AWS Permission Updates You Approve in episki, Never Beyond SecurityAudit
The AWS integration has always asked for a narrow, read-only role. The friction was everything around it: copying an account ID back into episki after launching the stack, and coming back to the CloudFormation console every time we added a check. This release removes both without asking you to trust us with more.
The stack introduces itself. On launch, a small function in the template tells episki the account ID, role, and stack version. The connect page is waiting for it and finishes the connection on its own. The function always reports success to CloudFormation, so episki being unreachable can never fail your stack.
You pick how permissions are maintained. SecurityAudit attaches AWS's own managed policy, which AWS keeps current, so new checks usually work without any update. Least privilege is episki's exact list and nothing else. The template defaults to least privilege, so an update made from the console or CLI never widens access unless someone chooses it.
Updates are one click, and bounded. If you opt in, an admin can approve a permission update from inside episki. The role episki updates has AWS's SecurityAudit policy as its permissions boundary, and the service role that applies the update can only change that one role's policies, only with that boundary in place. Whatever a template asks for, the effective access is metadata-only. Your existing parameters are carried over unchanged on every update.
The checks themselves grew too: CloudTrail, GuardDuty, Security Hub, Config, Access Analyzer, default EBS encryption, security groups, RDS, and KMS key rotation. A region we cannot read produces no result rather than a false "off", so a stack that has not been updated yet never generates findings it cannot back up.
Elsewhere, the dashboard now remembers. A nightly snapshot means the trend chart, the deltas, and the sparklines show where you were, not just where you are. And the agent's work reads like a conversation: one card per item, a clear state, and a place to reply when it needs input.
- Self-registering AWS stacks and one-click, SecurityAudit-capped permission updates
- AWS posture checks and an Organizations rollout with daily discovery
- Dashboard trend history with a scrubbable chart
- One chat surface with edit and resend, / skills, and real @-mentions
- Agent sessions in the activity feed, and replies that instruct the agent
- Saved views on every list, with Favorites in the sidebar
Security Questionnaires, Answered From What You Have Already Said
Inbound security questionnaires land as work items and draft their answers from your trust center and an answer library of everything you have approved before. Plus trust center subscribers and updates, custom control mapping, per-scope tests, evidence-grounded PCI assessment drafting, and findings that read like findings.
episki for macOS, Windows, and Linux
The episki desktop app is here for macOS, Windows, and Linux, with tabs for every workspace, native notifications, and automatic updates. Plus a guided setup wizard for new workspaces, scheduled reports delivered by email, approvals in the inbox, overview dashboards, mapped controls everywhere, a services directory, and per-instruction PCI responses.