Free read-only AWS scan

What the AWS scan checks, and what it doesn’t

The scan connects through a read-only IAM role in your AWS account and runs 46 checks. It reads settings and metadata, never the data inside your buckets, databases or secrets. Every check is listed below with the read-only AWS permissions it uses and the framework requirements it gives evidence for.

Start your free AWS scanView the read-only role template

A passing check is evidence for a requirement, not proof that the requirement is met. Where a check gives only “supporting context”, it is relevant to the requirement but never enough on its own. TrustProof prepares and organises your evidence. Your auditor tests it independently and forms their own opinion, and you remain responsible for your controls.

Identity and access

  • IAM users without MFA

    Finds IAM users who do not have multi-factor authentication turned on.

    Read-only permissions
    iam:GenerateCredentialReport, iam:GetCredentialReport
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.312(d)
    • ISO/IEC 27001:2022 Annex A: A.8.5
    • ISO/IEC 20000-1:2018: 8.7.3
    • NIST Cybersecurity Framework 2.0: PR.AA-03
    • APRA CPS 234 Information Security: Para 21
    • Australian Privacy Principles: APP 11.1

  • Root user MFA

    Checks that the AWS account root user has multi-factor authentication turned on.

    Read-only permissions
    iam:GetAccountSummary
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.312(d)
    • ISO/IEC 27001:2022 Annex A: A.8.5
    • ISO/IEC 20000-1:2018: 8.7.3
    • NIST Cybersecurity Framework 2.0: PR.AA-03
    • APRA CPS 234 Information Security: Para 21
    • Australian Privacy Principles: APP 11.1

  • Root user access keys

    Checks that the root user has no active access keys.

    Read-only permissions
    iam:GenerateCredentialReport, iam:GetCredentialReport
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.312(a)(1), §164.312(d)
    • ISO/IEC 27001:2022 Annex A: A.8.2
    • NIST Cybersecurity Framework 2.0: PR.AA-01
    • APRA CPS 234 Information Security: Para 21
    • Australian Privacy Principles: APP 11.1

  • IAM access key rotation

    Finds active IAM user access keys that have not been rotated in the last 90 days.

    Read-only permissions
    iam:GenerateCredentialReport, iam:GetCredentialReport
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.308(a)(3), §164.312(a)(1)
    • ISO/IEC 27001:2022 Annex A: A.8.2
    • NIST Cybersecurity Framework 2.0: PR.AA-01
    • APRA CPS 234 Information Security: supporting context for Para 21

  • IAM password policy

    Checks the account password policy asks for at least 14 characters and blocks reuse of the last 24 passwords.

    Read-only permissions
    iam:GetAccountPasswordPolicy
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.312(d)
    • ISO/IEC 27001:2022 Annex A: A.8.5
    • NIST Cybersecurity Framework 2.0: PR.AA-03
    • APRA CPS 234 Information Security: supporting context for Para 21
    • Australian Privacy Principles: supporting context for APP 11.1

  • IAM Access Analyzer

    Checks an IAM Access Analyzer for external access is set up in each region your account uses.

    Read-only permissions
    access-analyzer:ListAnalyzers
    Supports
    • SOC 2: supporting context for CC6.3
    • HIPAA Security Rule: §164.308(a)(4), §164.312(a)(1)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.3
    • NIST Cybersecurity Framework 2.0: supporting context for PR.AA-05
    • APRA CPS 234 Information Security: supporting context for Para 21
    • Australian Privacy Principles: supporting context for APP 11.1

  • IAM role session length

    Finds IAM roles that allow sessions longer than 4 hours.

    Read-only permissions
    iam:ListRoles
    Supports
    • HIPAA Security Rule: §164.312(a)(2)(iii)

  • Broad IAM permissions

    Reviews IAM user, group and role policies for broad Allow statements (wildcard actions or resources).

    Read-only permissions
    iam:ListUsers, iam:ListGroups, iam:ListRoles, iam:ListUserPolicies, iam:ListGroupPolicies, iam:ListRolePolicies, iam:ListAttachedUserPolicies, iam:ListAttachedGroupPolicies, iam:ListAttachedRolePolicies, iam:GetUserPolicy, iam:GetGroupPolicy, iam:GetRolePolicy, iam:GetPolicy, iam:GetPolicyVersion
    Supports
    Not yet mapped to a framework requirement. Shown as supporting information only.

Data storage and encryption at rest

  • S3 public access

    Checks the account and each bucket for Block Public Access settings, and bucket policies or ACLs that make a bucket public.

