How it works
Nothing to install, no agent to run, no per-account registration to maintain — and no permission to read your data, because we never ask for one.
A single CloudFormation template creates a read-only audit role in every member account by service-managed StackSet with auto-deployment, and in the management account directly. The role name is fixed, so every account’s role ARN is derived — nothing is registered per account, and an account created later is covered on placement and scanned on the next run.
We read 4 ungated AWS sources — Security Hub, Service Quotas, Compute Optimizer, and Cost Optimization Hub — and run 117 rules of our own against the control plane. Together that reaches 627 of the 638 Trusted Advisor checks with no support plan involved. Schedules live in Postgres and are reconciled on every worker boot, so a cache flush cannot silently stop your scans.
Findings become recommendations, and recommendations become a ranked list that stays at least ten items deep. Severity, dollars and age all feed the ordering, and an organisation-level profile decides which wins when savings and risk disagree. A daily pass re-ranks as findings arrive and age, so the top of the list is current without anyone maintaining it.
Every item names its remediation. Work it by hand, or let agents you run yourself work it — completion is an API call, so an agent closes its own items and the queue reflects what actually happened rather than who remembered to tick a box.
The audit role
ReadOnlyAccess.
ReadOnlyAccess is the policy most tools ask for, and it grants s3:GetObject and friends — actual customer data. The audit role is SecurityAudit plus ViewOnlyAccess with an explicit Deny on data-plane reads layered over the top. The template that creates it is published, and it is verbatim what the StackSet delivers.
Two stacks, and why they are two
station-org-onboarding.yaml The audit role, in every account. Free.
Everything StationChief needs to read your posture.
station-telemetry-org.yaml AWS Config recording and Security Hub, organisation-wide. AWS bills for these.
Kept separate precisely because it costs money. Unlike everything else we ask for, this one has a bill attached — so it is your decision, made explicitly, not something buried in a setup step.
Without a Config recorder, most Security Hub controls emit nothing rather than failing — so they never reach the denominator, and only around 211 of the 638 checks survive. StationChief refuses to publish a score from an account that cannot support one, and names the resource types it is missing instead.