/////TECHNICAL REFERENCE

[378 DETECTORS]

VERSIONED TECHNICAL DOCUMENTATION

ArthaOps Technical Reference Hub

Exhaustive versioned technical specifications, IAM AssumeRole CloudFormation templates, 3-tier math benchmarking methodology, and stable detector taxonomy index.

Documentation Version:

Article Lifecycle: CURRENT (Production Build)

NAVIGATE:1. Architecture 2. IAM CloudFormation 3. Detector Taxonomy 4. 3-Tier Math 5. REST API Specs 6. Downloads

1. Zero-Trust Architecture & STS Delegation Model

ArthaOps operates under a strict zero-trust, read-only telemetry ingestion mandate. Credentials are never persistently stored on ArthaOps servers. Cross-account access is established strictly via AWS Security Token Service (STS) AssumeRole using cryptographically generated 256-bit random ExternalIDs.

Temporal Sovereignty

All timestamps are stored in UTC at the database layer. Localized refraction occurs exclusively at the presentation layer using sovereign time helpers (`get_sovereign_now()`).

Financial Refraction

Monetary values convert from USD → INR at the presentation layer using the platform sovereign FX rate (default 84.0), ensuring 100% localization parity across India enterprise reporting.

Deterministic Rollback

Every Autopilot remediation action records complete pre-execution metadata snapshot states to enable verified 1-click deterministic rollback where supported.

2. Deployable CloudFormation & IAM Policy Specification

Deploy this official CloudFormation stack in your AWS master management account or target target accounts. It provisions a zero-trust IAM Role bound to the ArthaOps production engine using your unique ExternalID.

arthaops-sovereign-read-only.template.yamlVERIFIED AWS IAM FORMAL SPEC (2012-10-17)

AWSTemplateFormatVersion: '2010-09-09'
Description: 'ArthaOps Sovereign Read-Only & STS Autopilot Role Delegation Template v3.3'

Parameters:
  ArthaOpsAccountId:
    Type: String
    Default: '730335345759'
    Description: 'ArthaOps Production SaaS AWS Account ID'
  ExternalId:
    Type: String
    Description: 'Cryptographically generated random ExternalID provided in ArthaOps Console'
  EnableAutopilotRemediation:
    Type: String
    Default: 'false'
    AllowedValues: ['true', 'false']
    Description: 'Allow governed 1-click remediation actions via STS AssumeRole'

Conditions:
  AutopilotEnabled: !Equals [!Ref EnableAutopilotRemediation, 'true']

Resources:
  ArthaOpsIntegrationRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub 'ArthaOps-Sovereign-Role-${AWS::Region}'
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${ArthaOpsAccountId}:root'
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalId

  ArthaOpsReadOnlyPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: 'ArthaOps-ReadOnly-Telemetry-Policy'
      Roles:
        - !Ref ArthaOpsIntegrationRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'ce:GetCostAndUsage'
              - 'ce:GetCostForecast'
              - 'ce:GetDimensionValues'
              - 'cloudwatch:GetMetricData'
              - 'cloudwatch:GetMetricStatistics'
              - 'ec2:DescribeInstances'
              - 'ec2:DescribeVolumes'
              - 'ec2:DescribeSnapshots'
              - 'rds:DescribeDBInstances'
              - 's3:ListAllMyBuckets'
              - 's3:GetBucketTagging'
              - 'eks:ListClusters'
              - 'tag:GetResources'
            Resource: '*'

Outputs:
  RoleArn:
    Description: 'ARN of the generated ArthaOps IAM Role. Paste into ArthaOps onboarding screen.'
    Value: !GetAtt ArthaOpsIntegrationRole.Arn
  ExternalIdVerified:
    Description: 'ExternalID applied for zero-trust cross-account validation.'
    Value: !Ref ExternalId

3. Searchable Detector Taxonomy Index (378 Detectors)

Canonical stable IDs (DET-XXX-NNN) are immutable and deterministic. Filter by category or search by keyword.

DET-RDS-104Idle RDS Database Instance DetectorRDS(Introduced in v1.0)

SEVERITY: CRITICAL

Problem: Unused RDS database instances running 24/7 without active client connections.

P95 Rolling Window:

720 Continuous Hours (30 Days)

Evaluation Signal Profile:

Multi-Signal Profile: Zero client connections correlated with continuous compute & IOPS idle envelope

Deterministic Rollback:

1-Click Start RDS Instance from final DB snapshot metadata.