    Read-only permissions
    s3:ListAllMyBuckets, s3:GetBucketLocation, s3:GetAccountPublicAccessBlock, s3:GetBucketPublicAccessBlock, s3:GetBucketPolicyStatus, s3:GetBucketAcl
    Supports
    • SOC 2: CC6.1, CC6.7
    • HIPAA Security Rule: §164.312(a)(1)
    • ISO/IEC 27001:2022 Annex A: A.8.3
    • ISO/IEC 20000-1:2018: 8.7.3
    • NIST Cybersecurity Framework 2.0: PR.IR-01
    • APRA CPS 234 Information Security: Para 21
    • Australian Privacy Principles: APP 11.1

  • S3 default encryption

    Checks each S3 bucket has default encryption set.

    Read-only permissions
    s3:ListAllMyBuckets, s3:GetBucketLocation, s3:GetEncryptionConfiguration
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.312(a)(2)(iv)
    • ISO/IEC 27001:2022 Annex A: A.8.24
    • ISO/IEC 20000-1:2018: 7.5
    • ISO/IEC 42001:2023: A.4.3
    • NIST Cybersecurity Framework 2.0: PR.DS-01
    • APRA CPS 234 Information Security: Para 21
    • Australian Privacy Principles: APP 11.1

  • EBS volume encryption

    Checks EBS volumes are encrypted.

    Read-only permissions
    ec2:DescribeVolumes
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.312(a)(2)(iv)
    • ISO/IEC 27001:2022 Annex A: A.8.24
    • NIST Cybersecurity Framework 2.0: PR.DS-01
    • APRA CPS 234 Information Security: supporting context for Para 21
    • Australian Privacy Principles: APP 11.1

  • RDS encryption at rest

    Checks RDS databases and Aurora clusters have storage encryption turned on.

    Read-only permissions
    rds:DescribeDBInstances, rds:DescribeDBClusters
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.312(a)(2)(iv)
    • ISO/IEC 27001:2022 Annex A: A.8.24
    • ISO/IEC 20000-1:2018: 8.7.3
    • NIST Cybersecurity Framework 2.0: PR.DS-01
    • APRA CPS 234 Information Security: Para 21
    • Australian Privacy Principles: APP 11.1

  • KMS key rotation

    Checks your customer-managed KMS keys have automatic rotation turned on.

    Read-only permissions
    kms:ListKeys, kms:DescribeKey, kms:GetKeyRotationStatus
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.312(a)(2)(iv)
    • ISO/IEC 27001:2022 Annex A: A.8.24
    • NIST Cybersecurity Framework 2.0: PR.DS-01
    • APRA CPS 234 Information Security: supporting context for Para 21
    • Australian Privacy Principles: supporting context for APP 11.1

  • Snapshot encryption

    Checks EBS and RDS snapshots you own are encrypted.

    Read-only permissions
    ec2:DescribeSnapshots, rds:DescribeDBSnapshots, rds:DescribeDBClusterSnapshots
    Supports
    • SOC 2: CC6.1
    • HIPAA Security Rule: §164.312(a)(2)(iv)
    • ISO/IEC 27001:2022 Annex A: A.8.24
    • NIST Cybersecurity Framework 2.0: PR.DS-11; supporting context for PR.DS-01
    • APRA CPS 234 Information Security: supporting context for Para 21
    • Australian Privacy Principles: APP 11.1

  • Secrets Manager rotation

    Checks Secrets Manager secrets have rotation turned on. It reads rotation settings only, never secret values.

    Read-only permissions
    secretsmanager:ListSecrets
    Supports
    • SOC 2: supporting context for CC6.1
    • ISO/IEC 27001:2022 Annex A: supporting context for A.5.17
    • NIST Cybersecurity Framework 2.0: supporting context for PR.AA-01

Network exposure

  • RDS public access

    Finds RDS databases and Aurora instances that are set to be publicly accessible.

    Read-only permissions
    rds:DescribeDBInstances, rds:DescribeDBClusters
    Supports
    • SOC 2: CC6.6
    • HIPAA Security Rule: §164.312(a)(1)
    • ISO/IEC 27001:2022 Annex A: A.8.20
    • NIST Cybersecurity Framework 2.0: PR.IR-01
    • APRA CPS 234 Information Security: Para 21
    • Australian Privacy Principles: APP 11.1

  • SSH or RDP open to the internet

    Finds security groups that let anyone on the internet reach SSH (port 22) or Remote Desktop (port 3389).

