Frequently asked questions

No. The audit only uses a read-only IAM role, which you deploy in two minutes with CloudFormation and can delete at any time.

The configuration and metadata of your resources (inventory, IAM policies, network, aggregated costs). Collectors do not read the content of your buckets, databases or application logs. Everything is processed in Paris (eu-west-3) and deleted after 7 days.

Yes: one audit covers one AWS account. Deploy the role in each account and launch one audit per account; each audit is billed.

Reports are currently written in French.

An audit is metered once the reports have been generated, just before the email is sent. If it fails before that step, it is not billed. Contact support to relaunch it.

By AWS, on your AWS Marketplace invoice: USD 299 per audit, with no subscription and no commitment.

Most common causes:

• The CloudFormation stack isn't yet in CREATE_COMPLETE status - wait 30 seconds and retry.
• The ARN you entered is not the one of the created role. Grab it from the stack's Outputs tab, key RoleArn.
• The stack was deployed in a different region than expected. The IAM role is global, but the stack must exist.
• The External ID was changed. Redeploy the stack with the exact value displayed at the previous step.

The email is sent from audit@aws.silamir.com when the audit completes (about 1 hour after launch). If you don't see it:

• Check the Spam and Junk folders.
• Ask your IT department to allow the domain aws.silamir.com (SPF/DKIM/DMARC are configured).
• Double-check that the email entered during onboarding is correct.

Deliverables are kept for 7 days, then deleted automatically. Each download link expires after 10 minutes: request a new code from the download page to get a fresh one. Contact support to relaunch an audit.

A full audit takes on average 30 to 60 minutes depending on the number of regions selected and the size of your estate. If you haven't received anything after 90 minutes, contact support with the audit ID provided at the end of the form.

20 commercial regions are offered at the configuration step (Europe, North America, Asia Pacific, South America): select those where you have resources. Opt-in regions, GovCloud and China are not covered.

Read policies only:

• AWS managed policies: ReadOnlyAccess, Billing, AWSSupportAccess.
• Read access to Cost Explorer, Security Hub, Compute Optimizer.
• No permission allows creating, modifying or deleting your resources. ReadOnlyAccess also allows reading some data and AWSSupportAccess allows opening support cases: Silamir collectors only use configuration APIs and never open a support case.

The role is protected by a unique External ID: only the Silamir account presenting this secret identifier can assume it (protection against the confused deputy attack).

Open the CloudFormation console in your account, select the stack SilamirAuditRole, and click Delete. Deletion takes a few seconds and revokes access permanently. You can redeploy the stack later to run a new audit.

The DAST scan (OWASP ZAP, passive baseline or active full mode) is optional and auto-discovers the public endpoints (CloudFront, API Gateway, ALB) of the audited account. If no endpoint is exposed, the scan finishes with no alert. A DAST failure does not interrupt the audit: other reports are produced normally.

After subscribing on AWS Marketplace, you are redirected to the portal with a token in the URL. If detection fails, close the tab and restart the flow from your AWS Marketplace console (Manage subscriptions → Silamir Audit AWS product → Set up your account). If the problem persists, contact support.