A five-minute setup that guarantees the scanner can't touch anything
Running a third-party tool against your AWS account raises a fair question before you type a single command: what can it actually do with my credentials?
With GreenOps Scan the honest answer should be "nothing but read." But you do not have to take that on faith. AWS lets you create a dedicated IAM user or role that is technically incapable of making changes — no write, no delete, no configuration changes, anywhere. If you attach only ReadOnlyAccess to the credentials you scan with, there is no policy misconfiguration or bug in the scanner that could put your infrastructure at risk.
This post walks through creating that profile with the AWS CLI, so you can try npx greenops-scan with full confidence.
Why a dedicated profile instead of your existing one