    Read-only permissions
    ec2:DescribeSecurityGroups
    Supports
    • SOC 2: CC6.6
    • HIPAA Security Rule: §164.312(a)(1)
    • ISO/IEC 27001:2022 Annex A: A.8.20
    • ISO/IEC 20000-1:2018: 8.7.3
    • NIST Cybersecurity Framework 2.0: PR.IR-01
    • APRA CPS 234 Information Security: supporting context for Para 21
    • Australian Privacy Principles: supporting context for APP 11.1

  • Security groups open to the internet

    Finds security groups that allow inbound traffic from anywhere on the internet.

    Read-only permissions
    ec2:DescribeSecurityGroups
    Supports
    • SOC 2: CC6.6
    • HIPAA Security Rule: §164.312(a)(1)
    • ISO/IEC 27001:2022 Annex A: A.8.20
    • NIST Cybersecurity Framework 2.0: PR.IR-01
    • APRA CPS 234 Information Security: Para 21
    • Australian Privacy Principles: supporting context for APP 11.1

  • AWS WAF on public applications

    Checks CloudFront distributions and internet-facing Application Load Balancers have an AWS WAF web ACL, and notes whether Shield Advanced is subscribed.

    Read-only permissions
    cloudfront:ListDistributions, elasticloadbalancing:DescribeLoadBalancers, wafv2:ListWebACLs, wafv2:ListResourcesForWebACL, shield:GetSubscriptionState
    Supports
    • SOC 2: supporting context for CC6.6
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.20
    • NIST Cybersecurity Framework 2.0: supporting context for PR.IR-01
    • APRA CPS 234 Information Security: supporting context for Para 21

  • VPC endpoints

    Checks VPCs that call AWS services have VPC endpoints, so that traffic can stay off the public internet.

    Read-only permissions
    ec2:DescribeVpcs, ec2:DescribeVpcEndpoints
    Supports
    • SOC 2: supporting context for CC6.6
    • NIST Cybersecurity Framework 2.0: supporting context for PR.IR-01

Encryption in transit and certificates

  • S3 HTTPS-only access

    Checks bucket policies refuse requests that do not use HTTPS.

    Read-only permissions
    s3:ListAllMyBuckets, s3:GetBucketLocation, s3:GetBucketPolicy
    Supports
    • SOC 2: CC6.7
    • HIPAA Security Rule: §164.312(e)(1), §164.312(e)(2)(ii)
    • ISO/IEC 27001:2022 Annex A: A.8.24
    • NIST Cybersecurity Framework 2.0: PR.DS-02
    • APRA CPS 234 Information Security: Para 21
    • Australian Privacy Principles: APP 11.1

  • Load balancer HTTPS

    Checks internet-facing load balancers serve HTTPS and redirect plain HTTP to HTTPS.

    Read-only permissions
    elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeListeners
    Supports
    • SOC 2: CC6.7
    • HIPAA Security Rule: §164.312(e)(1), §164.312(e)(2)(ii)
    • ISO/IEC 27001:2022 Annex A: A.8.24
    • NIST Cybersecurity Framework 2.0: PR.DS-02
    • APRA CPS 234 Information Security: supporting context for Para 21
    • Australian Privacy Principles: APP 11.1

  • Certificate expiry

    Finds in-use ACM certificates that have expired or expire within 30 days.

    Read-only permissions
    acm:ListCertificates, cloudfront:ListDistributions, elasticloadbalancing:DescribeLoadBalancers
    Supports
    • SOC 2: supporting context for CC6.7
    • HIPAA Security Rule: §164.312(e)(1)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.24
    • NIST Cybersecurity Framework 2.0: supporting context for PR.DS-02

  • TLS version on CloudFront and load balancers

    Checks CloudFront distributions and HTTPS load balancer listeners require TLS 1.2 or later.

    Read-only permissions
    cloudfront:ListDistributions, elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeListeners
    Supports
    • SOC 2: supporting context for CC6.7
    • HIPAA Security Rule: §164.312(e)(1), §164.312(e)(2)(ii)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.24
    • NIST Cybersecurity Framework 2.0: supporting context for PR.DS-02
    • APRA CPS 234 Information Security: supporting context for Para 21
    • Australian Privacy Principles: supporting context for APP 11.1

Logging and monitoring

  • CloudTrail logging

    Checks a CloudTrail trail is recording activity in your account.