DET-EBS-102Unattached EBS Volume DetectorEBS(Introduced in v1.0)

SEVERITY: HIGH

Problem: Orphaned EBS volumes remaining in 'available' state after EC2 instance termination.

P95 Rolling Window:

336 Hours (14 Days)

Evaluation Signal Profile:

Multi-Signal Profile: Unattached volume state exceeding organizational retention baseline

Deterministic Rollback:

1-Click Create EBS Volume from saved snapshot ID.

DET-EC2-103Overprovisioned EC2 Sizing DetectorEC2(Introduced in v1.0)

SEVERITY: HIGH

Problem: EC2 instances operating at under 5% CPU & memory utilization.

P95 Rolling Window:

336 Hours (14 Days)

Evaluation Signal Profile:

Multi-Signal Profile: Sub-5% compute & memory utilization envelope against instance family baseline

Deterministic Rollback:

1-Click Revert EC2 Instance Type back to original size.

DET-S3-201Incomplete Multipart Upload Storage LeakS3(Introduced in v1.0)

SEVERITY: MEDIUM

Problem: Aborted S3 upload parts accumulating invisibly in S3 buckets without lifecycle rules.

P95 Rolling Window:

168 Hours (7 Days)

Evaluation Signal Profile:

Multi-Signal Profile: Stale uncommitted upload parts lacking automated bucket lifecycle abort rules

Deterministic Rollback:

Lifecycle rule update is non-destructive and easily modified.

DET-EKS-302Underutilized EKS Managed Node GroupEKS(Introduced in v1.1)

SEVERITY: CRITICAL

Problem: Kubernetes worker nodes running at < 15% pod request capacity across node group.

P95 Rolling Window:

168 Hours (7 Days)

Evaluation Signal Profile:

Multi-Signal Profile: Node group allocatable compute significantly exceeding workload request density

Deterministic Rollback:

1-Click Scale NodeGroup min/max boundaries back to previous size.

DET-IAM-401Unused IAM Access Key & Privilege LeakIAM(Introduced in v1.1)

SEVERITY: HIGH

Problem: Active IAM access keys with zero API activity for over 90 days.

P95 Rolling Window:

2160 Hours (90 Days)

Evaluation Signal Profile:

Multi-Signal Profile: Active credential status with zero CloudTrail API activity over 90 days

Deterministic Rollback:

1-Click Reactivate IAM Access Key.

DET-NET-501Unattached Elastic IP Address LeakNetworking(Introduced in v1.1)

SEVERITY: LOW

Problem: Elastic IP addresses allocated in AWS account but not attached to any EC2 or ENI.

P95 Rolling Window:

24 Hours

Evaluation Signal Profile:

Multi-Signal Profile: Allocated public IPv4 address with null network interface association

Deterministic Rollback:

Allocate new Elastic IP address (IP address string may change).

DET-GOV-601Unallocated Cost Tag Governance LeakGovernance(Introduced in Latest)

SEVERITY: MEDIUM

Problem: High-spend cloud resources missing required environment or cost-center tags.

P95 Rolling Window:

Real-time

Evaluation Signal Profile:

Multi-Signal Profile: Resource metadata missing required organizational cost-allocation tags

Deterministic Rollback:

1-Click Revert Resource Tags to prior state.

DET-ML-701Idle SageMaker Real-Time EndpointAI/ML(Introduced in Latest)

SEVERITY: CRITICAL

Problem: Provisioned SageMaker multi-model endpoints receiving zero invocations for 14 days.

P95 Rolling Window:

336 Hours (14 Days)

Evaluation Signal Profile:

Multi-Signal Profile: Provisioned ML inference endpoint with sustained zero invocation telemetry

Deterministic Rollback:

1-Click Re-deploy SageMaker Endpoint from saved EndpointConfig.

DET-AZ-001Deallocated Azure VM Attached Resource LeakAzure(Introduced in Latest)

SEVERITY: HIGH

Problem: Deallocated Azure VMs still retaining premium OS and data disks, static public IPs, and NSGs.

P95 Rolling Window:

336 Hours (14 Days)

Evaluation Signal Profile:

Multi-Signal Profile: VM powerState/deallocated with active attached premium storage volumes

Deterministic Rollback:

1-Click Restore Azure VM and reattach Managed Disks from ARM template.

DET-GCP-004Unattached Persistent Disk LeakGCP(Introduced in Latest)

SEVERITY: MEDIUM

Problem: Zonal and regional persistent disks in READY state with zero attached Compute Engine instances.

