Where it lives
What it puts in your account, and what each piece can do.
This page is generated from the release's where-it-lives.json (source commit
b44081aa7642). The console's Install › Where it lives and
warden footprint --plain draw the same data.
The picture
YOUR HUB ACCOUNT, HOME REGION
wardensec-base
wardensec-gate
wardensec-hub
wardensec-edge
wardensec-address only when your domain lives elsewhere
wardensec-cluster
wardensec-defend only while Defend is on
wardensec-defend-cluster only while Defend is on
wardensec-flowlogs only when you install it
wardensec-selftest only when you install it
wardensec-org only when you install it
YOUR HUB ACCOUNT, US-EAST-1
wardensec-hub-global
YOUR EKS CLUSTER, NAMESPACE WARDENSEC
wardensec CronJob
wardensec-console Deployment
EVERY OTHER WATCHED ACCOUNT, EACH ENABLED REGION
wardensec-member
wardensec-spoke only when you install it
wardensec-member-defend only while Defend is onThe straight answer on permissions
- To watch
- AWS's own read-only policies SecurityAudit and ViewOnlyAccess, a short list of extra reads, and explicit denies on secret values, object contents and other data. The watcher writes only its own records. It never writes to your resources.
- The AI agents
- Run inside the scanner and call Amazon Bedrock through a role that can invoke only the models you chose. They read evidence Warden already collected, never your cloud directly. They cannot act, change a setting or hide a finding. The console's Check function makes at most ten one-token test calls a day to show which models you can use.
- To defend (optional)
- A separate role exists only while Defend is on. It can do one item of a closed list of reversible actions, to one target, for a short time, and only after a person signs that exact action with a passkey. Each action undoes itself when its time box ends unless a person renews it.
- Who else can change Warden
- In a single account, your administrators and anyone allowed to update Warden's stacks or functions (AWS's PowerUserAccess allows both). Warden lists them by name below and pages on every such change; an organisation guard closes it when the hub is a member account (v1.1).
- Sent to the vendor
- Nothing. No telemetry, no licence server, no update check. Alerts go only to the addresses and webhooks you configure.
The release carries no names for who else can change Warden. Each install reads them from its own account's IAM, and its console lists them under Install › Where it lives.
Your hub account, home region
| Stack | What it is for | Runs as | Uninstall |
|---|---|---|---|
wardensec-base | The release store (bucket, image and chart repositories) and the installer and deploy roles. First in, last out. | Wardensec-Installer , Wardensec-Deploy | You delete it, last. |
wardensec-gate | The install gate: the only thing that changes Warden, and only as keepers signed. It also owns the image cache. | Wardensec-Gate , Wardensec-Gate-Kube , Wardensec-Gate-Retire , Wardensec-Gate-Retire-Kube , Wardensec-Gate-Scheduler | Deleted by the uninstall, last of all but the base. |
wardensec-hub | The read-only watcher's identity and records: read roles, the validation probe, the state and authority buckets, alarms, private AWS endpoints, the notary and checks functions, the console's role and secrets. | Wardensec-Hub-ReadOnly , Wardensec-Validate , Wardensec-Spoke-ReadOnly , Wardensec-Agent-Invoke , Wardensec-Trail-Forward , wardensec-secrets-reader , Wardensec-Console , Wardensec-Authority-Notary , Wardensec-Checks | Removed; the state bucket and its key stay until their retention ends. |
wardensec-edge | The console's front door: a load balancer that signs every request in with Amazon Cognito, its certificate, web firewall, alarms and the signing page. | wardensec-signer | Removed. |
wardensec-address only when your domain lives elsewhere | A DNS zone for the console's names, only when your domain lives elsewhere. | none of its own | Removed. |
wardensec-cluster | Warden's own node group, the Pod Identity agent, the cluster's OIDC provider and a one-time cluster check. | wardensec-cluster , wardensec-node | Removed, except the OIDC provider, which others may rely on. |
wardensec-defend only while Defend is on | Only while Defend is on: an isolated network and the one function that carries out a signed act. | Wardensec-Defend-Verifier | Removed, only after every Defend action is undone. |
