Security and permissions
The access model behind CUR enrichment.
The access model
CUR enrichment only ever touches the storage you set up for it. Greenpixie is granted access to your nominated input and output buckets/containers and nothing else in your environment. We read billing data from the input directory and write enriched results to the output directory.
- Access is scoped to the specific buckets/containers you nominate
- Input-only storage can be granted read-only access
- You grant the access in your own environment, and you can revoke it at any time by removing the policy or role assignment
How access is granted per platform
Each storage platform uses its native access mechanism; see the platform guides for the exact setup:
| Platform | Mechanism | You grant |
|---|---|---|
| Amazon S3 | Bucket policy naming a dedicated Greenpixie IAM principal (one per data connection) | s3:GetObject, s3:PutObject, s3:ListBucket and multipart-upload actions on the bucket |
| Azure Blob Storage | A Local App Registration created in your tenant; Greenpixie authenticates with its client ID/secret | Storage Blob Data Reader (input), plus Storage Blob Data Contributor for output |
| Google Cloud Storage | A per-customer Greenpixie service account ({customer-name}@client-data-access.iam.gserviceaccount.com) | Storage Object Viewer (input) or Storage Object User (output) on the bucket |
Recommended storage settings
The platform guides include hardening settings as part of setup:
- S3: ACLs disabled and all public access blocked
- Azure Blob Storage: soft delete disabled (required for API compatibility)
- Google Cloud Storage: public access prevention enforced, uniform access control
Revoking access
Remove the bucket policy statement (S3), the role assignments or the Local App Registration (Azure), or the service account's role on the bucket (GCS). Access stops immediately; no action from Greenpixie is required.
If you have questions about the access model or need to review it with your security team, contact your Greenpixie representative.