Strengthening the Security of Qovery's Access to Your AWS Account

Qovery has strengthened AWS account access security by sending each Qovery organization’s ID as the sts:ExternalId when assuming IAM roles and adding a trust-policy condition that permits role assumption only for that organization. Previously, this isolation was enforced solely through Qovery’s application logic and database constraints; AWS now independently enforces it within the customer’s account, providing defense in depth. Existing Qovery IAM roles have already been updated without service interruption, but customers using the qovery-role-creation CloudFormation stack should update it to the latest template to prevent future stack changes from removing the new condition. Qovery also recommends that customers still using static AWS credentials migrate to STS role assumption, which uses short-lived credentials and benefits from the strengthened trust relationship.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.