P95 Rolling Window:

168 Hours (7 Days)

Evaluation Signal Profile:

Multi-Signal Profile: Persistent disk users array empty exceeding project retention window

Deterministic Rollback:

1-Click Recreate Persistent Disk from GCS disk snapshot.

DET-K8S-001Overprovisioned Pod CPU & Memory Request BoundsK8s(Introduced in Latest)

SEVERITY: HIGH

Problem: Kubernetes pod CPU and memory requests exceed observed p95 usage by over 300%, starving cluster capacity.

P95 Rolling Window:

336 Hours (14 Days)

Evaluation Signal Profile:

Multi-Signal Profile: container_requested_cpu > 3.0 * container_p95_actual_cpu across running replicas

Deterministic Rollback:

1-Click Revert Kubernetes deployment to previous replica revision.

DET-OCI-001Idle OCI Compute Instance Envelope DetectorOCI(Introduced in Latest)

SEVERITY: HIGH

Problem: Unutilized Oracle Cloud Infrastructure VM/Bare Metal compute instances running continuously without VNIC network throughput.

P95 Rolling Window:

336 Hours (14 Days)

Evaluation Signal Profile:

Multi-Signal Profile: max(cpu_utilization_p95) < 3% AND sum(vnic_octets_total) < 50MB

Deterministic Rollback:

1-Click Start OCI Compute Instance via standard OCI API.

4. 3-Tier Telemetry & Sovereign Financial Mathematics

Every metric displayed across ArthaOps is visually tagged to distinguish direct telemetry from derivative calculations and cryptographic audit signatures:

[MEASURED TELEMETRY]Direct Cloud API Ingestion

Direct CloudWatch & Cost Explorer API values (e.g. CPU < 0.8%, zero DB connections, 0 active IOPS).

[CALCULATED METRIC]P95 Windowing Math

Deterministic computation & P95/P99 rolling window math (e.g. 720 continuous hours idle).

[ESTIMATED ROI]Sovereign Spend Recovery

Modeled monthly financial spend waste recovery (e.g. ₹18,480/mo waste leak converted at sovereign FX rate).

[SHA-256 AUDIT CERTIFICATE]SHA-256 Execution Proof

SHA-256 forensic execution verification certificate generated upon every automated action.

5. REST API & OpenAPI 3.0 Specifications (Latest)

All ArthaOps platform endpoints return predictable { status: "ok", data: { ... } } JSON structures with strict rate-limiting and Bearer JWT token contracts.

POST/api/v1/scan/instant

Rate Limit: 10 requests / minute

Trigger Instant Telemetry Scan

Initiates an on-demand 378-detector waste scan across all connected cloud accounts.

Example JSON Response (200 OK)Available since v1.0

{
  "status": "ok",
  "data": {
    "scan_id": "scan_8f9a2b1c",
    "detectors_evaluated": 378,
    "waste_detected_inr": 48250.00,
    "execution_time_ms": 2840,
    "findings_count": 14
  }
}

GET/api/v1/findings

Rate Limit: 60 requests / minute

List Active Waste Findings

Returns paginated list of active financial waste leaks with sovereign FX conversion.

Example JSON Response (200 OK)Available since v1.0

{
  "status": "ok",
  "data": {
    "total": 14,
    "items": [
      {
        "id": "fnd_rds_104_8f",
        "stable_id": "DET-RDS-104",
        "title": "Idle RDS Database Instance",
        "severity": "CRITICAL",
        "monthly_waste_usd": 220.00,
        "monthly_waste_inr": 18480.00,
        "confidence": 0.98,
        "action_type": "STS_AUTOMATED_STOP"
      }
    ]
  }
}

GET/api/v1/governance/economics

Rate Limit: 30 requests / minute

Platform Financial Economics

Retrieves aggregate cloud spend efficiency, realized savings, and ROI multiplier metrics.

Example JSON Response (200 OK)Available since v1.1

{
  "status": "ok",
  "data": {
    "total_spend_monitored_inr": 14250000.00,
    "realized_savings_inr": 1840000.00,
    "roi_multiplier": 14.8,
    "active_detectors": 378
  }
}

GET/api/v1/trust/certificate/{id}

Rate Limit: 120 requests / minute

Fetch Cryptographic Audit Proof

Retrieves SHA-256 Merkle root verification certificate for any executed remediation action.

