Built to pass your security review.
One read-only role in your own account, explicit denies on secret and data reads, every session in your own CloudTrail, and your data in the region you choose.
Least privilege you can read.
A read-only IAM role you create in your own account: list/describe/get permissions only, protected by a unique external ID against confused-deputy attacks, and explicitly barred from reading secret values. No agents, no inbound network access, revocable by you at any time.
SecurityAudit-based, read-only
The policy builds on the AWS SecurityAudit managed policy: Describe and List calls plus your tags. Omnitam never writes to your accounts.
ExternalId on every assume
A unique external ID per connection protects the role against confused-deputy attacks. Only Omnitam, presenting your ID, can assume it.
Every session in your CloudTrail
Every discovery session is visible in your own CloudTrail. You can watch what Omnitam calls, and revoke the role at any time.
Explicit denies on secret and data reads
On top of read-only, the role carries an explicit deny, so even a broad managed policy can’t open these reads. The DenySensitiveFieldReads statement in the managed read-role template blocks access to sensitive fields.
Role-based access control
System and custom roles with five permission levels (full, team, own, read, none) across every resource domain.
Scoped API keys
Hashed, prefix-identified keys with least-privilege scopes and rate limits. Automation without shared passwords.
Three policy levels. Your security team reads every line first.
The connect wizard offers three policy levels, delivered as CloudFormation (a magic link or a download) or as Terraform. Connect one account, or many with StackSets across whole OUs.
| Level | What it is |
|---|---|
| Managed recommended | The SecurityAudit-based role with the explicit deny on secret and data reads. |
| Verb-driven | Permissions expressed by read-only API verbs, for teams that prefer not to attach the managed policy. |
| Explicit | Every read-only action listed one by one, for reviews that want each permission spelled out. |
Optional, and only if you turn them on: a change-event stack per region for change events as they happen, and opt-in SBOM permissions to list installed software without an agent.
Controls, with plan availability stated plainly.
Omnitam enforces these per organization. Each control shows the plans that include it, and anything not yet generally available says so.
SAML 2.0 & OIDC single sign-on
Bring Okta, Entra ID, or any standards-compliant IdP. Email-domain routing sends each user to the right connection.
Social sign-in
Users can sign in with a supported social identity provider account.
SCIM 2.0 provisioning
Joiners, movers, and leavers synced from your directory. Deprovisioning that actually deprovisions.
MFA enforcement
Organization-wide TOTP enforcement at the identity layer, not a per-user suggestion.
IP allow-listing
Restrict access to corporate ranges with warn or enforce modes. Roll out without locking yourself out.
SIEM streaming (rolling out)
Audit events forwarded over HTTPS in JSON or CEF. Today: the full audit trail in-app, with export.
Email-domain verification
DNS-verified org domains gate who can join your workspace and how their sign-in routes.
Multi-tenant isolation
Organizations are isolated at the data layer on every plan. Separate tenants for business units are an Enterprise feature, and teams stay granular.
Encryption
Data is encrypted in transit (TLS) and at rest using industry-standard algorithms, with secure key management.
SIEM streaming in JSON or CEF is rolling out on Enterprise. Each role has a level per area (Full, Team, Own, Read or None), every API request is checked against it, and an API key can never do more than its owner’s role allows.
Evidence that holds up.
Every change is recorded in write-protected storage: who, what, when, and the value it replaced. Kept in hash-chained batches, and it can't be changed in normal operation. Audit evidence is kept in write-protected, tamper-evident storage, up to seven years, and can be exported for auditors.
You choose where your data is hosted, at launch.
You choose the region at sign-up. Asset data, evidence and reports are stored and processed in that region, apart from encrypted disaster-recovery backups, which are kept in other regions named in the Terms and DPA.
United States (N. Virginia)
Germany (Frankfurt)
Singapore
Pick your region at signup, on every plan: United States, Germany or Singapore at launch.
Bring your security questionnaire.
Ask us for the security architecture pack, or read how Omnitam connects to AWS.