    Read-only permissions
    cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus
    Supports
    • SOC 2: CC7.2
    • HIPAA Security Rule: §164.312(b)
    • ISO/IEC 27001:2022 Annex A: A.8.15
    • ISO/IEC 20000-1:2018: 8.2.6, 8.5.1
    • ISO/IEC 42001:2023: A.6.2.8
    • NIST Cybersecurity Framework 2.0: PR.PS-04, DE.CM-03
    • APRA CPS 234 Information Security: Para 23
    • Australian Privacy Principles: APP 11.1

  • CloudTrail coverage and log integrity

    Checks a multi-region trail is logging with log file validation turned on, so changes to log files can be detected.

    Read-only permissions
    cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus, cloudtrail:GetEventSelectors
    Supports
    • SOC 2: CC7.2
    • HIPAA Security Rule: §164.308(a)(1)(ii)(D), §164.312(b)
    • ISO/IEC 27001:2022 Annex A: A.8.15
    • ISO/IEC 42001:2023: A.6.2.8
    • NIST Cybersecurity Framework 2.0: PR.PS-04, RS.AN-07
    • APRA CPS 234 Information Security: Para 23
    • Australian Privacy Principles: supporting context for APP 11.1

  • GuardDuty threat detection

    Checks Amazon GuardDuty is turned on in each region your account uses.

    Read-only permissions
    guardduty:ListDetectors, guardduty:GetDetector
    Supports
    • SOC 2: CC7.2
    • HIPAA Security Rule: §164.308(a)(1)(ii)(D), §164.312(b)
    • ISO/IEC 27001:2022 Annex A: A.8.16
    • ISO/IEC 20000-1:2018: supporting context for 8.6.1, 8.7.3
    • NIST Cybersecurity Framework 2.0: DE.CM-01, DE.CM-09, DE.AE-02
    • APRA CPS 234 Information Security: Para 23
    • Australian Privacy Principles: APP 11.1

  • AWS Config recording

    Checks AWS Config is recording resource changes in each region your account uses.

    Read-only permissions
    config:DescribeConfigurationRecorders, config:DescribeConfigurationRecorderStatus
    Supports
    • SOC 2: CC7.2
    • HIPAA Security Rule: §164.312(b)
    • ISO/IEC 27001:2022 Annex A: A.8.9; supporting context for A.5.9
    • ISO/IEC 20000-1:2018: supporting context for 8.2.5, 8.2.6, 8.5.1
    • ISO/IEC 42001:2023: supporting context for A.4.5
    • NIST Cybersecurity Framework 2.0: ID.AM-02, PR.PS-01, PR.PS-04, DE.CM-09
    • APRA CPS 234 Information Security: Para 20

  • VPC flow logs

    Checks each VPC has flow logs turned on.

    Read-only permissions
    ec2:DescribeVpcs, ec2:DescribeFlowLogs
    Supports
    • SOC 2: CC7.2
    • HIPAA Security Rule: §164.312(b)
    • ISO/IEC 27001:2022 Annex A: A.8.15
    • NIST Cybersecurity Framework 2.0: PR.PS-04, DE.CM-01
    • APRA CPS 234 Information Security: Para 23

  • CloudWatch Logs retention

    Checks CloudWatch Logs log groups have a retention period set, and notes whether they use a customer-managed key. It never reads log events.

    Read-only permissions
    logs:DescribeLogGroups
    Supports
    • SOC 2: supporting context for CC7.2
    • HIPAA Security Rule: §164.312(b)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.15
    • ISO/IEC 42001:2023: supporting context for A.6.2.8
    • NIST Cybersecurity Framework 2.0: supporting context for PR.PS-04

  • AWS Config conformance packs

    Checks at least one AWS Config conformance pack is deployed.

    Read-only permissions
    config:DescribeConformancePacks
    Supports
    • SOC 2: supporting context for CC7.1
    • HIPAA Security Rule: §164.308(a)(8)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.9
    • NIST Cybersecurity Framework 2.0: supporting context for PR.PS-01
    • APRA CPS 234 Information Security: supporting context for Para 27

  • CloudWatch alarms with notifications

    Checks CloudWatch alarms exist with actions that notify someone.

    Read-only permissions
    cloudwatch:DescribeAlarms
    Supports
    • SOC 2: supporting context for CC7.2, A1.1
    • HIPAA Security Rule: §164.308(a)(1)(ii)(D)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.6, A.8.16
    • ISO/IEC 20000-1:2018: supporting context for 8.4.3, 8.6.1, 8.7.1
    • ISO/IEC 42001:2023: supporting context for A.6.2.6
    • NIST Cybersecurity Framework 2.0: supporting context for PR.IR-04, DE.AE-06
    • APRA CPS 234 Information Security: supporting context for Para 23

Backup and recovery

  • AWS Backup plans and recent backups

    Checks AWS Backup has a plan, and that protected resources have a recovery point from the last 7 days.

