet |
6 | 6 | 6 | 6 |
| Amazon VPC / EC2 networking | AWS::EC2::SubnetRouteTableAssociation |
6 | 6 | 6 | 6 |
| Amazon VPC / EC2 networking | AWS::EC2::VPC |
1 | 1 | 1 | 1 |
| Amazon VPC / EC2 networking | AWS::EC2::VPCEndpoint |
4 | 4 | 4 | 4 |
| Amazon VPC / EC2 networking | AWS::EC2::VPCGatewayAttachment |
1 | 1 | 1 | 1 |
| Elastic Load Balancing | AWS::ElasticLoadBalancingV2::Listener |
2 | 2 | 2 | 2 |
| Elastic Load Balancing | AWS::ElasticLoadBalancingV2::LoadBalancer |
1 | 1 | 1 | 1 |
| Elastic Load Balancing | AWS::ElasticLoadBalancingV2::TargetGroup |
1 | 1 | 1 | 1 |
| Total | 142 | 146 | 122 | 174 |
The stack creates five IAM roles. All five are assumed only by AWS services (ecs-tasks.amazonaws.com, lambda.amazonaws.com) inside your account. No role trusts an Autonoma AWS account, and no role can be assumed by a principal outside your account. No IAM users and no long-lived access keys are created.
Role names are prefixed with the deployment identifier you choose at launch (CustomerId), so they never collide with your existing roles.
autonoma-(this stack's CustomerId)-dbinit-fnExecution role for the one-shot database-initialisation Lambda, which runs the schema bootstrap as an ECS task. Scoped to running that single task definition in this stack's cluster.
lambda.amazonaws.comAWSLambdaBasicExecutionRole| Effect | Actions | Scoped to |
|---|---|---|
| Allow | ecs:RunTask |
(this stack's DbInitTaskDefinition) (constrained by an IAM condition — see §3) |
| Allow | ecs:DescribeTasks |
* (constrained by an IAM condition — see §3) |
| Allow | iam:PassRole |
(this stack's ExecutionRole) (this stack's TaskRole) |
autonoma-(this stack's CustomerId)-ecs-executionECS task execution role. Used by the Fargate agent (not by our code) to pull container images and to resolve the secrets block of each task definition at container start. Its only inline grant is secretsmanager:GetSecretValue, enumerated to the exact secret ARNs this stack creates.
ecs-tasks.amazonaws.comAmazonECSTaskExecutionRolePolicy| Effect | Actions | Scoped to |
|---|---|---|
| Allow | secretsmanager:GetSecretValue |
(this stack's DbPasswordSecret) (this stack's LlmProxyTokenSecret) (this stack's GatewayJwtSecret) (this stack's MeteringTokenSecret) (this stack's AttestationSecret) (this stack's RigorSigningSecret) (this stack's InterServiceJwtSecret) (this stack's AgentJwtSecret) (this stack's ForwardingSecret) (this stack's NatsSecretSecurityAi) (this stack's NatsSecretThreathunterAi) (this stack's NatsSecretOrchestratorAi) (this stack's NatsSecretApiGateway) (this stack's NatsSecretKnowledgeGraph) |
autonoma-(this stack's CustomerId)-register-fnExecution role for the registration Lambda, which calls the Autonoma control plane once at stack creation and stores the returned forwarding secret. Its only grant is read/write of that one secret.
lambda.amazonaws.comAWSLambdaBasicExecutionRole| Effect | Actions | Scoped to |
|---|---|---|
| Allow | secretsmanager:PutSecretValuesecretsmanager:GetSecretValue |
(this stack's ForwardingSecret) |
autonoma-(this stack's CustomerId)-ecs-taskECS task role — the identity Autonoma's own containers run as. Grants EFS access to the single file system this stack creates, read of the forwarding secret, and OpenTelemetry export to the two log groups this stack creates plus AWS X-Ray.
ecs-tasks.amazonaws.com| Effect | Actions | Scoped to |
|---|---|---|
| Allow | elasticfilesystem:ClientMountelasticfilesystem:ClientWriteelasticfilesystem:ClientRootAccess |
(this stack's EfsFileSystem) |
| Allow | ecs:DescribeServicesecs:UpdateService |
arn:${AWS::Partition}:ecs:${AWS::Region}:${AWS::AccountId}:service/autonoma-(this stack's CustomerId)/* (constrained by an IAM condition — see §3) |
| Allow | secretsmanager:GetSecretValue |
(this stack's ForwardingSecret) |
| Allow | logs:CreateLogStreamlogs:PutLogEventslogs:DescribeLogStreams |
(this stack's OtelMetricsLogGroup) (this stack's OtelMetricsLogGroup): (this stack's OtelLogsLogGroup) (this stack's OtelLogsLogGroup): |
| Allow | xray:PutTraceSegmentsxray:PutTelemetryRecordsxray:GetSamplingRulesxray:GetSamplingTargets |
* |
| Allow | securityhub:BatchImportFindings |
arn:${AWS::Partition}:securityhub:${AWS::Region}:${AWS::AccountId}:product/${AWS::AccountId}/default |
| Allow | ecs:RunTask |
arn:${AWS::Partition}:ecs:${AWS::Region}:${AWS::AccountId}:task-definition/autonoma-(this stack's CustomerId)-test-runner:* (constrained by an IAM condition — see §3) |
| Allow | ecs:DescribeTasksecs:StopTask |
arn:${AWS::Partition}:ecs:${AWS::Region}:${AWS::AccountId}:task/autonoma-(this stack's CustomerId)/* (constrained by an IAM condition — see §3) |
| Allow | iam:PassRole |
(this stack's ExecutionRole) (this stack's TestRunnerTaskRole) (constrained by an IAM condition — see §3) |
autonoma-(this stack's CustomerId)-ecs-task-test-runnerecs-tasks.amazonaws.com| Effect | Actions | Scoped to |
|---|---|---|
| Deny | secretsmanager:*ssm:GetParameterssm:GetParametersssm:GetParametersByPathsts:AssumeRolests:GetFederationTokeniam:*ecr:GetAuthorizationToken |
* |
A Deny row is a restriction, not a permission. Denies on Resource: "*" are deliberately the broadest possible scope — this role runs third-party code and is blocked from reaching credentials or identity APIs anywhere in your account.
