Sleipner uses a read-only role to audit your AWS account. It never makes changes without asking.
Demo — no real account is connected.