Using Opsec
Connecting sources
Give Opsec read-only access to repositories, contracts and cloud accounts.
Sources are always connected with the least access needed. Opsec requests write access only to open pull requests, and only if you enable repairs.
| Source | Connection | Permissions |
|---|---|---|
| GitHub / GitLab / Bitbucket | App installation | Contents: read · Pull requests: write (optional) |
| Smart contracts | Repository + RPC endpoint | Read-only RPC, archive node recommended |
| AWS | Cross-account role | SecurityAudit + ViewOnlyAccess |
| GCP / Azure | Service principal | Viewer + Security Reviewer |
| Kubernetes | Service account | Cluster-wide get / list / watch |
bash
opsec sources add aws --role-arn arn:aws:iam::123456789012:role/OpsecReadOnly