PingTraceSSH uses temporary cross-account AWS access to read only the network configuration metadata required for modeling and assurance.
A customer-managed IAM role establishes the boundary. PingTraceSSH assumes that role with a customer-specific External ID, receives temporary STS credentials, and uses those credentials only for the permitted discovery calls.
AWS does not support resource-level permissions for these discovery operations, so the policy uses Resource: "*". The permission boundary remains the explicit list of read-only Describe, Search, and identity-check actions shown here.
There are no create, update, delete, attach, detach, or other mutation actions in the role.
Connect AWS documentationNetwork configuration metadata needed to build topology, compare snapshots, and evaluate Critical Paths.
The scanner does not inspect workloads or application data. Its IAM role cannot retrieve these categories.
HCP Run Task requests are verified against a per-integration HMAC signing key before real runs are accepted.
The signed post-plan payload provides the temporary access needed to retrieve plan data for that analysis.
HCP access tokens and callback details are excluded from customer-facing analysis responses.
Analysis pages expose modeled results, changed resources, and unresolved references—not the raw Terraform plan.
After a terminal analysis callback, the stored HCP access token and callback URL are cleared. See the Terraform assurance workflow.
Real Run Task requests require a valid HMAC-SHA512 signature. Unsigned or invalid real-run requests are rejected before plan processing.
Stripe webhook signatures are verified server-side. Event IDs are claimed before processing so repeat deliveries do not duplicate subscription side effects.
Webhook signing keys, billing secrets, and integration tokens are never exposed in this page or the public product interface.
PingTraceSSH retains historical network snapshots, Terraform analyses, alert history, and the billing metadata required to operate the service. Canceling a subscription pauses new paid processing when access becomes inactive; it does not immediately delete historical data.
Formal retention controls are still evolving.
Removing an AWS connection stops future scans. Connections with history are archived so existing results remain available.
Delete PingTraceSSHReadOnlyRole from the customer AWS account to prevent any future role assumption.
Cancel the subscription through the Stripe-hosted billing portal from the Account page.
Use the company contact form and identify the message as a security report. Include enough detail for the team to reproduce and assess the issue, without sending credentials or secrets.
See how discovery, Critical Paths, Terraform assurance, and HCP gating work together.