    Read-only permissions
    backup:ListBackupPlans, backup:GetBackupPlan, backup:ListBackupVaults, backup:ListProtectedResources
    Supports
    • SOC 2: supporting context for A1.2
    • HIPAA Security Rule: §164.308(a)(7)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.13
    • ISO/IEC 20000-1:2018: supporting context for 8.7.2
    • NIST Cybersecurity Framework 2.0: supporting context for PR.DS-11
    • Australian Privacy Principles: supporting context for APP 11.1

  • RDS backups, deletion protection and Multi-AZ

    Checks RDS databases keep automated backups for at least 7 days, have deletion protection on and use Multi-AZ.

    Read-only permissions
    rds:DescribeDBInstances, rds:DescribeDBClusters
    Supports
    • SOC 2: supporting context for A1.2
    • HIPAA Security Rule: §164.308(a)(7), §164.312(c)(1)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.13, A.8.14
    • ISO/IEC 20000-1:2018: supporting context for 8.7.1, 8.7.2
    • NIST Cybersecurity Framework 2.0: supporting context for PR.DS-11, PR.IR-03

  • DynamoDB point-in-time recovery

    Checks DynamoDB tables have point-in-time recovery turned on.

    Read-only permissions
    dynamodb:ListTables, dynamodb:DescribeContinuousBackups
    Supports
    • SOC 2: supporting context for A1.2
    • HIPAA Security Rule: §164.308(a)(7), §164.312(c)(1)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.13
    • ISO/IEC 20000-1:2018: supporting context for 8.7.2
    • NIST Cybersecurity Framework 2.0: supporting context for PR.DS-11

  • S3 bucket versioning

    Checks S3 buckets have versioning turned on.

    Read-only permissions
    s3:ListAllMyBuckets, s3:GetBucketLocation, s3:GetBucketVersioning
    Supports
    • SOC 2: supporting context for A1.2
    • HIPAA Security Rule: §164.308(a)(7), §164.312(c)(1)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.13
    • ISO/IEC 20000-1:2018: supporting context for 7.5, 8.7.2
    • NIST Cybersecurity Framework 2.0: supporting context for PR.DS-11
    • Australian Privacy Principles: supporting context for APP 11.1

Security services and patching

  • Security Hub standards

    Checks AWS Security Hub is turned on with at least one security standard in each region your account uses.

    Read-only permissions
    securityhub:DescribeHub, securityhub:GetEnabledStandards
    Supports
    • SOC 2: supporting context for CC7.1
    • HIPAA Security Rule: §164.308(a)(8)
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.8, A.8.9, A.8.16
    • ISO/IEC 20000-1:2018: supporting context for 8.7.3
    • NIST Cybersecurity Framework 2.0: supporting context for ID.RA-01, PR.PS-01, DE.CM-09, DE.AE-03
    • APRA CPS 234 Information Security: supporting context for Para 23, Para 27

  • Amazon Inspector coverage

    Checks Amazon Inspector vulnerability scanning is turned on and covering your EC2 instances.

    Read-only permissions
    inspector2:BatchGetAccountStatus, inspector2:ListCoverage
    Supports
    • SOC 2: supporting context for CC7.1
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.8
    • NIST Cybersecurity Framework 2.0: supporting context for ID.RA-01, PR.PS-02, DE.CM-09
    • APRA CPS 234 Information Security: supporting context for Para 27

  • Systems Manager managed instances

    Checks EC2 instances are registered and online with AWS Systems Manager, so they can be inventoried and patched.

    Read-only permissions
    ssm:DescribeInstanceInformation
    Supports
    • ISO/IEC 27001:2022 Annex A: supporting context for A.8.8, A.8.18
    • NIST Cybersecurity Framework 2.0: supporting context for PR.PS-02

  • Amazon Macie

    Checks Amazon Macie is turned on in regions where you keep S3 buckets. It never reads Macie findings.

    Read-only permissions
    s3:ListAllMyBuckets, s3:GetBucketLocation, macie2:GetMacieSession
    Supports
    • SOC 2: supporting context for C1.1
    • ISO/IEC 27001:2022 Annex A: supporting context for A.5.12
    • NIST Cybersecurity Framework 2.0: supporting context for ID.AM-07
    • APRA CPS 234 Information Security: supporting context for Para 20
    • Australian Privacy Principles: supporting context for APP 11.1

AI services

  • Bedrock model invocation logging

    Checks Amazon Bedrock model invocation logging is turned on where Bedrock is used. It never reads prompts or responses.

