Accounts
Every AWS account Cloudblame reads with the read-only role, and when it last read each one. Reading runs on its own.
Connected accounts
One read-only role per account. Cloudblame reads; it never creates, changes or deletes anything in AWS.
Automatic investigations: the engine investigates priced events and metric spikes on its own, up to the daily cap per account (1 to 50).
To revoke access, delete the cloudblame-readonly stack in the AWS account; that removes the role.