What Data is Collected
|
Data Type |
Example |
Purpose |
|
AWS Access Key ID |
AKIAIOSFODNN7EXAMPLE |
Authenticate API requests to AWS services |
|
AWS Secret Access Key |
wJalrXUtnFEMI/K7MDENG/... |
Sign requests made to AWS APIs |
|
AWS Default Region |
ap-south-1 |
Scope API calls to the correct AWS region |
Why This Data is Collected
-
AWS Access Key ID: Identifies the IAM user or role making API requests to AWS services on behalf of COMPASS.
-
AWS Secret Access Key: Used to cryptographically sign all API requests — never transmitted in plaintext after initial entry.
-
AWS Default Region: Ensures data collection and compliance checks are scoped to the correct geographic AWS region.
How Data is Secured
-
Encryption at Rest: All credentials are encrypted using AES-256 in isolated, tenant-specific databases.
-
Encryption in Transit: All communications use HTTPS/TLS 1.2+.
-
Access Control: Only automated systems (not staff) can use your credentials for authorized operations.
-
Audit Logging: Every access, refresh, and revocation is logged for compliance.
-
Multi-Tenant Isolation: Your data is never mixed with other organizations.
How to Revoke Access
Option 1: From COMPASS
-
Go to Integrations → Configurations
-
Click AWS under the Original Equipment Manufacturers (OEMs) page.
-
Under Actions column, click Delete.
Option 2: From AWS Console
-
Go to the AWS IAM Console (https://console.aws.amazon.com/iam/)
-
Navigate to Users → select the relevant IAM user.
-
Under Security credentials, find the Access Key and click Deactivate or Delete.
What Happens After Revocation? 
-
COMPASS deletes all stored credentials and stops all access.
-
Scheduled operations are cancelled.
-
You can reconnect anytime.