Your Cloud, Your Keys
Planton does not need a long-lived key to your cloud. Keyless connections exchange a short-lived token for temporary credentials at the moment of use; where a credential is stored, it is a managed secret resolved just in time. Every module is open source, and your manifests leave with you.
For the team that will not hand a vendor a long-lived credential, and wants to know what leaves their account.
What You Get
Shipped behavior, stated as it works today. The record beside it is the shape of what the product stamps; its figures are examples.
Keyless Connections
Connections can be keyless: a short-lived, connection-scoped identity token is minted at the moment of use and exchanged by the cloud for temporary credentials. Nothing is stored, nothing is rotated, and the trust is yours to revoke.
Open Source, and the Way Out
Every infrastructure module is open source under Apache 2.0. If you leave, you take your manifests and keep deploying them with the open-source CLI.
Secrets on the Desktop
On the desktop, secrets are encrypted locally with the key in your OS keychain and resolved on the runner at the moment of use.
Hosted, Self-Hosted, or Desktop: One Model
The same manifests and the same model run on all three shapes, so nothing is redone when a person becomes a team.
Connection · AWS production
mode
keyless
stored credential
none
at deploy time
short-lived identity token · scoped to this connection · exchanged by AWS for temporary credentials
trust
an IAM role in your account that trusts Planton’s issuer · yours to revoke
rotation
nothing to rotate
modules
open source · Apache 2.0 · github.com/plantonhq/planton
An illustration of the record the product shows. Broker-issued credentials (your own vault) are the other keyless mode.
What We Will Not Say
The words this page holds itself to, so a reviewer does not have to find the over-claim.
- Your account, your keys, your state, your bill. Planton holds the record and the manifests; the infrastructure is yours in your provider’s console the whole time.
- Where a connection stores a credential, it is a managed secret: resolved on the runner at the moment of use, never copied into a manifest, a record, or a log.
- The exit is concrete: your manifests, and the open-source CLI that deploys them. It is not a badge.
Read Next
Verified Before Deploy
Before anything is created, Planton states the monthly cost with its coverage, the least-privilege permissions, and the controls each kind enforces.
What It Proves →Security Posture
Seventeen technical controls with evidence per kind, crosswalked to four frameworks, stated honestly: a kind enforces controls; it is never called compliant.
What It Proves →