[{"data":1,"prerenderedAt":307},["ShallowReactive",2],{"docs-navigation":3,"\u002Fdocs\u002Fsaving\u002Fresources\u002Fsecurity":107},[4],{"title":5,"section":6,"to":7,"groups":8},"MilkStraw Saving","\u002Fdocs\u002Fsaving","\u002Fdocs\u002Fsaving\u002Fget-started\u002Fintroduction",[9,26,45,68,92],{"title":10,"links":11},"Get started",[12,14,18,22],{"title":13,"to":7},"Overview",{"title":15,"to":16,"icon":17},"How MilkStraw AI works","\u002Fdocs\u002Fsaving\u002Fget-started\u002Fhow-milkstraw-ai-works","IconLightBulb",{"title":19,"to":20,"icon":21},"Quickstart","\u002Fdocs\u002Fsaving\u002Fget-started\u002Fquickstart","IconPlugin1",{"title":23,"to":24,"icon":25},"Activate and track savings","\u002Fdocs\u002Fsaving\u002Fget-started\u002Factivate-savings","IconLightningBolt",{"title":27,"links":28},"Use MilkStraw AI",[29,33,37,41],{"title":30,"to":31,"icon":32},"Projects and findings","\u002Fdocs\u002Fsaving\u002Fuse-milkstraw-ai\u002Fprojects-and-findings","IconSquareChecklist",{"title":34,"to":35,"icon":36},"Spend","\u002Fdocs\u002Fsaving\u002Fuse-milkstraw-ai\u002Fspend","IconLineChart1",{"title":38,"to":39,"icon":40},"Milkman","\u002Fdocs\u002Fsaving\u002Fuse-milkstraw-ai\u002Fmilkman","IconChatBubbles",{"title":42,"to":43,"icon":44},"MilkStraw CLI","\u002Fdocs\u002Fsaving\u002Fuse-milkstraw-ai\u002Fcli","IconConsole",{"title":46,"links":47},"Upgrade guides",[48,52,56,60,64],{"title":49,"to":50,"icon":51},"Guides overview","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Foverview","IconBook",{"title":53,"to":54,"icon":55},"Amazon EKS","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Fupgrade-eks-instance-types","IconArrowUpCircle",{"title":57,"to":58,"icon":59},"Amazon EC2 Auto Scaling","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Fupgrade-asg-instance-types","IconBuildingBlocks",{"title":61,"to":62,"icon":63},"Amazon EBS gp2 to gp3","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Fupgrade-ebs-gp2-to-gp3","IconServer1",{"title":65,"to":66,"icon":67},"AWS Elastic Beanstalk","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Fupgrade-elastic-beanstalk-instance-types","IconGrowth",{"title":69,"links":70},"Resources",[71,75,79,82,85,89],{"title":72,"to":73,"icon":74},"Supported services","\u002Fdocs\u002Fsaving\u002Fresources\u002Fsupported-services","IconServer",{"title":76,"to":77,"icon":78},"Security","\u002Fdocs\u002Fsaving\u002Fresources\u002Fsecurity","IconShield",{"title":80,"to":81},"Permissions","\u002Fdocs\u002Fsaving\u002Fresources\u002Fpermissions",{"title":83,"to":84},"Roles","\u002Fdocs\u002Fsaving\u002Fresources\u002Froles",{"title":86,"to":87,"icon":88},"Billing","\u002Fdocs\u002Fsaving\u002Fresources\u002Fbilling","IconBanknote2",{"title":90,"to":91},"Cancellation","\u002Fdocs\u002Fsaving\u002Fresources\u002Fcancellation",{"title":93,"links":94},"Get help",[95,99,103],{"title":96,"to":97,"icon":98},"FAQ","\u002Fdocs\u002Fsaving\u002Fget-help\u002Ffaq","IconCircleQuestionmark",{"title":100,"to":101,"icon":102},"Troubleshooting","\u002Fdocs\u002Fsaving\u002Fget-help\u002Ftroubleshooting","IconHammer",{"title":104,"to":105,"icon":106},"Contact & support","\u002Fdocs\u002Fsaving\u002Fget-help\u002Fcontact","IconSupport",{"path":77,"data":108,"meta":111,"nodes":145},{"title":76,"description":109,"navigation":110},"Learn about our security-first approach to optimizing your AWS cloud spend.",{"icon":78},{"toc":112,"key":137,"source":138,"stem":139,"extension":140,"kind":141,"type":142,"partial":143,"hash":144},{"title":113,"searchDepth":114,"depth":114,"links":115},"",2,[116,119,122,125,128,131,134],{"id":117,"depth":114,"text":118},"integration-security","Integration security",{"id":120,"depth":114,"text":121},"transfer-security","Transfer security",{"id":123,"depth":114,"text":124},"least-privilege-policy","Least-privilege policy",{"id":126,"depth":114,"text":127},"milkboxes-isolated-by-design","MilkBoxes isolated by design",{"id":129,"depth":114,"text":130},"milkbox-removal","MilkBox removal",{"id":132,"depth":114,"text":133},"underlying-safeguards","Underlying safeguards",{"id":135,"depth":114,"text":136},"billing-security","Billing security","docs\u002F2.saving\u002F4.resources\u002F2.security.md","docs","2.saving\u002F4.resources\u002F2.security",".md","document","text\u002Fmarkdown",false,"41b1916d828b6b56",[146,150,153,156,185,187,199,219,221,224,247,249,252,272,274,277,279,282,302,304],[147,148,149],"p",{},"MilkStraw AI is designed with security as a core principle, ensuring