Skip to main content

Security FAQ

What data does OpsWorker collect from my cluster?​

Resource metadata (pod specs, deployment configs, service selectors), pod logs, Kubernetes events, and endpoint status. By default the agent has read-only access and does not read Secret values; only secret metadata (names, labels) is collected. Secret value access is opt-in and disabled by default. See Agent Scope.

Does the agent have write access to my cluster?​

No. The agent operates in read-only mode. It can only get, list, and watch resources. It cannot create, update, delete, or execute commands in containers. See Safe Execution Model.

How does the agent communicate with OpsWorker?​

Outbound-only via AWS SQS over TLS (HTTPS, port 443). The agent initiates all connections, so no inbound ports need to be opened on your cluster. See Clusters.

Is my data isolated from other customers?​

Yes. OpsWorker uses logical, application-layer isolation. Data for all organizations is stored in shared DynamoDB tables, with every record scoped to its organization so that no cross-organization access is possible. See Data Isolation.

Is data encrypted?​

Yes. Data is encrypted at rest with AES-256 using AWS-managed encryption (DynamoDB and S3) and encrypted in transit with TLS (AWS default). See Isolation & Encryption.

Can I restrict which namespaces the agent can access?​

Yes. Configure namespace-scoped RBAC (Role/RoleBinding instead of ClusterRole/ClusterRoleBinding) to limit the agent to specific namespaces. See RBAC Configuration.

Does OpsWorker store my cloud provider credentials?​

No. The agent authenticates using a cluster token. OpsWorker has no AWS IAM roles, kubeconfig, or cloud credentials for your environment.

What compliance certifications does OpsWorker have?​

OpsWorker has no compliance certifications today. SOC 2 is on the roadmap (not yet certified). For current compliance status and documentation, contact the OpsWorker team.

Can OpsWorker auto-execute commands on my cluster?​

No. OpsWorker generates recommendations with specific kubectl commands, but they are displayed for human review only. Engineers decide what to execute. The agent is physically unable to perform write operations.

Where is my data stored?​

In AWS infrastructure. Data is hosted in the deployment region; contact the OpsWorker team for specific region information and for a Data Processing Agreement (DPA).

PrivateLink is not generally available. It can be offered on request for supported deployments to route agent communication through AWS's private network. Contact the OpsWorker team to discuss requirements.

Who at OpsWorker can access my data?​

Access is limited to essential operations personnel and is audit-logged. Contact the OpsWorker team for details on access controls and audit policies.