Example JSON Response (200 OK)Available since Latest

{
  "status": "ok",
  "data": {
    "certificate_id": "cert_merkle_9f82a1",
    "timestamp": "2026-08-11T14:30:00Z",
    "merkle_root": "MERKLE_ROOT_VERIFIED",
    "action_executed": "EBS_SNAPSHOT_AND_DELETE",
    "signature_algorithm": "ED25519"
  }
}

6. Enterprise Policy & Proof Asset Download Center

Download representative sample audit reports, deployable CloudFormation policies, and forensic proof certificates.

Executive Multi-Cloud & AI FinOps Optimization Report

Demonstrates executive summary layout, spend breakdown, and monthly waste recovery roadmap across AWS, Azure, GCP, and K8s.

Download PDF (Representative Sample)

Cryptographic Audit Ledger Export

Illustrates JSON structure of hash-chained audit events, actor sign-offs, and state transitions.

Download JSON (Test Environment Output)

AWS STS Least-Privilege IAM Policy Template

CloudFormation / Terraform template defining exact AssumeRole read-only permissions.

Download JSON (Test Environment Output)

Azure ARM Reader Least-Privilege Role Definition

Bicep / Terraform definition granting read-only inspection across Azure Subscriptions and Management Groups.

Download JSON (Test Environment Output)

GCP Workload Identity Least-Privilege Binding

Terraform template configuring short-lived credential exchange for GCP Resource Manager and Compute viewer.

Download JSON (Test Environment Output)

Kubernetes Read-Only ClusterRole Manifest

Standard Kubernetes YAML manifest defining read-only ClusterRole for pods, PVCs, nodes, and daemonsets.

Download JSON (Test Environment Output)

Multi-Cloud Agentless Architecture & Data Flow Diagram

Visualizes network boundaries, AWS STS, Azure ARM, GCP Workload Identity, K8s RBAC, and AP-SOUTH-1 hosting.

Download PNG (Representative Sample)

View Public Engineering Changelog

AWSTemplateFormatVersion: '2010-09-09' Description: 'ArthaOps Sovereign Read-Only & STS Autopilot Role Delegation Template v3.3' Parameters: ArthaOpsAccountId: Type: String Default: '730335345759' Description: 'ArthaOps Production SaaS AWS Account ID' ExternalId: Type: String Description: 'Cryptographically generated random ExternalID provided in ArthaOps Console' EnableAutopilotRemediation: Type: String Default: 'false' AllowedValues: ['true', 'false'] Description: 'Allow governed 1-click remediation actions via STS AssumeRole' Conditions: AutopilotEnabled: !Equals [!Ref EnableAutopilotRemediation, 'true'] Resources: ArthaOpsIntegrationRole: Type: 'AWS::IAM::Role' Properties: RoleName: !Sub 'ArthaOps-Sovereign-Role-${AWS::Region}' MaxSessionDuration: 3600 AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: AWS: !Sub 'arn:aws:iam::${ArthaOpsAccountId}:root' Action: 'sts:AssumeRole' Condition: StringEquals: 'sts:ExternalId': !Ref ExternalId ArthaOpsReadOnlyPolicy: Type: 'AWS::IAM::Policy' Properties: PolicyName: 'ArthaOps-ReadOnly-Telemetry-Policy' Roles: - !Ref ArthaOpsIntegrationRole PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - 'ce:GetCostAndUsage' - 'ce:GetCostForecast' - 'ce:GetDimensionValues' - 'cloudwatch:GetMetricData' - 'cloudwatch:GetMetricStatistics' - 'ec2:DescribeInstances' - 'ec2:DescribeVolumes' - 'ec2:DescribeSnapshots' - 'rds:DescribeDBInstances' - 's3:ListAllMyBuckets' - 's3:GetBucketTagging' - 'eks:ListClusters' - 'tag:GetResources' Resource: '*' Outputs: RoleArn: Description: 'ARN of the generated ArthaOps IAM Role. Paste into ArthaOps onboarding screen.' Value: !GetAtt ArthaOpsIntegrationRole.Arn ExternalIdVerified: Description: 'ExternalID applied for zero-trust cross-account validation.' Value: !Ref ExternalId

4. 3-Tier Telemetry & Sovereign Financial Mathematics

Every metric displayed across ArthaOps is visually tagged to distinguish direct telemetry from derivative calculations and cryptographic audit signatures:

[MEASURED TELEMETRY]Direct Cloud API Ingestion

Direct CloudWatch & Cost Explorer API values (e.g. CPU < 0.8%, zero DB connections, 0 active IOPS).

