1"use strict";(globalThis.webpackChunkopsworker_docs=globalThis.webpackChunkopsworker_docs||[]).push([[996],{4434(e,t,n){n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>d,default:()=>h,frontMatter:()=>c,metadata:()=>r,toc:()=>o});const r=JSON.parse('{"id":"architecture/security-compliance","title":"Security & Compliance","description":"OpsWorker security architecture: least privilege, defense in depth, human oversight, and the controls that protect your cluster data.","source":"@site/docs/architecture/security-compliance.md","sourceDirName":"architecture","slug":"/architecture/security-compliance","permalink":"/docs/architecture/security-compliance","draft":false,"unlisted":false,"tags":[],"version":"current","frontMatter":{"description":"OpsWorker security architecture: least privilege, defense in depth, human oversight, and the controls that protect your cluster data."},"sidebar":"docs","previous":{"title":"Private Cloud Deployment","permalink":"/docs/architecture/deployment/private-cloud"},"next":{"title":"OpsWorker Kubernetes Agent","permalink":"/docs/agent/overview"}}');var s=n(4848),i=n(8453);const c={description:"OpsWorker security architecture: least privilege, defense in depth, human oversight, and the controls that protect your cluster data."},d="Security & Compliance",l={},o=[{value:"Overview",id:"overview",level:2},{value:"Security Architecture",id:"security-architecture",level:2},{value:"Agent Security",id:"agent-security",level:3},{value:"Cloud Security",id:"cloud-security",level:3},{value:"Application Security",id:"application-security",level:3},{value:"Human Oversight",id:"human-oversight",level:2},{value:"Compliance",id:"compliance",level:2},{value:"Next Steps",id:"next-steps",level:2}];function a(e){const t={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"security--compliance",children:"Security & Compliance"})}),"\n",(0,s.jsx)(t.h2,{id:"overview",children:"Overview"}),"\n",(0,s.jsx)(t.p,{children:"OpsWorker's security architecture is built on the principles of least privilege, defense in depth, and human oversight."}),"\n",(0,s.jsx)(t.h2,{id:"security-architecture",children:"Security Architecture"}),"\n",(0,s.jsx)(t.h3,{id:"agent-security",children:"Agent Security"}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Control"}),(0,s.jsx)(t.th,{children:"Implementation"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Read-only access"})}),(0,s.jsxs)(t.td,{children:["Agent runs with the built-in ",(0,s.jsx)(t.code,{children:"view"})," ClusterRole (get/list/watch only)"]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"No Secret values by default"})}),(0,s.jsx)(t.td,{children:"By default the agent does not read Secret values; secret access is opt-in and disabled by default"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Outbound-only communication"})}),(0,s.jsx)(t.td,{children:"No inbound ports; agent polls SQS"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"No stored cluster credentials"})}),(0,s.jsx)(t.td,{children:"Cluster token only; no kubeconfig in cloud"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Minimal footprint"})}),(0,s.jsx)(t.td,{children:"A default install runs three pods: the agent, the Kubernetes MCP server, and the Grafana MCP server"})]})]})]}),"\n",(0,s.jsx)(t.h3,{id:"cloud-security",children:"Cloud Security"}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Control"}),(0,s.jsx)(t.th,{children:"Implementation"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Serverless"})}),(0,s.jsx)(t.td,{children:"No servers to patch or manage"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Multi-tenant isolation"})}),(0,s.jsx)(t.td,{children:"Logical, application-layer isolation by organization on shared DynamoDB tables"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Encryption"})}),(0,s.jsx)(t.td,{children:"At rest (AES-256, AWS-managed) and in transit (TLS, AWS default; not pinned to a minimum version by configuration)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Access control"})}),(0,s.jsx)(t.td,{children:"Role-based access in portal (Admin and ReadOnly roles)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Audit logging"})}),(0,s.jsx)(t.td,{children:"Investigation activities logged"})]})]})]}),"\n",(0,s.jsx)(t.h3,{id:"application-security",children:"Application Security"}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Control"}),(0,s.jsx)(t.th,{children:"Implementation"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Authentication"})}),(0,s.jsx)(t.td,{children:"Auth0 (with Google social login)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Authorization"})}),(0,s.jsx)(t.td,{children:"Role-based access control"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Session management"})}),(0,s.jsx)(t.td,{children:"Secure session handling via Auth0"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"API
1security"})}),(0,s.jsx)(t.td,{children:"Authenticated API endpoints"})]})]})]}),"\n",(0,s.jsx)(t.h2,{id:"human-oversight",children:"Human Oversight"}),"\n",(0,s.jsx)(t.p,{children:"OpsWorker never auto-executes commands on your cluster:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"Recommendations are suggestions for human review"}),"\n",(0,s.jsx)(t.li,{children:"Engineers decide what to execute and when"}),"\n",(0,s.jsxs)(t.li,{children:["The ",(0,s.jsx)(t.a,{href:"/docs/capabilities/recommendations/safe-execution",children:"safe execution model"})," ensures humans stay in control"]}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"compliance",children:"Compliance"}),"\n",(0,s.jsx)(t.p,{children:"OpsWorker holds no certified compliance attestations today."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Standard"}),(0,s.jsx)(t.th,{children:"Status"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"SOC 2"})}),(0,s.jsx)(t.td,{children:"On the roadmap, not yet certified. Contact OpsWorker for details."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.strong,{children:"Data residency"})}),(0,s.jsx)(t.td,{children:"Data is hosted in the AWS region you select. Contact OpsWorker for a DPA and region options."})]})]})]}),"\n",(0,s.jsx)(t.p,{children:"For specific compliance questions or security documentation requests, contact the OpsWorker team."}),"\n",(0,s.jsx)(t.h2,{id:"next-steps",children:"Next Steps"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.a,{href:"/docs/architecture/isolation-encryption",children:"Isolation & Encryption"}),": Data protection details"]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.a,{href:"/docs/agent/scope",children:"Agent Scope"}),": What the agent can access"]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.a,{href:"/docs/architecture/deployment/saas",children:"Deployment Options"}),": Choose your deployment model"]}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(a,{...e})}):a(e)}},8453(e,t,n){n.d(t,{R:()=>c,x:()=>d});var r=n(6540);const s={},i=r.createContext(s);function c(e){const t=r.useContext(i);return r.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),r.createElement(i.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.