--- title: "Free AWS self-assessment in 10 questions | Silamir Group" description: "Free AWS self-assessment: 10 questions on security and cost, a score out of 20 computed in your browser, and the articles to fix your weakest points." url: https://audit.aws.silamir.com/en/resources/aws-self-assessment lang: en updated: 2026-10-31 --- Free tool # AWS self-assessment: 10 questions on security and cost Ten questions, three minutes, no access to your account. You get a score out of 20, a security sub-score and a FinOps sub-score, and for each of your three weakest points, the article that explains how to fix it. Your answers stay in your browser. Published October 31, 2026 · 4 min read ## The questionnaire Answer from what you know today. "I don't know" counts as the weakest answer: a control nobody checks is not a control. The score is computed in your browser: no answer is sent or stored. 1. Root account — How is the root account protected? - Hardware MFA, no access keys, no day-to-day use - Software MFA, or occasional use of the root account - No MFA, or I don't know 2. Human access — How do your teams sign in to AWS? - IAM Identity Center (SSO), no IAM users - IAM users with mandatory MFA - IAM users with long-lived access keys and no tracked rotation, or I don't know 3. Detection — Which detection services are enabled in every region you use? - Multi-region CloudTrail, GuardDuty and Security Hub (FSBP or CIS) - CloudTrail only, or only in some regions - I don't know 4. Network exposure — Do you have security groups open to the whole Internet (0.0.0.0/0) on ports other than 80 and 443? - No, and an AWS Config or Security Hub rule checks it - Probably not, but nothing checks it - Yes (SSH, RDP or a database), or I don't know 5. Data and secrets — Where do your S3 buckets, databases and secrets stand? - S3 Block Public Access at account level, encryption everywhere, secrets in Secrets Manager or Parameter Store - Partial encryption, or some secrets still in environment variables - Public buckets possible, secrets in code, or I don't know 6. Resilience — If a database or an Availability Zone went down tomorrow, how would you restore? - AWS Backup, Multi-AZ deployment, restore tested in the last 12 months - Backups in place, never tested - No formal strategy, or I don't know 7. Cost visibility — Do you know who spends what on AWS? - Mandatory cost allocation tags, budgets with alerts per team or project - Cost Explorer checked now and then, partial tagging - We find out when the bill arrives 8. Commitments — Is your steady compute (EC2, Fargate, Lambda, RDS) covered by Savings Plans or Reserved Instances? - Yes, coverage tracked and reviewed at least quarterly - A few commitments, not tracked - No commitments, or I don't know 9. Unused resources — Do you clean up unattached EBS volumes, idle Elastic IPs, old snapshots and non-production environments left running at night? - Yes, automated or scheduled cleanup, shutdown outside business hours - Manual cleanup, now and then - Never, or I don't know 10. Network and data transfer — Do you know what your NAT gateways and data transfer cost? - Yes, and S3 and DynamoDB gateway VPC endpoints are in place - NAT gateways in place, cost never analysed - I don't know 0 of 10 answered. Your score appears once all 10 questions are answered. ## How the score is computed Each question is worth 2 points for the first answer, 1 for the second, 0 for the third or for "I don't know". - **Questions 1 to 6, security and resilience** (out of 12): root account, human access, detection, network exposure, data and secrets, backups. - **Questions 7 to 10, cost** (out of 8): visibility, commitments, unused resources, network transfer. - **Reading the total**: 16 to 20, solid foundations; 9 to 15, real blind spots; 0 to 8, likely exposure. ## What this self-assessment does not replace A questionnaire measures what you know about your account, not what it contains. It sees neither the resource forgotten in a little-used region, nor the security group opened for a test two years ago, nor the actual amount of waste. Those findings require reading the account itself: that is what the [audit](https://audit.aws.silamir.com/en/how-it-works) does, read-only, across 10 domains. ## Frequently asked questions **Are my answers sent to Silamir?** No. The score is computed in your browser, nothing is sent or kept. Reloading the page clears your answers. **Do I need to give access to my AWS account?** No. The self-assessment relies only on your answers. Only the full audit reads your account, through a read-only IAM role that you create and can delete at any time. **Who should answer?** Whoever knows the account best: cloud lead, DevOps lead or CISO. If you hesitate on a question, answer "I don't know": that is a result in itself. ## Read next - **[AWS security checklist](https://audit.aws.silamir.com/en/resources/aws-security-checklist)**: AWS security best practices checklist: 40 items to secure an AWS account, from the root user, IAM and CloudTrail to GuardDuty, encryption, networking and backups. - **[Reduce your AWS bill](https://audit.aws.silamir.com/en/resources/reduce-aws-bill)**: AWS cost optimization checklist: 15 ways to reduce your AWS bill, ranked by savings and effort: rightsizing, Savings Plans, gp3, NAT gateways, unused resources. - **[How to audit an AWS account](https://audit.aws.silamir.com/en/resources/how-to-audit-aws-account)**: Audit an AWS account in 7 steps: scope, read-only access, inventory, CIS v5.0 and FSBP baseline, costs, prioritization. Native tools and options compared. ## Ready to audit your AWS account? Subscribe on AWS Marketplace, deploy the read-only role and get your reports within the hour. [Subscribe on AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-llvpm5sa4mljs) · [See how it works](https://audit.aws.silamir.com/en/how-it-works)