    Read-only permissions
    bedrock:GetModelInvocationLoggingConfiguration
    Supports
    • ISO/IEC 42001:2023: A.6.2.6, A.6.2.8

  • Bedrock guardrails

    Checks Amazon Bedrock guardrails exist where Bedrock is used. It lists guardrails only, not their content.

    Read-only permissions
    bedrock:ListGuardrails
    Supports
    • ISO/IEC 42001:2023: A.9.2

  • AI resource inventory (for information)

    Lists Amazon Bedrock and SageMaker resources (agents, knowledge bases, custom and imported models, endpoints) so you can compare them with your AI system inventory.

    Read-only permissions
    bedrock:ListAgents, bedrock:ListKnowledgeBases, bedrock:ListCustomModels, bedrock:ListImportedModels, bedrock:ListInferenceProfiles, bedrock:ListProvisionedModelThroughputs, sagemaker:ListEndpoints, sagemaker:ListModels
    Supports
    • ISO/IEC 42001:2023: A.4.2

Account settings

  • AWS regions in use (for information)

    Lists the AWS regions where you have S3 buckets, databases, EBS volumes, DynamoDB tables or non-default VPCs, so you can compare them with your data residency commitments.

    Read-only permissions
    ec2:DescribeRegions, s3:ListAllMyBuckets, s3:GetBucketLocation, ec2:DescribeVpcs, ec2:DescribeVolumes, rds:DescribeDBInstances, dynamodb:ListTables
    Supports
    Not yet mapped to a framework requirement. Shown as supporting information only.

  • AWS Artifact agreements

    Checks whether agreements such as the AWS Business Associate Addendum (for HIPAA) have been accepted in AWS Artifact.

    Read-only permissions
    artifact:ListCustomerAgreements
    Supports
    Not yet mapped to a framework requirement. Shown as supporting information only.

  • AWS security contact

    Checks the AWS account has a security alternate contact set. It records only whether one is set, never the contact details.

    Read-only permissions
    account:GetAlternateContact
    Supports
    • SOC 2: supporting context for CC7.4
    • ISO/IEC 27001:2022 Annex A: supporting context for A.5.24
    • APRA CPS 234 Information Security: supporting context for Para 23

Other read-only permissions in the role

The role also grants these read-only permissions, which no single check above uses. None of them can change anything in your account.

  • ec2:DescribeRegions

    Finds which AWS regions your account has turned on, so regional checks read every one.

  • guardduty:ListFindings, guardduty:GetFindings

    Reads GuardDuty finding summaries for threat alerts in Continuous Monitoring. TrustProof does not change GuardDuty.

  • auditmanager:ListAssessments, auditmanager:GetAssessment, auditmanager:GetEvidenceFoldersByAssessmentControl, auditmanager:GetEvidenceByEvidenceFolder

    Imports evidence from AWS Audit Manager assessments when you choose to import it.

Download the read-only role template (CloudFormation JSON) →

Not checked by the AWS scan

An AWS scan sees AWS settings. Much of SOC 2 and ISO/IEC 27001 sits outside AWS, so these are covered by the policies, sign-offs and evidence you provide, and tested by your auditor.

  • The data inside your services

    TrustProof never reads the contents of S3 objects, databases, DynamoDB tables, secrets, log events or prompts. It reads settings and metadata only.

  • Your application code

    The AWS scan does not review source code, dependencies, code repositories or build pipelines.

  • Identity provider, HR and ticketing systems

    Single sign-on providers, HR systems (joiners, movers and leavers) and ticketing or change tools are outside AWS, so the scan cannot see them.

  • Policies and people processes

    Whether your policies are followed, staff are trained, access reviews happen or vendors are assessed is evidence you provide and sign off, not something an AWS scan can show.

  • Physical security

    Offices, devices and data centre controls are not checked. AWS covers its own data centres in its own audit reports.

  • Other clouds and on-premises systems

    Only the AWS accounts you connect are scanned. Azure, Google Cloud, SaaS tools and your own servers are not.

  • Whether a control works as designed over time

    A scan shows configuration at the time it ran. Your auditor tests whether controls operated over the audit period and forms their own opinion.

Start your free AWS scanSee pricingBack to home