[{"data":1,"prerenderedAt":201},["ShallowReactive",2],{"changelog-2026-10-05-aws-self-updating-stacks-dashboard-trends":3,"changelog-2026-10-05-aws-self-updating-stacks-dashboard-trends-surround":190},{"id":4,"title":5,"api":6,"authors":7,"body":13,"category":110,"date":111,"description":112,"extension":113,"faq":6,"features":114,"fixes":135,"highlight":155,"image":164,"improvements":166,"meta":184,"navigation":185,"path":186,"seo":187,"stem":188,"summary":6,"updated":6,"__hash__":189},"posts\u002F3.blog\u002F2026-10-05-aws-self-updating-stacks-dashboard-trends.md","AWS Permission Updates You Approve in episki, Never Beyond SecurityAudit",null,[8],{"name":9,"to":10,"avatar":11},"Justin Leapline","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fjustinleapline\u002F",{"src":12},"\u002Fimages\u002Fjustinleapline.png",{"type":14,"value":15,"toc":106},"minimark",[16,20,27,42,48,51,62],[17,18,19],"p",{},"The AWS integration has always asked for a narrow, read-only role. The friction was everything around it: copying an account ID back into episki after launching the stack, and coming back to the CloudFormation console every time we added a check. This release removes both without asking you to trust us with more.",[17,21,22,26],{},[23,24,25],"strong",{},"The stack introduces itself."," On launch, a small function in the template tells episki the account ID, role, and stack version. The connect page is waiting for it and finishes the connection on its own. The function always reports success to CloudFormation, so episki being unreachable can never fail your stack.",[17,28,29,32,33,37,38,41],{},[23,30,31],{},"You pick how permissions are maintained."," ",[34,35,36],"em",{},"SecurityAudit"," attaches AWS's own managed policy, which AWS keeps current, so new checks usually work without any update. ",[34,39,40],{},"Least privilege"," is episki's exact list and nothing else. The template defaults to least privilege, so an update made from the console or CLI never widens access unless someone chooses it.",[17,43,44,47],{},[23,45,46],{},"Updates are one click, and bounded."," If you opt in, an admin can approve a permission update from inside episki. The role episki updates has AWS's SecurityAudit policy as its permissions boundary, and the service role that applies the update can only change that one role's policies, only with that boundary in place. Whatever a template asks for, the effective access is metadata-only. Your existing parameters are carried over unchanged on every update.",[17,49,50],{},"The checks themselves grew too: CloudTrail, GuardDuty, Security Hub, Config, Access Analyzer, default EBS encryption, security groups, RDS, and KMS key rotation. A region we cannot read produces no result rather than a false \"off\", so a stack that has not been updated yet never generates findings it cannot back up.",[17,52,53,54,57,58,61],{},"Elsewhere, the ",[23,55,56],{},"dashboard now remembers",". A nightly snapshot means the trend chart, the deltas, and the sparklines show where you were, not just where you are. And the ",[23,59,60],{},"agent's work reads like a conversation",": one card per item, a clear state, and a place to reply when it needs input.",[63,64,65,72,82,88,94,100],"ul",{},[66,67,68,71],"li",{},[23,69,70],{},"Self-registering AWS stacks"," and one-click, SecurityAudit-capped permission updates",[66,73,74,77,78,81],{},[23,75,76],{},"AWS posture checks"," and an ",[23,79,80],{},"Organizations rollout"," with daily discovery",[66,83,84,87],{},[23,85,86],{},"Dashboard trend history"," with a scrubbable chart",[66,89,90,93],{},[23,91,92],{},"One chat surface"," with edit and resend, \u002F skills, and real @-mentions",[66,95,96,99],{},[23,97,98],{},"Agent sessions"," in the activity feed, and replies that instruct the agent",[66,101,102,105],{},[23,103,104],{},"Saved views"," on every list, with Favorites in the sidebar",{"title":107,"searchDepth":108,"depth":108,"links":109},"",2,[],"changelog","2026-10-05","The AWS stack now registers itself, offers AWS's managed SecurityAudit policy, adds baseline posture checks, rolls out across an Organization, and can update itself when you click approve — with a permissions boundary that caps it at SecurityAudit. Plus dashboard trend history, one chat surface with edit and resend, agent sessions in the activity feed, and saved views on every list.","md",[115,118,120,123,126,129,132],{"label":116,"text":117},"AWS","Rolling out across an AWS Organization is a supported path — the connect page gives you a StackSet command, a template download, and a console link. Discovery can pause new accounts for you to choose, or scan every account automatically, and re-runs daily so new member accounts appear without a manual refresh.",{"label":116,"text":119},"The access policy is tighter. Four grants nothing ever used are gone, and a test pins every permission to the check that uses it, so episki cannot ask for one it does not call.",{"label":121,"text":122},"Dashboard","The dashboard has history. A nightly snapshot records assurance, risks by level, open issues, expiring evidence, and overdue tests, and the overview leads with a trend chart you can scrub across 7, 30, or 90 days. KPI tiles show week-over-week deltas and sparklines drawn from real history rather than row counts.",{"label":124,"text":125},"Chat","The side panel and the full agent page are now the same conversation. Edit any message you sent and resend it, type \u002F for skills, and @-mention teammates by name. Stop actually stops, and regenerate runs on the