Anomaly Partners
You set up anomaly partners by creating a dedicated role with read-only permissions. You then link that role to the external vendor account for metric analysis. Many engineering teams rush this setup during a busy week. They often grant broad admin roles so the tool works right away. Those wide permissions create a major security risk across your cloud apps. If an outside partner gets breached, attackers can use that wide role. They can read private customer rows or change live system settings.
Network Monitoring & Anomaly Detection: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up anomaly partners by creating a dedicated role with read-only permissions. You then link that role to the external vendor account for metric analysis. Many engineering teams rush this setup during a busy week. They often grant broad admin roles so the tool works right away. Those wide permissions create a major security risk across your cloud apps. If an outside partner gets breached, attackers can use that wide role. They can read private customer rows or change live system settings.
How to set up anomaly partners with native roles
A safe setup starts inside your main cloud identity provider. You first create a distinct service identity for the external analysis tool. Next, you build a custom permission policy with strict read limits. This policy should allow reading system metrics and billing logs only. You must block access to raw database tables and secret stores. After you save the policy, you attach it to the new role.
Most external analysis tools use cross-account role assumption to read data. You configure a trust relationship between your cloud account and the vendor. You also add an external identifier to stop confused deputy attacks. The vendor tool assumes the role for a short time window. It pulls the allowed metric streams and sends them to its engine. The engine then looks for strange spikes in cost or traffic. Your security team should review these role trust rules every quarter.
What native anomaly partners roles leave open
Native cloud roles handle the initial login step very well. They check who the partner is before granting a session token. They also restrict which high-level cloud services the partner can reach. Still, native roles stop checking once the session starts running. They cannot inspect individual queries or commands sent inside an active session.
Sometimes an external partner needs access to a live production database. They might need to run diagnostic queries to find slow performance issues. A native database role lets them read every column in a table by default. That table often holds sensitive customer data like emails and phone numbers. It might also hold card numbers or national IDs in plain text. Native permissions cannot rewrite those sensitive fields in query results on the fly. They also fail to require a human check before a risky command runs. Teams need a way to control each action during the session itself.
Network Monitoring & Anomaly Detection: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
How to audit partner queries and protect live data
You can close this gap by adding controls at the command level. First, map out every database and server that outside vendors touch. Remove shared static passwords from all vendor tools and support teams. Require every person and service to log in through your identity provider. This step ties every single query to a known user identity.
Next, set up real-time data masking on your sensitive database tables. When a partner queries a table, masking rewrites matched fields in results. The partner sees masked values instead of real emails or card numbers. They can still check row counts and fix query performance bugs. Finally, turn on detailed command logging for every external session. Your team will know every query that ran and when it happened.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What permissions do anomaly partners need in cloud accounts?
They usually need read-only access to metric logs, billing data, and resource lists. They should never get write permissions or access to secret stores.
How do we stop third-party tools from reading sensitive database columns?
Use dynamic data masking to rewrite matched fields like emails or phone numbers in results. This lets partners run test queries while keeping private customer fields hidden.
How often should teams review external partner roles?
Security teams should check all external roles and trust policies every ninety days. Remove any unused vendor roles right away to keep your attack surface small.