The stack is up and the gate is open — now the Sentinel needs permission to look. Every screen, every dropdown, every button, and the exact rule that decides when Continue wakes up.
Three doors, one strip across the top of every screen. It tells you which one you're standing in.
Three states, three looks. The highlighted, solid-numbered tile is where you are. A plain, full-contrast tile is behind you. A faded tile is still ahead. The tiles are a progress display, not buttons — you move with Back and Continue at the bottom of each screen.
Every move writes the step to the backend and into the URL, e.g. /onboarding?step=role.
Close the browser, come back tomorrow, and the wizard reopens exactly where you left it — profile,
environment, account, and regions still filled in.
Three big cards — Automated Optimization, Policy-Based, Cost Savings. Do I have to pick one?
No. They're pure description — not settings, not toggles. Nothing is stored when you read them.
The cards and the About MaxOps paragraph tell you what the product does: find underused resources, express rules as policies, track the savings. You configure none of it here — check tuning lives in Settings once onboarding is finished.
This screen does exactly one piece of real work, and it's on the next panel.
Bundled pricing artifact found and not yet extracted.
"This volume is idle" is trivia. "…and it costs $41 a month" is a decision. That second half comes from here.
AWS price data ships as a compressed artifact inside the repository, so MaxOps works offline — but it is never unpacked behind your back. You choose, on this screen.
Always enabled. The only ungated button in the wizard.
What the click writes# 1. progress, persisted server-side onboarding_step = "role" # 2. then the browser navigates → /onboarding?step=role
The extract looks optional. Can I just… skip it?
You can — Get Started won't stop you. But then I run blind on price: findings arrive with no cost and no savings attached. It takes seconds. Do it now.
There is nothing on this screen you can get wrong, so nothing blocks you. If you do skip it, the button and badge stay on this screen — come back any time and extract, then re-run the checks.
I can't peek at a single instance until AWS says I may! So let's make you a key — a friendly one that only ever turns one way: read.
Role is the identity MaxOps assumes. Policy is the inline permission
document attached to it. Actions counts the distinct API calls it allows — 87 of them
across 11 groups, and every single one is a List, Get, or Describe.
No Create. No Modify. No Delete. CUR export setup, S3 writes, and
remediation actions are deliberately left out.
There are two routes to that key, and a button for each.
↳ Resolve AWS account for profile failed (ExpiredToken): …
Where does this list come from, and what's the number in brackets?
Your own local AWS profiles — the ones in ~/.aws/config and ~/.aws/credentials. I read their names, then ask AWS who each one is. That answer is the number in brackets.
default entry, using whatever credentials the environment provides.{
"Sid": "AllowCurrentMaxOpsCaller",
"Effect": "Allow",
"Principal": {
"AWS": "<the profile you picked>"
},
"Action": "sts:AssumeRole"
}
Nobody outside this statement can assume the role.
That dropdown does not choose which account gets scanned. It chooses the credentials that do the setup work — the identity that makes the key.
iam:CreateRole and iam:PutRolePolicy, or Create Role will fail. If your day-to-day profile is read-only, take the escape hatch three panels along.And if I change the dropdown after I've already made a role?
The success card clears and Continue goes back to grey — on purpose. Different profile can mean a different account and a different trusted principal, so the key has to be cut again. Re-picking the value it already had is harmless: I compare old and new, and do nothing when they match.
[profile MaxOpsReadOnlyRole]
role_arn = arn:aws:iam::123456789012:role/MaxOpsReadOnlyRole
region = us-east-1
source_profile = maxops
sts:GetCallerIdentity to learn who you are and which account you're in.iam:CreateRole for MaxOpsReadOnlyRole — 1-hour max session, a description, tags ManagedBy=MaxOps and MaxOpsAccess=ReadOnlyScan. If it already exists it is not duplicated — the trust policy is updated instead and the badge reads Updated.MaxOpsReadOnlyScanPolicy on it — those 87 read-only actions.MaxOpsReadOnlyRole profile into your ~/.aws/config, pointing at the new ARN with your selected profile as its source.IAM is eventually consistent. For a few seconds a brand-new role still draws AccessDenied from some endpoints — and onboarding is about to fire a hundred checks. If the button seems to pause at the end, that pause is doing you a favour.
Saves maxops-read-only-scan-policy.json to your Downloads folder.
{
"Version": "2012-10-17",
"Statement": [
{ "Sid": "Ec2EbsVpcRead",
"Effect": "Allow",
"Action": [ "ec2:DescribeInstances", … ],
"Resource": "*" },
… 10 more read-only groups …
]
}
A browser-side file save. No server call, no AWS call, nothing transmitted anywhere. Click it before, after, or instead of creating a role.
What do I do with a file full of permissions?
The same document is on screen too: Permission groups lists each of the 11 blocks with its actions and resource scope, and Policy JSON shows the raw text. The download is simply that, as a file.
Dead while the box is empty or the text isn't a valid role ARN.
Malformed inputEnter a full IAM role ARN, e.g. arn:aws:iam::123456789012:role/MyReadOnlyRole.
For everyone whose credentials are read-only. Your admin cuts the key from the downloaded policy — or points you at one that already exists — and you paste its ARN here. I make zero IAM writes on this path. No role created, no policy attached, nothing in your account modified.
:role/, a name. Paths like role/team/Reader and partitions like aws-us-gov are fine. Get it wrong and a red line appears under the box while the button stays dead.iam:GetRole. A definitive "no such role" is reported; a permissions failure on the lookup itself is tolerated and left to the next test.sts:AssumeRole attempt. If the role's trust policy doesn't allow your selected profile, you're told now, not an hour later when every check fails.MaxOpsReadOnlyRole profile and waits for propagation, exactly as the create path does.The result card's badge reads Using existing role for this route.
