Skip to main content

Security Model

What access Kostavo has, what it does with it, and where the hard limits are. This page is written for the security review that precedes most rollouts.

How Kostavo Connects​

Kostavo is a SaaS platform; nothing is installed in your infrastructure. All access goes through the Databricks APIs using a service principal you create and can revoke at any time:

  • Azure: a service principal with a custom role carrying exactly two permissions: Microsoft.Databricks/workspaces/read (discover workspaces and read metadata) and Microsoft.Databricks/workspaces/assignWorkspaceAdmin/action (obtain workspace admin access for scanning and remediation). No Contributor, no Owner, no other built-in role. See Azure service principal.
  • AWS: a Databricks service principal granted admin access per workspace in the account console. Kostavo can only reach workspaces you explicitly granted. See AWS credentials.

The blast radius is controlled on your side: the scope of the Azure role assignment, or the per-workspace grants on AWS, decides what Kostavo can see.

What Scans Do​

On each scan, policies read resource configuration and state through the Databricks APIs: cluster settings, warehouse configuration, job definitions, permissions, workspace settings. The results become findings. Reading is all a scan does; whether anything changes is decided by the action mode you configured.

When Kostavo Changes Something​

Kostavo modifies a resource only when a policy you put in Fix or Remove mode detects a violation, and every action is one you can look up in advance:

  • The exact Fix and Remove behavior per policy is documented in the policy catalog. There are no undocumented actions.
  • Notify mode never changes anything, and every policy supports it. It is the recommended starting mode.
  • Schedules suppress Fix and Remove during protected windows; detection continues.
  • Exception lists and suppression exclude specific resources. See Suppress vs exception.
  • After an action, a cooldown window prevents repeated actions on the same resource.

Every scan and action is recorded in execution history, so "what did Kostavo do and when" always has an exact answer.

What Kostavo Never Does​

  • Run policies against a workspace with no assignment
  • Enroll or touch workspaces you did not add, even when the Azure read permission lets it discover their names
  • Change any resource under a policy in Notify mode
  • Show a stored secret to anyone: credential secrets are encrypted at rest and write-only, and the API only ever returns metadata

Credentials and Secrets​

Secrets are entered once, stored encrypted, and never displayed again. Rotation is a paste-new-secret operation with no downtime (Managing credentials). Revoking the service principal or its secret at the provider cuts off all Kostavo access immediately; nothing on the Kostavo side can restore it.

Data Residency​

Customer data is stored in the EU (Amsterdam). SOC 2 compliance is in progress. Kostavo stores the resource metadata, configuration snapshots, and scan results needed to operate the product.