Guide
How to audit an AWS account: method, tools and checklist
Auditing an AWS account means checking, with read-only access, how its security, costs and resilience are configured, then turning the gaps into a prioritized action plan. This guide gives the method step by step, the native AWS tools, and the options to run it yourself or have it done.
In short
- Scope first: which account, which regions, which goal (security, costs, compliance, before a migration…).
- Read-only access: a dedicated IAM role with the
ReadOnlyAccessmanaged policy, protected by an External ID if a third party performs the audit. - Ten areas to review: inventory, IAM, logging, data protection, network, exposed applications, secrets and encryption, resilience, costs, containers and serverless.
- A reference framework: the CIS AWS Foundations Benchmark v5.0 and AWS Foundational Security Best Practices (FSBP) for security, the Well-Architected Framework for the rest.
- A prioritised plan: P0 / P1 / P2 actions, ranked by the risk they remove and the effort they require.
The method in seven steps
- 1. Define the scope. List the accounts, the regions actually used and the reason for the audit. An audit before a board meeting, a migration or a DORA review does not stress the same points.
- 2. Grant read-only access. Create an IAM role with
ReadOnlyAccess(plus read access to billing data for costs). No user with permanent access keys, no write permission. - 3. Take the inventory. Resources per region, tags, owners. Forgotten resources (a test instance, a public snapshot) are often the most exposed.
- 4. Check the security baseline. Root user, MFA, access keys, CloudTrail, GuardDuty, encryption, public buckets, security groups open to the Internet: the CIS v5.0 and FSBP controls.
- 5. Review architecture and costs. Backups and multi-AZ, network segmentation, Savings Plans coverage, oversized or unused resources.
- 6. Prioritise. Rank the findings by severity, then by the attack scenarios they make possible: a gap that opens a path to sensitive data comes first.
- 7. Remediate and measure again. Fix the P0s first, then run the audit again to prove the progress at a given date.
The native AWS tools that help
| AWS service | What it brings to the audit | Limit |
|---|---|---|
| AWS Security Hub | Continuous assessment against FSBP, CIS v5.0, PCI DSS or NIST | To enable per account and region; findings to triage, no report |
| AWS Config | Configuration history and compliance rules | Rules to choose and maintain |
| AWS Trusted Advisor | Checks on costs, security, limits and fault tolerance | Full set of checks depends on the support plan |
| IAM Access Analyzer | Resources shared outside the account or made public | IAM and sharing only |
| Amazon GuardDuty | Threat detection (compromised credentials, suspicious traffic) | Detects incidents, does not audit configuration |
| Cost Explorer and Compute Optimizer | Spend analysis, rightsizing and commitment recommendations | Costs only, no link with security |
| AWS Well-Architected Tool | Questionnaire per workload over the six pillars | Declarative: answers come from your teams, not from the configuration |
These services are complementary, but none of them alone produces a cross-domain, prioritised review with deliverables for management.
Three ways to run the audit
| Option | Effort | Turnaround | What you get |
|---|---|---|---|
| In-house, with native tools or open source (Prowler, ScoutSuite) | High: install, run, triage, interpret, write up | Days to weeks, depending on availability | Raw results to analyse yourself |
| Consulting firm | Interviews, access, reviews | Several days to several weeks | Written report and debrief, can cover organisation and processes |
| Silamir automated audit | Deploy a read-only role, choose the regions | Usually 30–60 minutes | 10 domain reports, attack scenarios, P0/P1/P2 plan, executive summary and board deck, for 299 USD |
When an automated audit is not enough
- You need continuous monitoring: enable Security Hub and GuardDuty, an audit is a snapshot at a given date.
- You are preparing a certification (ISO 27001, SOC 2): the accredited auditor will also review your processes.
- You need a human penetration test of your applications.
- Your workloads are not on AWS, or the question concerns your organisation more than your configuration.
Auditing an AWS account: frequently asked questions
What access does an AWS audit need?
Read-only access is enough: an IAM role with the ReadOnlyAccess managed policy, plus read access to billing data to analyse costs. A third-party auditor should assume that role with an External ID, never receive access keys.
How long does an AWS account audit take?
Collection takes minutes; analysis and write-up take most of the time. Manually, count several days per account. The Silamir automated audit delivers its reports in 30–60 minutes for one account and the regions you choose.
How much does an AWS audit cost?
In-house, the cost is your teams' time. A consulting engagement is priced on quotation, according to the number of days. The Silamir automated audit costs 299 USD per audit, billed on your AWS invoice through AWS Marketplace.
How often should an AWS account be audited?
At least once a year, and before any major event: a migration, an external audit, a fundraising or acquisition, a DORA review. Between two audits, continuous services such as Security Hub and GuardDuty take over.
Which standard should an AWS security audit follow?
The CIS AWS Foundations Benchmark v5.0 for the account baseline and AWS Foundational Security Best Practices for service-level controls. They overlap in part: using both gives the best coverage.
Where does your AWS account stand?
Ten questions, three minutes, no access to your account: a security score, a FinOps score and the article to read for each of your three weakest points. Your answers stay in your browser.
Ready to audit your AWS account?
Subscribe on AWS Marketplace, deploy the read-only role and get your reports within the hour.