What PingTraceSSH reads
Network configuration metadata—not packet contents or packet captures.
- VPCs
- Subnets
- Route tables
- Transit Gateways
- VPN state
- Security-group configuration
- Gateway relationships
// security architecture
Read-Only by Design.
PingTraceSSH uses temporary cross-account AWS access to read the network configuration metadata required for modeling and assurance.
- Customer AWS Account
- PingTraceSSHReadOnlyRole
- AWS STS AssumeRole
- Temporary credentials
- PingTraceSSH Scanner
- Network Change + Assurance Engine
- Customer Dashboard
No static customer AWS access keys
Customer-specific External IDs
Minimum read-only network discovery permissions
Temporary STS credentials
Server-side secrets
Customer-scoped connection records
Access configuration and credentials remain server-side. The browser never receives scanner credentials.