In short
- Read-only. CloudPeek reads CloudWatch, and can call one model in Amazon Bedrock. It never changes anything in your AWS account.
- Its own sign-in. Give it a dedicated IAM user or IAM Identity Center permission set with only the permissions below.
- Credentials stay on the device, in the iOS Keychain, and are only used to sign requests to AWS.
- No CloudPeek servers. The app talks straight to AWS, and to Anthropic only if you choose it for AI widgets. It has no analytics, crash-reporting or advertising code.
Permissions
These are the actions in CloudPeek's policy, and what each is for:
| Action | Used for | Without it |
|---|---|---|
cloudwatch:ListDashboards | Listing an account's dashboards, and checking at sign-in that the sign-in can read CloudWatch. | Signing in fails: “… isn't allowed to read CloudWatch dashboards.” |
cloudwatch:GetDashboard | Reading a dashboard's widgets, when you browse it and each time one of its widgets refreshes. | Dashboard widgets show “Access denied”. |
cloudwatch:GetMetricData | The data for every graph, number, gauge, bar, pie and table. | Metric widgets show “Access denied”. |
cloudwatch:DescribeAlarms | Alarm widgets and the alarm presets. | Alarm widgets show “Access denied”. |
cloudwatch:ListMetrics | Letting the AI model find your metrics' real names. Optional. | The model writes from standard AWS metric names, which works less often. |
bedrock:InvokeModel | Writing AI widgets in Amazon Bedrock. Optional. | Use the Anthropic API for AI widgets instead. |
- Checking an access key uses
sts:GetCallerIdentity, which needs no permission. IAM Identity Center sign-in needs nothing beyond the permission set assigned to you. - Resource
"*": the CloudWatch read actions don't support resource-level permissions for this use. To allow only CloudPeek's model in Bedrock, see AI widgets. - AWS managed policy:
CloudWatchReadOnlyAccessincludes the CloudWatch actions, but not Bedrock. - Service control policies in AWS Organizations apply too. One that denies Bedrock stops AI widgets in Bedrock, whatever the user's policy says.
Where your credentials are kept
- AWS sign-ins: each account's access key, or the tokens and role credentials IAM Identity Center issues, is kept in its own item in the iOS Keychain, shared only between CloudPeek and its widgets.
- Available after first unlock, on this device only: widgets can refresh while your iPhone is locked, but not between a restart and the first unlock. The items are never synced to iCloud Keychain or restored to another device.
- Identity Center sessions are renewed by the app and by its widgets, until your organisation's session limit.
- Your Anthropic API key, if you add one, is kept in the Keychain on this device, readable only while it's unlocked, and only ever sent to Anthropic.
- Widgets and their latest data are kept in storage shared only between CloudPeek and its widgets.
What leaves your device
Requests go straight from your iPhone or iPad to these services, each signed with the account's credentials on the device:
| Service | Address | When |
|---|---|---|
| Amazon CloudWatch | monitoring.<region>.amazonaws.com | Listing dashboards, refreshing widgets, finding metrics for AI widgets |
| AWS STS | sts.<region>.amazonaws.com | Checking a sign-in |
| IAM Identity Center | oidc.<region>.amazonaws.com, portal.sso.<region>.amazonaws.com | Signing in with SSO, and renewing the session |
| Amazon Bedrock | bedrock-runtime.<region>.amazonaws.com | Writing an AI widget, if you use Bedrock |
| Anthropic | api.anthropic.com | Writing an AI widget, only if you choose the Anthropic API |
In AWS China, the AWS addresses end in .amazonaws.com.cn. When you sign in with IAM Identity Center, you approve the sign-in on AWS's own website, in your browser. The sample account contacts no one.
What an AI model is sent, and never sent, is listed in AI widgets › What the model sees. The privacy policy covers the app and this website in full.
Take CloudPeek's access away
On the device:
- Remove Account, in an account's Account Details, deletes its credentials and the widgets only it could refresh. Remove All Accounts, in Settings, deletes all of them.
- Remove API Key, in Settings › AI Widgets, deletes your Anthropic API key.
- iOS can keep Keychain items after an app is deleted, so remove your accounts before deleting CloudPeek.
In AWS, so the credentials stop working wherever they are:
- Access key: in the IAM console, open the user, then Security credentials, and deactivate or delete the key. Delete the user and the
CloudPeekpolicy if you no longer need them (see Removing it for the CLI, CloudFormation and Terraform). - IAM Identity Center: remove the CloudPeek permission set's assignment from the account, or delete the permission set.
- Anthropic API key: revoke it in the Anthropic Console.