The other product listings (BUILD, OPERATE, PLATFORM) create the same five roles. Two things differ, both because each product runs a different set of agents: the number of secrets the execution role reads, and securityhub:BatchImportFindings, which is granted only on SECURE and PLATFORM because only those two deploy the security agent that imports findings. BUILD and OPERATE do not carry that permission.
Resource: "*" grant, and whyAutonoma's deployed roles contain no service:* action wildcards. Four actions are granted at Resource: "*", in each case because AWS does not support resource-level permissions for them:
| Action | Why it cannot be scoped |
|---|---|
xray:PutTraceSegments |
AWS X-Ray does not support resource-level permissions for trace submission. AWS's own AWSXRayDaemonWriteAccess managed policy uses the same Resource: "*". |
xray:PutTelemetryRecords |
Same as xray:PutTraceSegments — no resource-level permission support. |
xray:GetSamplingRules |
Sampling rules are an account-level construct with no ARN to scope to. |
xray:GetSamplingTargets |
Sampling targets are an account-level construct with no ARN to scope to. |
ecs:DescribeTasks |
ecs:DescribeTasks takes a task ARN that does not exist until the task is started. The grant is instead constrained by an ArnEquals condition on ecs:cluster, restricting it to this stack's cluster. |
There are no other unscoped grants. Every other statement names the exact ARNs the stack itself creates.
ELBSecurityPolicy-TLS13-1-2-2021-06); port 80 exists solely to issue a 301 redirect to 443. There is no plaintext path. You supply the certificate (AcmCertificateArn) and the hostname it covers (PublicHostname); the certificate lives in your ACM, in your account and Region, and Autonoma never holds it.AllowedIngressCidr is a required parameter with no default — set it to a single address, your office or VPN range, or 0.0.0.0/0. If you narrow it, the range must still include 107.20.163.23/32, the address Autonoma delivers GitHub webhook events from, or that delivery stops.EnableAccessLogs) and written to an S3 bucket the stack creates in your account, with a 90-day lifecycle rule. The bucket is retained if you delete the stack. AWS WAF is available (EnableWaf) and is off by default, because it adds AWS WAF charges to your bill.GenerateSecretString) and stored in AWS Secrets Manager. They are never transmitted to Autonoma.Outbound — your data plane calls the Autonoma control plane over public TLS:
| When | Call | Purpose |
|---|---|---|
| Once, at stack creation | POST /api/customer/agents/register |
Registers the deployment and receives a forwarding secret. Sends the deployment id, the load balancer DNS name, your AWS account id and region, and the agent version. |
| Per developer session | JWKS fetch | Verifies developer session tokens. Read-only, no payload. |
| Per LLM request | LLM proxy | Routes model calls and meters usage for AWS Marketplace billing. |
Inbound — the Autonoma control plane calls your data plane in exactly one case:
| When | Call | Purpose |
|---|---|---|
| Only if you install the Autonoma GitHub App | POST to the callback URL your stack registered (your load balancer) |
Relays GitHub webhook events to your deployment so agents can act on repository activity. |
That relay is opt-in: it happens only for deployments with an enabled GitHub integration, and only to the callback URL your own stack supplied at registration. Each request carries an X-Autonoma-Signature-256 HMAC-SHA256 header computed with the per-deployment forwarding secret, so your data plane can verify the request genuinely originated from the Autonoma control plane and reject anything else. Autonoma holds no AWS credentials for your account and cannot reach any resource other than that one HTTPS endpoint.
The permissions an administrator needs once to create the stack are published here: https://autonoma-quicklaunch-templates-808773666646.s3.us-east-1.amazonaws.com/docs/autonoma-quicklaunch-buyer-iam-policy.json
That file is the exact policy embedded in this product's Quick Launch deployment template, so it is what your administrator will actually use — not a representative sample. AWS Marketplace also surfaces it in the Quick Launch experience at deploy time.
Those permissions are held by your administrator, are used only for stack creation, and are not granted to Autonoma. It grants no service:* wildcards; the Get*/List* prefixes it does contain are read-only verbs, collapsed to fit the AWS Marketplace 4,000-character field limit.
Deleting the CloudFormation stack removes every resource listed in §1, with one deliberate exception.
The database is snapshotted, not discarded. The RDS instance carries DeletionPolicy: Snapshot, so deleting the stack takes a final snapshot and leaves it in your account rather than destroying your data. That snapshot survives the stack and continues to incur AWS storage charges until you delete it. Remove it yourself once you are satisfied you no longer need the data.
This is also why the deployment permissions in §7 include rds:CreateDBSnapshot: without it the stack cannot complete deletion.
The deployment's registration in the Autonoma control plane can be revoked from the Autonoma dashboard.