This is the read-only scan profile MaxOps just set up — it can't create or update IAM resources. Pick a different profile to re-create the role.
Bottom of the screenAfter success the dropdown switches itself to MaxOps
And Create Role greyed out at the same moment.
Because that profile is read-only by design — using it to write IAM is a guaranteed failure. The button is saving you the trip. Pick a different profile first if you need to re-cut the key.
Continue stays grey until a role is ready. It enables when any of these is true: Create Role succeeded this session; Use this role succeeded this session; or you're returning to a session where a role was already saved — both a scan profile name and a role ARN on record. It switches back off the moment you select a genuinely different AWS profile.
Back returns to Information and saves progress on the way. The profile you picked is remembered, and a role you already created stays created.
Seven preset tiles, pick exactly one — clicking a second moves the selection rather than adding to it. This is a label for the workspace, not a filter: it does not restrict which resources get scanned. It's how you tell this MaxOps workspace apart from the next one.
Need something the presets don't cover — "eu-payments-prod"? Click Use a custom environment and the tiles become a text box; the link then reads Choose from standard environments to go back. Careful — toggling clears both the tile selection and the typed text, so re-enter your choice after switching.
Usually already filled in when you arrive.
RegionsAccount — the 12-digit AWS account ID this workspace covers. If step 2 resolved an account (it almost always does) MaxOps auto-fills it here and clears any prior error. It re-applies even if you typed over it, so the field agrees with the role you just set up. Validation is strict: exactly twelve digits. Anything else keeps Continue grey and, on submit, shows "Enter a valid 12-digit AWS account ID."
You can type a different account number — but if you do, make sure the IAM role I use actually has access to that account. Changing the digits doesn't change the key.
Should I just tick everything to be safe?
Checks run per region — every extra one is more API calls and a longer first scan. Start with the regions you actually run in; adding more later is one click in Settings.
→ draft saved environment = "Production" account = "123456789012" regions = ["us-east-1", "us-west-2"] # and once more when you navigate away
About half a second after you stop typing, I quietly save a draft — environment, account, regions. Once more when you navigate away. That's why Back and forward doesn't clear the form, and a reload picks up where you were.
Continue needs all three at once:
It's also disabled while the save is in flight, so a double-click can't submit twice. Back returns to the IAM Role step and is disabled during that same save.
✓ ec2-idle-instances 4 findings ✓ ebs-unattached-volumes 11 findings … s3-lifecycle-policy running (slow ≠ broken) ✓ rds-rightsizer 2 findings ✗ es-domain-idle attempt 1/3, retrying in 2s
The step strip disappears. Settings saved. I start immediately — you finish onboarding with real findings, not an empty screen.
Savings surfaced. Evidence attached. View Dashboard is one click away — and the wizard never asks again.
When the run finishes you get a summary of what was found and a button through to the dashboard where the real work starts. Thresholds, which checks are enabled, and everything else now live under Settings.
Read-only the whole way. I can show my security team every line.
One question every wizard raises: why is that button grey? Here's every answer.
| Screen | Button | Enabled when | Greyed out when |
|---|---|---|---|
| Information | Get Started | Always — there is no gate on this screen. | Never. |
| Information | Extract Pricing DB | A bundled artifact exists and hasn't been unpacked yet. | Hidden entirely once the database is ready, or if there's no artifact to unpack. |
| IAM Role | Create Role | Profiles have loaded and the selected profile isn't the read-only MaxOps scan profile. | While profiles load, while a creation is in flight, or when the read-only scan profile is selected. |
| IAM Role | Download JSON | Always — a local file save with no prerequisites. | Never. |
| IAM Role | Use this role | The box holds text matching a full IAM role ARN. | Empty box, malformed ARN, or a registration already running. |
| IAM Role | Continue | A role is ready — created or registered this session, or already saved from a previous one. | No role yet, or you switched to a different AWS profile, which resets readiness. |
| Account Settings | Continue | Environment chosen and account exactly 12 digits and at least one region. | Any of those unmet, or while the settings are being saved. |
| Any step | Back | Always — and your progress is saved on the way back. | During submission only. |
Every error here is telling you something specific. Read the message, not the vibe.
I couldn't resolve that profile's identity — expired SSO session, stale keys, or no network. Refresh
the credentials (aws sso login, or new keys) and reload the page. The precise reason is
printed under the dropdown.
Almost always the selected profile lacking iam:CreateRole or iam:PutRolePolicy.
Either pick a profile that can write IAM, or take the Download JSON → admin creates it → paste
the ARN route.
The pasted text isn't a role ARN. Look for a stray space, a truncated copy, or an ARN for something
other than a role. Shape: arn:aws:iam::123456789012:role/MyReadOnlyRole.
The role exists, but its trust policy doesn't let your selected profile in. Ask whoever owns the role to add your identity as a trusted principal — or select the profile that is trusted.
Well-formed ARN pointing at nothing. Usually a typo in the role name, or the wrong account number.
The circuit breaker. Three identical failures means something structural, not a blip — most often a permission the role is missing, or credentials that expired mid-run. Read the repeated message, fix that one thing, and re-run the checks from the dashboard. You don't have to redo onboarding.
The pricing database was never extracted. Go back to /onboarding?step=information, click
Extract Pricing Database, and re-run the checks.
Keep this issue open beside the app the first time through — every control in the product has a panel here.