your workloads and data remain isolated and untouched. Our approach is built on isolation and least privilege.",[151,152,118],"h2",{"id":117},[147,154,155],{},"Our integration with your AWS environment relies on a secure cross-account IAM role that you deploy.",[157,158,159,167,179],"ul",{},[160,161,162,166],"li",{},[163,164,165],"strong",{},"Cross-Account IAM Role",": Resides within your AWS management account. If your organization has member accounts, a CloudFormation StackSet creates the same role in each member account, including accounts you add later. If an account leaves your organization, the role stays in that account until you delete its stack.",[160,168,169,172,173,178],{},[163,170,171],{},"Unique External ID",": The role's trust policy includes a unique external ID known only to ",[174,175,177],"a",{"href":176},"http:\u002F\u002FMilkstraw.ai","Milkstraw.ai",", preventing confused-deputy attacks and verifying the call origin.",[160,180,181,184],{},[163,182,183],{},"Temporary Credentials",": We utilize temporary AWS STS credentials for each API call, avoiding the use of long-lived access keys.",[151,186,121],{"id":120},[147,188,189,190,198],{},"Onboarding and offboarding ",[191,192,197],"abbr",{"$":193,"title":196},{"html":194,"block":195},1,0,"Standard AWS accounts that contain Commitment-based discounts","MilkBoxes"," (accounts with savings) are managed through secure, controlled steps.",[157,200,201,207,213],{},[160,202,203,206],{},[163,204,205],{},"Invite Through Your Role",": After you activate savings, MilkStraw AI sends an AWS Organizations invite to each MilkBox account from your management account, using your cross-account role.",[160,208,209,212],{},[163,210,211],{},"Single-Action Acceptance",": Milkstraw AI accepts the invite from within the milkbox account; no other permissions are exchanged.",[160,214,215,218],{},[163,216,217],{},"Revocable",": You can detach a MilkBox at any time by removing the account from your organization in AWS Organizations. MilkStraw AI detects the change within an hour.",[151,220,124],{"id":123},[147,222,223],{},"MilkStraw AI operates with minimal necessary permissions to perform its function.",[157,225,226,232,241],{},[160,227,228,231],{},[163,229,230],{},"Least-privilege Role",": We use a single least-privilege IAM role.",[160,233,234,237,238,240],{},[163,235,236],{},"No Workload Changes",": The role can’t start, stop, or modify your workloads, such as instances, databases, or networks. It reads cost, usage, and resource metadata. A few write permissions let MilkStraw AI create an AWS Organization for a standalone account, invite MilkBox accounts, and set up S3 Storage Lens. See ",[174,239,80],{"href":81}," for the full list.",[160,242,243,246],{},[163,244,245],{},"Limited Scope",": The scope is limited strictly to the AWS APIs required for cost analysis and MilkBox management.",[151,248,127],{"id":126},[147,250,251],{},"MilkBoxes are engineered to be entirely separate from your existing environment.",[157,253,254,260,266],{},[160,255,256,259],{},[163,257,258],{},"Zero-Access Architecture",": They operate outside your VPCs, IAM roles, and networks.",[160,261,262,265],{},[163,263,264],{},"No Data Paths",": There are no data paths between MilkBoxes and your workloads—only billing linkage.",[160,267,268,271],{},[163,269,270],{},"One-Way Isolation",": You also have no access to MilkBoxes, which prevents potential lateral movement risks.",[151,273,130],{"id":129},[147,275,276],{},"When your on-demand capacity or savings needs change, we remove the MilkBox from your organization. After that, the MilkBox has no billing link to your organization.",[151,278,133],{"id":132},[147,280,281],{},"Our technical operations incorporate standard security best practices.",[157,283,284,290,296],{},[160,285,286,289],{},[163,287,288],{},"Encryption",": All control-plane communication with AWS over the cross-account role uses TLS 1.2 or higher encryption.",[160,291,292,295],{},[163,293,294],{},"Auditability",": Every AWS API call that MilkStraw AI makes through your cross-account role is logged in your AWS CloudTrail.",[160,297,298,301],{},[163,299,300],{},"Best Practices",": Our controls are designed in alignment with AWS Well-Architected principles and CIS benchmarks.",[151,303,136],{"id":135},[147,305,306],{},"We use Stripe as our payment gateway. Stripe stores your full payment details, and we keep only display details, such as the card brand and the last four digits.",1792482912268]