Skip to content

For Security Teams

Continuous compliance, guardrails that bind every principal, and access that ends when the reason does.

Who This Is For

Security, compliance and audit teams responsible for a multi-account cloud estate. Compliance work tends to concentrate in the weeks before an audit, which is exactly when the estate is least representative of how it usually looks. Scanning continuously changes what the audit is: a reading rather than a rebuild.

Ten Standards, Scanned Continuously

RosettaHub provides continuous compliance against ten standards, implemented with Cloud Custodian, the open-source rules engine. Policies are written in Cloud Custodian's YAML format, so you can read, clone and extend them.
SOC 2 ISO 27001 PCI DSS v4
HIPAA GDPR FedRAMP
NIST SP 800-53 NIST SP 800-171 NIST CSF
CIS Benchmarks

Coverage

Coverage is not yet complete for every standard. Each release adds policies, so check the controls a standard covers before relying on it for an audit.

Each policy records the standards it maps to. A standard is a portfolio of policies, run against selected accounts and regions. Assigning a compliance role to users runs the associated policies on their accounts automatically. See Compliance.

Three Places to Act

When What happens Edition
Before Restrict the regions, services, instance types and models a team can reach. A resource in a region you do not operate in is never created, so it is never a finding Govern
Continuously Scanning runs against the estate as it is, not as it was at the last review Observe
After Remediation actions (notify, tag, stop, modify) act on what is found. Run them in dry-run mode first Automate

Controls That Apply Outside the Portal

A control that only applies inside a vendor portal is a suggestion. RosettaHub translates roles and limits into the cloud's own policy layer. On AWS that is service control policies, which bind every principal in a member account, including its root user, whether or not they ever sign in to RosettaHub.

Budgets work the same way. When an account reaches its budget, new activity is blocked at the cloud's API, whoever attempted it.

The management account

AWS does not apply service control policies to the management account. RosettaHub therefore gives the management account and the FinOps, audit and log-archive accounts a read-only federation role with a read-only permissions boundary. See Account Access and Scopes.

Access That Ends When the Reason Does

  • Sessions rather than keys. Users get single sign-on and direct federated access to the AWS console and CLI through IAM roles, on temporary credentials. There is no permanent key to rotate or leak.
  • Auditors and contractors need no account. Share a role and they get a session for as long as the work runs. See Native Resource Sharing.
  • Joiners and leavers follow membership. Access granted to a group follows the group, so leaving the group removes it without editing a policy.

What RosettaHub Can Reach

RosettaHub governs accounts and their configuration, not the data inside your systems.

Question Answer
Where does the platform run? RosettaHub is a multi-tenant SaaS platform run by RosettaHub, governing accounts in any Region. A dedicated platform is available
Where is cost data? In your own FinOps account, in FOCUS format, queried through Athena in your account
What is installed? No agent on a host and no proxy in your network. Access is an IAM role created by a CloudFormation template you deploy
Administrator credentials? Never held. The outer role assumption is protected by an external ID unique to your organization
What does it grant? Observe and Govern give RosettaHub no administrative path. Federation, RosettaCloud and Destroy do, and each is granted per account
How is it withdrawn? Remove the stack

Production accounts can be left without the blocking and stopping scopes. They are then monitored and alerted on, but never stopped.

Getting Started

  1. Read Account Access and Scopes and RosettaOps Editions.
  2. Follow Onboarding, starting with Observe.
  3. Run one standard in dry-run mode against a test account.