Security groups and firewall rules opened for temporary testing are routinely forgotten. ExceptionLease introduces revision-bound leases, CAS live drift protection, and automated read-back verification so you can prove to auditors the door was shut.
Automate Cloud Exceptions in Seconds
ExceptionLease operates inside your security perimeter. IAM credentials and cloud tokens never leave your VPC.
Generates exceptionlease.config.json, binds policy boundaries, and enforces dual-custody approval gates.
name: Continuous Security Exception Monitor
on:
schedule:
- cron: '*/15 * * * *' # Every 15 minutes
jobs:
drift-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Reconcile Exceptions & Check CAS Drift
uses: subash-thiruppathi/ExceptionLease@v1
with:
environment-id: production
org-id: org-main
slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
license-key: ${{ secrets.EXCEPTIONLEASE_LICENSE_KEY }}Runs continuous reconciliation in GitHub Actions. If out-of-band rule modification is detected, halts deletion and alerts Slack.
[](https://exceptionlease.spekra.in)
Embed live cloud exception trust badges on your internal README, architecture docs, or trust portal proving 0 overdue security group rules.
Scans your codebase and Terraform templates for wildcard ingress (0.0.0.0/0) on sensitive ports (22, 3389, 5432). Outputs a 0-100 Governance Score.
Simulate an end-to-end exception request: dual-custody approval, heartbeat renewal, expiry revocation, and read-back closure.
Embed Real-Time Cloud Exception Proofs
Prove cloud perimeter integrity to internal stakeholders, auditors, and customers with dynamically generated vector badges.
Compare-and-Swap (CAS) Drift Guard
Blindly running RevokeSecurityGroupIngress when a lease expires can take down production if someone changed the rule out-of-band.
An engineer expands a temporary single-IP rule (/32) to a broader office subnet (/24) directly in AWS Console. When a dumb cron job revokes it, production traffic breaks without warning.
ExceptionLease computes the SHA-256 fingerprint of the exact rule. Before revocation, it reads live provider state. If the live rule does not match the fingerprint, it halts revocation and flags drifted for human review.
A 200 response from AWS API is not enough. ExceptionLease issues an immediate read-back query to prove the rule is completely absent from the security group before issuing the signed closure certificate.
Temporary Cloud Exceptions for Every Scale
Lightweight customer runner polls outbound over TLS. IAM credentials and cloud tokens never leave your VPC.
Open-source CLI for manual cloud exception lifecycle tracking.
Automated CAS read-back reconciliation for growing engineering teams.
Continuous CAS live drift guards and automated compliance evidence bundles.
Multi-cloud AWS/GCP/Azure organizations with custom SAML/SSO.
No. ExceptionLease enforces strict separate approver dual-custody. The owner_id who submitted the request cannot be the approver_id who authorizes rule provisioning, satisfying SOC 2 CC6.1 and CC6.3 controls.
ExceptionLease uses fencing epochs and revision counters. When a lease is renewed, the revision counter increments and a new epoch is generated. Any background worker carrying an obsolete epoch is fenced and rejected, preventing premature revocation.
The runner operates with least-privilege IAM permissions: ec2:AuthorizeSecurityGroupIngress, ec2:RevokeSecurityGroupIngress, and ec2:DescribeSecurityGroups scoped strictly to tagged security groups. No administrator access is needed.