Security
What Stackmuster can access, and what it never touches
Stackmuster needs two things from you: read access to your repositories, and a role in your AWS account that it can assume. This page sets out what each one allows, what Stackmuster stores, and what it leaves alone.
How access flows
How Stackmuster connects to your repository and your AWS account:
- Your repository, on any Git host that supports SSH, is read by Stackmuster through a read-only SSH deploy key, plus webhooks.
- Stackmuster is hosted in an AWS region in Australia.
- Stackmuster reaches your AWS account by assuming a role you create, through an OIDC identity provider. There are no long-lived keys.
Access, storage and limits
What Stackmuster can access
- Your repositories, via a read-only SSH deploy key and webhooks. It works with any Git host that supports SSH.
- Your AWS account, via a role you create. You add an OIDC identity provider to your account and a role that Stackmuster assumes. There are no long-lived keys.
- Only what you grant: the role needs only the permissions your stacks need to deploy. You decide the scope.
- A permissions boundary, if you want one: Stackmuster will let you attach an IAM permissions boundary to the access it deploys with, so a template can't create IAM users, access keys or anything else you rule out.
What it stores
- Deployed stack state and stack metadata, kept while the stack is active.
- Where: Stackmuster is hosted in an AWS region in Australia.
What it never touches
- It scans only your repositories and CloudFormation. It never scans anything else in your AWS account.
- It never touches a stack you haven't connected to it. Existing stacks are only managed if you explicitly choose to bring them under Stackmuster.
- It holds no long-lived AWS keys.
- It cannot write to your repositories. The deploy key is read-only.
Related
Plans and what counts as a stack operation are on the pricing page. For how templates become deployments and stacks, see how Stackmuster works.
Security questions: hello@autyra.com
Early access, from November 2026
Stackmuster is not available yet. Join the list and we will email you once, when early access opens.
One email when early access opens, around November 2026. Nothing else, and no sharing with anyone.