server so it survives a closed tab.",{"label":127,"text":128},"Activity","Everything the agent did on a task or issue — every run, status move, tool call, and message — collapses into one session card that reads Working, Needs input, Awaiting approval, or Finished. Open it to see the whole conversation, and reply to the agent there to give it new instructions.",{"label":130,"text":131},"Lists","Saved views on every filterable list — tasks, issues, risks, controls, vendors, policies, evidence, and the rest. A view keeps filters, grouping, ordering, and columns, can be personal or shared with the workspace, and has its own link. Star one and it appears under Favorites in the sidebar. An owner filter of Me makes a shared \"My open issues\" view work for everyone.",{"label":133,"text":134},"Team","Resend an invite from the member row menu.",[136,138,141,143,146,149,152],{"label":116,"text":137},"When AWS refuses the role, episki now says so instead of reporting a missing permission, names the external ID it sent, and explains a mismatch. A customer's refusal is no longer counted as an episki outage.",{"label":139,"text":140},"Auth","A browser cookie that outlived its session no longer loads a workspace.",{"label":124,"text":142},"@-mentions are inserted as names, not member IDs.",{"label":144,"text":145},"App","A tab that wakes up on an outdated build reloads itself instead of failing quietly.",{"label":147,"text":148},"Navigation","Sidebar items stay highlighted on their sub-pages.",{"label":150,"text":151},"Reminders","Due-date reminders show the item's name again.",{"label":153,"text":154},"Coverage","Roll-ups to open assessments use their completion date, so coverage counts are correct.",{"title":156,"description":157,"icon":158,"items":159},"AWS that keeps itself current, inside a ceiling you can audit","Every time episki added an AWS check, someone on your side had to open the CloudFormation console, find the stack, and update it. Now the stack reports itself to episki when it launches, so the account ID fills in and the connection completes on its own. When a later check needs a permission the stack does not have yet, an admin clicks Approve update in episki and episki updates its own stack. That only works if you turned it on, and the role it updates carries AWS's SecurityAudit policy as a permissions boundary, so whatever the template says, the effective access can never exceed metadata-only reads. No object, log, parameter, or secret reads, ever.","i-simple-icons-amazonwebservices",[160,161,162,163],"The stack registers itself on launch and the connect page finishes the connection automatically","Choose AWS's managed SecurityAudit policy, which AWS keeps current, or episki's exact least-privilege list","Approve permission updates in episki, capped by a SecurityAudit permissions boundary","Baseline posture checks for CloudTrail, GuardDuty, Security Hub, Config, Access Analyzer, EBS encryption, security groups, RDS, and KMS rotation",{"src":165},"\u002Fimages\u002Fchangelog\u002Faws-self-updating-stacks-dashboard-trends.webp",[167,170,172,175,178,181],{"label":168,"text":169},"AI","Model calls fall back to a second provider when the first is unavailable, run with zero data retention, and cache long prompts so repeat turns are faster.",{"label":127,"text":171},"The feed is quieter. Duplicate completion rows, notification copies of status changes, and raw tool rows that repeat a result are gone, and rapid flips of one field by one person merge into one row.",{"label":173,"text":174},"Microsoft","Entra risk monitoring polls instead of holding Graph subscriptions open, and the tenant is resolved once per sync instead of once per request.",{"label":176,"text":177},"Findings","Every finding's title and body is built in one place, so findings from different checks read the same way.",{"label":179,"text":180},"Loops","Turning a loop on no longer resets fields you have not sent yet, and an untouched loop gets its working set.",{"label":182,"text":183},"Performance","The AWS sync no longer repeats identical lookups for every step and finding.",{},true,"\u002Fblog\u002F2026-10-05-aws-self-updating-stacks-dashboard-trends",{"title":5,"description":112},"3.blog\u002F2026-10-05-aws-self-updating-stacks-dashboard-trends","oK5ch1c9dpPcLkJ3E_1AZtdBLPW0KkFtevnuVs4oAAc",[191,196],{"title":192,"path":193,"stem":194,"description":195,"children":-1},"Security Questionnaires, Answered From What You Have Already Said","\u002Fblog\u002F2026-09-28-questionnaires-trust-center-control-mapping","3.blog\u002F2026-09-28-questionnaires-trust-center-control-mapping","Inbound security questionnaires land as work items and draft their answers from your trust center and an answer library of everything you have approved before. Plus trust center subscribers and updates, custom control mapping, per-scope tests, evidence-grounded PCI assessment drafting, and findings that read like findings.",{"title":197,"path":198,"stem":199,"description":200,"children":-1},"episki for macOS, Windows, and Linux","\u002Fblog\u002F2026-10-19-desktop-apps-guided-setup-scheduled-reports","3.blog\u002F2026-10-19-desktop-apps-guided-setup-scheduled-reports","The episki desktop app is here for macOS, Windows, and Linux, with tabs for every workspace, native notifications, and automatic updates. Plus a guided setup wizard for new workspaces, scheduled reports delivered by email, approvals in the inbox, overview dashboards, mapped controls everywhere, a services directory, and per-instruction PCI responses.",1792473222876]