Skip to main content

​
Architecture overview

OpsBeacon is a hosted service. You connect it to your AWS account via a read-only IAM role, and to your Slack workspace via the OpsBeacon Slack app. From there, Beacon runs on a schedule and on demand.

​
What OpsBeacon reads from AWS

OpsBeacon uses four AWS data sources: OpsBeacon never writes to your AWS account and never stores raw credentials. All AWS access is through a cross-account IAM role with a minimal permission set. See AWS IAM Permissions for the full policy.

​
How Beacon processes data

When you trigger a report or ask Beacon a question:
  1. Beacon pulls the relevant data from AWS via your IAM role
  2. It runs scoring models against that data (cost anomaly detection, security gap quantification, efficiency scoring)
  3. It formats the output as structured Slack messages with findings, scores, and recommended actions
  4. It stores a lightweight record of findings and scores over time so it can track trends and verify outcomes

​
Interaction model

Beacon lives in Slack. You interact with it in two ways: Mentions — tag @Beacon in any channel with a request in plain English:
Scheduled reports — configure Beacon to post reports to a channel on a schedule (daily, weekly, monthly). See Scheduled Reports.

​
Data freshness

  • Cost data refreshes daily (AWS Cost Explorer has a ~24h lag)
  • Security findings refresh on each report trigger
  • Scores are calculated at report time based on current data

​
What Beacon does not do

  • Does not make changes to your AWS account
  • Does not store your AWS credentials or access keys
  • Does not have access to your application code, databases, or non-AWS infrastructure
  • Does not share your data across tenants