[CALCULATED METRIC]P95 Windowing Math

Deterministic computation & P95/P99 rolling window math (e.g. 720 continuous hours idle).

[ESTIMATED ROI]Sovereign Spend Recovery

Modeled monthly financial spend waste recovery (e.g. ₹18,480/mo waste leak converted at sovereign FX rate).

[SHA-256 AUDIT CERTIFICATE]SHA-256 Execution Proof

SHA-256 forensic execution verification certificate generated upon every automated action.

5. REST API & OpenAPI 3.0 Specifications (Latest)

All ArthaOps platform endpoints return predictable { status: "ok", data: { ... } } JSON structures with strict rate-limiting and Bearer JWT token contracts.

POST/api/v1/scan/instant

Rate Limit: 10 requests / minute

Trigger Instant Telemetry Scan

Initiates an on-demand 378-detector waste scan across all connected cloud accounts.

Example JSON Response (200 OK)Available since v1.0

{
  "status": "ok",
  "data": {
    "scan_id": "scan_8f9a2b1c",
    "detectors_evaluated": 378,
    "waste_detected_inr": 48250.00,
    "execution_time_ms": 2840,
    "findings_count": 14
  }
}

GET/api/v1/findings

Rate Limit: 60 requests / minute

List Active Waste Findings

Returns paginated list of active financial waste leaks with sovereign FX conversion.

Example JSON Response (200 OK)Available since v1.0

{
  "status": "ok",
  "data": {
    "total": 14,
    "items": [
      {
        "id": "fnd_rds_104_8f",
        "stable_id": "DET-RDS-104",
        "title": "Idle RDS Database Instance",
        "severity": "CRITICAL",
        "monthly_waste_usd": 220.00,
        "monthly_waste_inr": 18480.00,
        "confidence": 0.98,
        "action_type": "STS_AUTOMATED_STOP"
      }
    ]
  }
}

GET/api/v1/governance/economics

Rate Limit: 30 requests / minute

Platform Financial Economics

Retrieves aggregate cloud spend efficiency, realized savings, and ROI multiplier metrics.

Example JSON Response (200 OK)Available since v1.1

{
  "status": "ok",
  "data": {
    "total_spend_monitored_inr": 14250000.00,
    "realized_savings_inr": 1840000.00,
    "roi_multiplier": 14.8,
    "active_detectors": 378
  }
}

GET/api/v1/trust/certificate/{id}

Rate Limit: 120 requests / minute

Fetch Cryptographic Audit Proof

Retrieves SHA-256 Merkle root verification certificate for any executed remediation action.

Example JSON Response (200 OK)Available since Latest

{
  "status": "ok",
  "data": {
    "certificate_id": "cert_merkle_9f82a1",
    "timestamp": "2026-08-11T14:30:00Z",
    "merkle_root": "MERKLE_ROOT_VERIFIED",
    "action_executed": "EBS_SNAPSHOT_AND_DELETE",
    "signature_algorithm": "ED25519"
  }
}

6. Enterprise Policy & Proof Asset Download Center

Download representative sample audit reports, deployable CloudFormation policies, and forensic proof certificates.

Executive Multi-Cloud & AI FinOps Optimization Report

Demonstrates executive summary layout, spend breakdown, and monthly waste recovery roadmap across AWS, Azure, GCP, and K8s.

Download PDF (Representative Sample)

Cryptographic Audit Ledger Export

Illustrates JSON structure of hash-chained audit events, actor sign-offs, and state transitions.

Download JSON (Test Environment Output)

AWS STS Least-Privilege IAM Policy Template

CloudFormation / Terraform template defining exact AssumeRole read-only permissions.

Download JSON (Test Environment Output)

Azure ARM Reader Least-Privilege Role Definition

Bicep / Terraform definition granting read-only inspection across Azure Subscriptions and Management Groups.

Download JSON (Test Environment Output)

GCP Workload Identity Least-Privilege Binding

Terraform template configuring short-lived credential exchange for GCP Resource Manager and Compute viewer.

Download JSON (Test Environment Output)

Kubernetes Read-Only ClusterRole Manifest

Standard Kubernetes YAML manifest defining read-only ClusterRole for pods, PVCs, nodes, and daemonsets.

Download JSON (Test Environment Output)

Multi-Cloud Agentless Architecture & Data Flow Diagram

Visualizes network boundaries, AWS STS, Azure ARM, GCP Workload Identity, K8s RBAC, and AP-SOUTH-1 hosting.

Download PNG (Representative Sample)