Bounded Cloud Infrastructure Exceptions with Verified Closure

Give Temporary Cloud Exceptions
An Owner, An Expiry, And Verified Closure.

Security groups and firewall rules opened for temporary testing are routinely forgotten. ExceptionLease introduces revision-bound leases, CAS live drift protection, and automated read-back verification so you can prove to auditors the door was shut.

Test Interactive Lease Simulator Why CAS Drift Protection Matters
✓ AWS Security Groups & Firewalls
✓ Separate Approver Dual-Custody
✓ Fencing Epochs & Race Protection
✓ SOC 2 (CC6.1/CC6.3) Evidence Bundles

Temporary Exception Lifecycle Simulator

Simulate an end-to-end exception request: dual-custody approval, heartbeat renewal, expiry revocation, and read-back closure.

exceptionlease-reconciler // lifecycle-engine
STANDBY
// Target Rule: AWS Security Group sg-0a9b8c (Postgres Ingress port 5432)
// Requester: [email protected] (Incident Hotfix #412)
// Ready. Click "Request & Execute Lease" to initiate temporary exception workflow.

Security Group Rule State Closed

No temporary rule active on AWS sg-0a9b8c.

SOC 2 Audit Evidence Seal

Lease ID: None
Digest (SHA-256): Unsealed
Read-back Proof: Pending

Safe Revocation Architecture

Compare-and-Swap (CAS) Drift Guard

Blindly running RevokeSecurityGroupIngress when a lease expires can take down production if someone changed the rule out-of-band.

01. BLIND REVOCATION HAZARD

The Out-Of-Band Edit

An engineer expands a temporary single-IP rule (/32) to a broader office subnet (/24) directly in AWS Console. When a dumb cron job revokes it, production traffic breaks without warning.

02. FINGERPRINT VERIFICATION

Canonical Hash Match

ExceptionLease computes the SHA-256 fingerprint of the exact rule. Before revocation, it reads live provider state. If the live rule does not match the fingerprint, it halts revocation and flags drifted for human review.

03. VERIFIED READ-BACK

Cryptographic Closure

A 200 response from AWS API is not enough. ExceptionLease issues an immediate read-back query to prove the rule is completely absent from the security group before issuing the signed closure certificate.

Predictable SecOps Pricing

Billed per AWS Account with Zero Surprises

Lightweight customer runner polls outbound over TLS. No inbound ports required.

Pilot Setup
$350 one-time

Single AWS account setup with Slack integration and policy baseline.

  • ✓ 1 AWS Account
  • ✓ Up to 10 active exceptions
  • ✓ Slack request & approval bot
  • ✓ SOC 2 evidence bundle export
Start Pilot
Recommended
Team Platform
$199 / mo / account

Full lifecycle automation with separate approver & CAS drift guard.

  • ✓ Unlimited temporary exceptions
  • ✓ Dual-custody separate approver
  • ✓ Automated Compare-and-Swap drift guard
  • ✓ Fencing epoch race protection
  • ✓ Instant compliance evidence exports
Get Started
Enterprise SecOps
$499 / mo

Multi-account AWS Organizations with Okta/SAML SSO.

  • ✓ Multi-account AWS Organizations
  • ✓ Okta/SAML SSO integration
  • ✓ Custom policy approval workflows
  • ✓ Dedicated compliance auditor portal
Contact Sales

Frequently Asked Questions

Can an engineer approve their own exception request?

No. ExceptionLease enforces strict separate approver dual-custody. The owner_id who submitted the request cannot be the approver_id who authorizes rule provisioning, satisfying SOC 2 CC6.1 and CC6.3 controls.

What if someone extends the lease while an expiry worker is executing?

ExceptionLease uses fencing epochs and revision counters. When a lease is renewed, the revision counter increments and a new epoch is generated. Any background worker carrying an obsolete epoch is fenced and rejected, preventing premature revocation.

What credentials does the customer runner require?

The runner operates with least-privilege IAM permissions: ec2:AuthorizeSecurityGroupIngress, ec2:RevokeSecurityGroupIngress, and ec2:DescribeSecurityGroups scoped strictly to tagged security groups. No administrator access is needed.