Second Brain

runwal-aws-account-798513555087-is-vendor-owned-midnight-dig

3 min read

Runwal AWS account 798513555087 is vendor-owned (Midnight Digital), Runwal has IAM admin only

Runwal AWS account ownership audit — 2026-05-08

Critical finding

The AWS account 798513555087 that Runwal Group operates on is NOT registered to Runwal. It is owned by a third-party vendor.

SurfaceValueImplication
Account name”The Midnight”Vendor-controlled identity
Root emailaws@themidnight.inVendor-controlled mailbox = ultimate super-admin
Account contactSagar GauswamiVendor employee, NOT Runwal staff
Company on fileMidnight Digital Pvt. Ltd.Bhavnagar, Gujarat
Phone9925743801Vendor’s phone
AWS Organizationo-i5kh7q6k2t (this account is the master)Single-account org, vendor is master

Runwal’s actual access level

Runwal’s IAM user (Runwal) has these policies attached:

  • AdministratorAccess (AWS-managed) — full IAM-level admin within the account
  • runwal (custom policy) — purpose-specific
  • IAMUserChangePassword — can change own password
  • AWSBillingReadOnlyAccess — read-only billing (cannot change credit card, cannot redirect invoices)

Other IAM users in the account

UserPoliciesLikely identity
Jay-chavdaAdministratorAccess + Billing (full) + AWSBillingConductorFullAccess + read-only variantsMidnight Digital lead — equal admin powers + full billing control
inso_account_teamBilling + AWSBillingConductorFullAccessThird party (INSO) with billing access
gh-actions(CI automation)GitHub Actions OIDC user
runwal-enterprises-media-181225(Runwal-purpose)Media S3 access
runwal-enterprises-S3(Runwal-purpose)S3 access

What this means in practice

Vendor (Midnight Digital) retains ULTIMATE control even though Runwal has AdministratorAccess:

  1. Root account override: whoever controls aws@themidnight.in can reset Runwal’s password, strip AdministratorAccess, lock Runwal out, transfer the account, or close it.
  2. Billing control: vendor receives all AWS bills; Runwal can only read them, not redirect or modify payment.
  3. Equal-admin override: Jay-chavda (vendor) has equal admin powers — can undo any Runwal action.
  4. Account sovereignty: if vendor relationship sours (billing dispute, contract end, M&A event), vendor retains all leverage over Runwal’s AWS infrastructure.

Action items (prioritized)

PriorityActionWhy
🔴 P0Verify Midnight Digital is formally contracted vendor with signed agreement covering account ownership + data custody + exit clausesWithout contract = uncontrolled exposure
🟠 P1Negotiate root email transfer to Runwal-controlled mailbox (aws-root@runwalgroup.com or similar)Removes vendor’s super-admin override
🟠 P1Inventory what’s in this account (RDS, S3, EC2, secrets, IAM roles, KMS keys)Sizes the blast radius if vendor revokes access
🟡 P2Get full billing access for Runwal user (or dedicated Runwal billing user)Should see + control your own bills
🟡 P2Document who at Midnight Digital controls aws@themidnight.in + Jay-chavda credentialsKnow who has the override key
🟢 P3Strategic: evaluate migration to Runwal-owned AWS accountPermanent sovereignty fix

Probes already run (audit evidence trail)

aws_get_identity                                  → account 798513555087, user/Runwal
iam list-account-aliases                          → [] (no friendly alias)
iam get-user --user-name Runwal                   → CreateDate 2025-10-30, last login 2026-05-08
iam list-attached-user-policies --user-name Runwal → AdministratorAccess + runwal + IAMUserChangePassword + AWSBillingReadOnlyAccess
iam list-users                                    → 6 users (above table)
iam list-attached-user-policies --user-name Jay-chavda     → AdministratorAccess + Billing (full)
iam list-attached-user-policies --user-name inso_account_team → Billing + AWSBillingConductorFullAccess
organizations describe-organization               → master account = self, MasterAccountEmail aws@themidnight.in
organizations list-accounts                       → [798513555087 "The Midnight" aws@themidnight.in]
organizations list-roots                          → r-00w8 (single root)
account get-contact-information                   → Sagar Gauswami / Midnight Digital Pvt. Ltd. / Bhavnagar

Probes NOT yet run (deferred to AJ’s discretion)

  • CloudTrail history — has Jay-chavda made admin changes recently?
  • Service Control Policies on org root — restrictions on Runwal user beyond IAM?
  • account get-alternate-contact — security/billing/operations alternates
  • Resource inventory across services (RDS instances, S3 buckets, EC2 fleet, KMS keys)

Strategic context

This finding is a vendor-sovereignty risk for Runwal Group’s AWS infrastructure. Audit was triggered by AJ’s suspicion that “some vendor purchased this on our behalf and given just the access” — confirmed correct.

Recommend treating this as a Tier-0 governance issue alongside any other vendor-managed infrastructure (CRM, CMS, analytics) that may have similar registration patterns.

Graph View

Backlinks