What is built and what is verified
Limen is tested thoroughly against local stand-ins: Dex for the identity provider, containers for databases and brokers, a local S3 and KMS, a fake Datadog intake. Nothing has been verified against real AWS, Okta, or Datadog yet. Each gap below has a “Verify” issue in the Real-environment verification milestone.
built means it works and is tested locally. unverified means a cloud or vendor-specific path is written but has not met the real service. planned means not built.
Connect
Section titled “Connect”| Capability | Status | Unverified or missing |
|---|---|---|
| SSH with recording and replay | built | |
| PostgreSQL, MySQL | built | RDS and Aurora IAM tokens; Redshift credential APIs |
| Redis and Valkey | built | ElastiCache IAM; cluster mode and Serverless are not built |
| Kubernetes (impersonation, recorded exec) | built on kind | unverified on EKS |
| MongoDB | built | Atlas, DocumentDB, MONGODB-AWS |
| OpenSearch, Elasticsearch | built | Amazon OpenSearch Service, Elastic Cloud |
| RabbitMQ, Kafka | built | Amazon MQ, MSK; AMQP 1.0 not built |
| Internal web apps, raw TCP | built |
Identity and workflows
Section titled “Identity and workflows”| Capability | Status | Unverified or missing |
|---|---|---|
| OIDC login, groups to roles | built with Dex | unverified with Okta |
| Bots: GitHub Actions, GitLab CI, any OIDC | built with a stand-in issuer | real CI tokens |
| AWS IAM join for components and bots | planned | Phase 15 |
| Access requests, approvals, break-glass | built | Slack and webhook notifiers against real endpoints |
| Search across audit and recordings | built | link to Athena history |
| Resource discovery | built | against real AWS (EC2, RDS, Redshift, ElastiCache, EKS) |
| Policy tests, who-can, diff, explain | built | |
| One management API: policy from the CLI, the console, or Terraform | planned | Phase 14 (ADR-0042), in progress |
| Access reviews, signed evidence packs | built | PDF evidence pack not built |
| Live session watch | built for SSH | other protocols |
Audit, deploy and operate
Section titled “Audit, deploy and operate”| Capability | Status | Unverified or missing |
|---|---|---|
Signed, hash-chained audit to S3, limen-audit-verify |
built | on real S3 |
| Datadog logs and monitors, Grafana dashboards | built with a fake intake and Trino | real Datadog, real Athena |
| Metrics, OpenTelemetry traces, example alerts | built | |
| Scale-out: several control planes, proxies, workers | built | Kubernetes example on a real cluster |
| Docker Compose stack | built | |
| Terraform for the audit store | built | |
| ECS, EC2 and Kubernetes deploy examples | planned | Phase 15 |
Not claimed
Section titled “Not claimed”- Anything compared with another product. Limen claims properties you can test.
- Compliance outcomes. Evidence packs help an audit; they are not a certification.
- Anything on the roadmap. The roadmap says what is planned, and so does every page that mentions it.
The source of truth is design §14 and the roadmap milestones.