AWS security audit
AWS security audit: FSBP, CIS v3.0 and attack scenarios
A read-only security audit of your AWS account, assessed against AWS Foundational Security Best Practices and the CIS AWS Foundations Benchmark v3.0.0, with attack scenarios and a prioritised remediation plan. Usually delivered in 30–60 minutes, for 299 USD.
Why audit the security of your AWS account
Under the shared responsibility model, AWS secures the infrastructure; the configuration of your accounts is yours. Most cloud incidents come from that configuration, not from an AWS flaw:
- a root user without MFA, or with active access keys;
- old IAM access keys, never rotated, or attached to people who have left;
- an S3 bucket or a snapshot made public by mistake;
- a security group that opens SSH (22) or RDP (3389) to the whole Internet;
- incomplete logging: CloudTrail limited to one region, GuardDuty disabled, no alarm on sensitive actions.
These gaps pile up project after project. A regular audit makes them visible, ranks them by severity and says exactly what to fix.
Two frameworks, one report
The security domain assesses your account against two complementary standards:
- AWS Foundational Security Best Practices (FSBP) v1.0.0: the native AWS Security Hub standard, over 200 controls specific to AWS services (EC2, S3, RDS, Lambda, CloudTrail…).
- CIS AWS Foundations Benchmark v3.0.0: the Center for Internet Security hardening benchmark, organised in five sections (IAM, storage, logging, monitoring, networking), often used as a reference by external auditors.
- A finding raised by both standards for the same resource appears once, tagged
FSBP+CIS. Each standard gets its own score, then an overall score.
If AWS Security Hub is enabled in your regions, its FSBP and CIS results are reused control by control. Otherwise, the analysis relies on direct collection of the configuration, and the absence of Security Hub is itself reported.
What the security audit checks
| Theme | Sample checks |
|---|---|
| Root user | MFA (hardware preferred), no access keys, recent root usage. |
| IAM identities | MFA for console users, password policy, credentials unused for 45 days, 90-day key rotation, *:* policies, permissions granted through groups. |
| Logging | Multi-region CloudTrail, log file validation and KMS encryption, AWS Config recording all resources. |
| Detection | GuardDuty and Security Hub enabled in every region, IAM Access Analyzer, CIS 4.1 to 4.15 alarms on sensitive events. |
| Storage and encryption | Public S3 buckets, denial of unencrypted HTTP, S3, default EBS and RDS encryption. |
| Networking | Security groups and NACLs open to 0.0.0.0/0 or ::/0 on administration ports, default security group. |
Beyond compliance: attack scenarios
A list of failed controls does not tell you where an attacker would get in. The audit connects the findings of all ten domains:
- 5 to 10 kill chains: attack scenarios that chain, for example, an exposed endpoint, an over-permissive role and an unencrypted bucket.
- Impact-driven priorities: an action that breaks three scenarios or more is automatically P0.
- The neighbouring domains: IAM, networking, web security (CloudFront, ALB, API Gateway, WAF, TLS), secrets and KMS encryption, containers and serverless.
- An optional DAST scan: OWASP ZAP tests your automatically discovered public endpoints, in passive mode (up to 20 targets) or active mode (up to 10 targets).
What your CISO receives
- The security report (Word and PDF): FSBP and CIS scores, findings ranked by severity with the ARN of every affected resource, and the fix to apply.
- The kill chain report: the attack scenarios, their severity and the findings that make them possible.
- The remediation plan and the P0, P1, P2 Excel action plan: commands, effort, reversibility and cost of each action.
- The executive summary and the 19-slide deck to present the security posture to management.
What the audit does not replace
- A manual penetration test: the audit reads the configuration; the optional DAST scan remains automated.
- A certification (ISO 27001, SOC 2): the audit provides evidence, not an attestation.
- Continuous monitoring: it is a snapshot of the account at a given date. Run it again after your fixes to measure progress.
An audit covers one AWS account; for a multi-account organisation, run one audit per account.
AWS security audit: frequently asked questions
Do I need to enable AWS Security Hub before the audit?
No. When Security Hub is enabled with the FSBP and CIS standards, the audit reuses its results control by control. Otherwise, it relies on direct collection of the configuration (IAM, S3, security groups, CloudTrail, GuardDuty, AWS Config…) and reports the absence of Security Hub as a finding.
Does the audit certify CIS compliance?
No. It measures the gap to the CIS AWS Foundations Benchmark v3.0.0 and to FSBP, with a score per standard and the list of failed controls. CIS does not certify AWS accounts: the report serves as evidence of the assessment and as a baseline for follow-up.
How is it different from a penetration test?
A penetration test actively exploits weaknesses, often at application level, with a human tester. The audit assesses the AWS account configuration in read-only mode, and can add an automated DAST scan of public endpoints. The two are complementary.
Does the audit change anything in my account?
No. The IAM role you deploy is read-only and no permission allows creating, modifying or deleting a resource. The remediation plan gives the commands to run: you apply them.
How much does an AWS security audit cost?
299 USD per audit and per account, billed by AWS on your AWS Marketplace invoice. The audit covers all ten domains, security included, with no subscription or commitment.
Ready to audit your AWS account?
Subscribe on AWS Marketplace, deploy the read-only role and get your reports within the hour.