Integrations · Deploy targets
CloudTrail and EventBridge show every change. Lambda code signing and ECS lifecycle hooks refuse anything Aspian didn’t approve.
Control levels
1Observe
We watch, record and flag.
CloudTrail and EventBridge: function updates, task definition changes and service deployments.
2GateRecommended
The tool waits for an approval.
Lambda code signing in Enforce mode; an ECS lifecycle hook that asks Aspian; admission control on EKS.
3Hold
Only Aspian holds the credentials.
A deploy role assumable only by Aspian for approved changes, through OIDC.
Set it up
- 1Deploy the Aspian CloudFormation stack in each account.
- 2Turn on code signing for production Lambda functions and the lifecycle hook for ECS services.
- 3Restrict the production deploy role to Aspian.
More deploy targets
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.