wardensec-defend-cluster only while Defend is on | Only while Defend is on: the cluster half of Defend's guard. | none of its own | Removed with Defend. |
wardensec-flowlogs only when you install it | Optional: flow-log queries the hub read role runs, capped by your budget. | none of its own | Removed. |
wardensec-selftest only when you install it | Optional: self-test targets that prove the watch sees what it should. | wardensec-selftest-role , wardensec-selftest-lambda-role | Removed. |
wardensec-org only when you install it | With an organisation only: the guard and the StackSet that puts the member roles in each account. | none of its own | Removed. |
Your hub account, us-east-1
| Stack | What it is for | Runs as | Uninstall |
|---|---|---|---|
wardensec-hub-global | Alarms on changes to Warden's own IAM roles and DNS. | none of its own | Removed. |
Your EKS cluster, namespace wardensec
| Workload | What it is for | Runs as |
|---|---|---|
CronJob wardensec | The scanner, every 15 minutes: the tick, the full sweep on your schedule, the rules and the agents. |
ServiceAccount wardensec |
Deployment wardensec-console | The console, reachable only through the front door. No write to AWS or Kubernetes. |
ServiceAccount wardensec-console |
Every other watched account, each enabled region
| Stack | What it is for | Runs as | Uninstall |
|---|---|---|---|
wardensec-member | One read-only role and one event forwarder in each watched account. | Wardensec-Spoke-ReadOnly , Wardensec-Trail-Forward | Removed; outside an organisation, a keeper task with its link. |
wardensec-spoke only when you install it | The read-only role in an account watched before the member template. | Wardensec-Spoke-ReadOnly | Removed. |
wardensec-member-defend only while Defend is on | Only in the accounts Defend covers: the hands Defend acts through. | Wardensec-Defend-Act , Wardensec-Defend-K8s , Wardensec-Defend-FenceWriter , Wardensec-Defend-Pager | Removed after every Defend action has ended. |
Identities, one line each
| Identity | Who uses it | Read | Write | Never |
|---|---|---|---|---|
Wardensec-Hub-ReadOnly | The scanner and the console's reads, in the hub account | AWS configuration and activity: AWS's SecurityAudit and ViewOnlyAccess, and a short list of extra reads | Its own state, ledger and spool objects, written once; the notice topic | Secret values, object contents or other data; any change to your resources; Bedrock directly |
Wardensec-Validate | The scanner's validation probe | The account summary only | Nothing | Anything else |
Wardensec-Spoke-ReadOnly | The scanner, in each watched account | As the hub read role | Nothing | Any change in the account; secret values or data |
Wardensec-Agent-Invoke | The agents, inside the scanner | Nothing of yours | Calls to the Bedrock models you allowed | Anything else |
Wardensec-Trail-Forward | EventBridge, in each watched account | Nothing | Write events onto the hub's event bus | Anything else |
Wardensec-Console | The console pods | Warden's records and the authority ledger | Its drafts and run requests; it asks the notary and the checks function | Any AWS or Kubernetes write |
Wardensec-Authority-Notary | The notary function | Signed records | The authority ledger, after checking every signature | Anything else |
Wardensec-Checks | The console's Check buttons | A fixed list of read-only checks and Bedrock's model lists | Its claim objects; at most ten one-token model probes a day | Anything else |
wardensec-secrets-reader | The External Secrets store in the cluster | Warden's own two secrets | Nothing | Any other secret |
wardensec-signer | The signing page | The verifier's heartbeat object | Its own log | Everything else, by an explicit deny |
Wardensec-Gate | The install gate's head | The release store, the authority ledger and the facts it checks | Change sets on wardensec-* stacks under the deploy role; its own plans and journal; door sign-ins | Anything the signatures do not cover |
Wardensec-Gate-Kube | The install gate's hands, in the cluster's network | The plans the gate wrote and the release they name | A server-side apply of a gate-written plan in Warden's namespace | Any object the plan does not hold; anything another delivery owns |
