CloudWeaver Security

CloudWeaver implements industry-standard security mechanisms including HTTPS (SSL encryption), OAuth, 3rd party authentication, strong encryption, access control, and firewalling. For example, we strongly encrypt all user credentials provided by you to CloudWeaver and we store theses securely.

Secure System Access

• We enforce standardized SSL encryption for all communication to and from CloudWeaver. You should never log in to CloudWeaver over an unencrypted connection and you should never communicate with the CloudWeaver application or API without using an HTTPS URL.
• CloudWeaver offers secure 3rd party authentication options like Github in order to create an account
• CloudWeaver uses OAuth session and bearer token schemes to authenticate access via the Web GUI, APIs, and Sensors

Secure Storage of Customer Credentials

• CloudWeaver uses industry-standard strong encryption technologies to store customer credentials
  • Please see Customer Credentials Storage
• Customer security credentials cannot be queried / retrieved in any way
  • There are no API endpoints to retrieve customer passwords, AWS credentials, SSH keys, etc.
• Customer credentials are deleted automatically on account cancellation

Secure Platform Deployment

• Distinct tiers of the CloudWeaver SaaS application are firewalled from outside access
  • Firewalls (Security Groups) are configured so that each application component is accessible only by its expected application counterparts
• Access to the production systems that house customer data is restricted to authorized Lyatiss staff only
• The CloudWeaver platform is hosted in Amazon Web Services
  • View the AWS security policy here

Isolation of Customer Data

• Each customer’s data is isolated and accessed independently within CloudWeaver
• API access to customer data is authenticated using industry-standard OAuth Bearer Tokens

Customer Credentials Storage

AWS Credentials

Credentials Used

• CloudWeaver requires your AWS Access Key ID and Secret Access Key in order to monitor your cloud infrastructure
• In addition, you can also provide your Instance SSH Keys in order to SSH into your instances directly from the CloudWeaver UI
  • NOTE: Using CloudWeaver, you can SSH into your instances from any web browser, even on your mobile device!

Credentials Storage

Please see Customer Credentials Storage for information about how we securely store your credentials.

Credential Usage

• CloudWeaver’s uses your AWS credentials in read-only mode
• CloudWeaver will never alter your cloud infrastructure in any way – There are no manual or automatic workflows within CloudWeaver that would allow this
• You may create an IAM User with the standard Read-Only IAM Policy Permissions or with just this basic set of read-only permissions in order to use CloudWeaver

{
   "Statement":[{
      "Action":[
         "ec2:Describe*","iam:List*",
         "iam:Get*", 
         "rds:Describe*",
         "s3:Get*",
         "s3:List*",
         "elasticloadbalancing:Describe*"
      ],
      "Effect":"Allow",
      "Resource":"*"
   }]
}