Wardensec-Gate-Retire , Wardensec-Gate-Retire-Kube | The uninstall | The signed decommission and the inventory | Delete Warden's own stacks and objects, only under an effective, unexpired signed decommission | The base stack or the gate itself; anything not Warden's |
Wardensec-Gate-Scheduler | The gate's hourly sweep schedule | Nothing | Invoke the gate's head | Anything else |
Wardensec-Deploy | CloudFormation, passed only by the gate | Nothing of its own | Warden's own resources, inside its boundary | Anything outside its boundary; a Warden role without a boundary |
Wardensec-Installer | Named principals with MFA, for the expert recovery commands | Its boundary's reads | Release store objects; invoke the gate | Change a stack directly |
Wardensec-Defend-Verifier only while Defend is on | Defend's verifier, only while Defend is on | The signed records and the evidence each act cites | Its own Defend records; one act's credentials into the act role | Anything unsigned |
Wardensec-Defend-Act , Wardensec-Defend-K8s only while Defend is on | The act, in each account Defend covers | What each act checks first | One signed, reversible act on one target, time-boxed | Anything unsigned; anything destructive |
Wardensec-Defend-FenceWriter , Wardensec-Defend-Pager only while Defend is on | Defend's fence and its pager | What each checks | The fence's own records; the page | Anything else |
wardensec-node , wardensec-cluster | Warden's node group; the one-time cluster check | The cluster's settings (the check) | What an EKS node needs: its network interfaces and pulling images | Anything else |
wardensec-selftest-role , wardensec-selftest-lambda-role | The self-test targets, only when you install them | Nothing of yours | The self-test's own resources | Anything else |
Your analyst role , Your secrets role yours, named at install | Your people, when you name an analyst role or a secrets role at install | Analyst: Warden's records. Secrets role: the two secrets, with MFA | Secrets role: hands the notary a record | Anything else |
k8s:wardensec Kubernetes | The scanner's pods | Kubernetes objects through the reader role, never secrets or exec | Through the hub read role only | Any Kubernetes write |
k8s:wardensec-console Kubernetes | The console's pods | Warden's own jobs and schedule | Through the console's role only | Any Kubernetes write |
k8s:wardensec-egress Kubernetes | The egress pod (v1.1), the only pod with an internet route | Nothing | Nothing | Any Kubernetes or AWS call |
k8s:wardensec-secrets-reader Kubernetes | The External Secrets store | Warden's two secrets, through its IAM role | Nothing | Any other secret |
k8s:default Kubernetes | Nothing: the namespace's default account, with no token mounted | Nothing | Nothing | Everything |
About a month
About $174 a month with private endpoints in one zone, or $298 in two, before traffic and before the model calls. These are setup's figures for one account, with Warden's own node group, with control-plane audit logs turned on, with the agents on, with no interface endpoints already in your VPC.
Prices: AWS list prices, us-east-1, read 2026-10-09; other regions differ, and your bill is the measure.
| Item | One zone | Two zones | Note |
|---|---|---|---|
| Hub interface endpoints (16) | $116.80 | $233.60 | per zone, plus $0.01 per GB through them |
| Edge load balancer | $16.43 | $16.43 | spans two zones either way, plus capacity units for its traffic |
| KMS keys and secrets | $3.20 | $3.20 | 2 keys, 3 secrets, plus requests |
| Dedicated node (one t3.medium) | $30.37 | $30.37 | A05's default; on demand, plus its volume |
| Model endpoint (bedrock-runtime) | $7.30 | $14.60 | per zone while the agents are on, plus $0.01 per GB; the model calls are priced on the agent card |
| Witness | no figure | no figure | not installed by this release |
| Defend enclave | no figure | no figure | not installed by this release; priced on the A17 card |
| Audit log ingestion | no figure | no figure | $0.50 per GB ingested; the volume is your cluster's |
Source: tools/release/where-it-lives.ts at commit b44081aa76422ea7485feb142452cd7d2f369a7f, file sha256
1e97ab201f35c0374c1845f4ee8d39086e76236e661d1aebf2e3553d0b0e3252. In an install, the console's Footprint page shows the account's
own figure.