---
title: "How to audit an AWS account: step-by-step | Silamir Group"
description: "Audit an AWS account in 7 steps: scope, read-only access, inventory, CIS v5.0 and FSBP baseline, costs, prioritization. Native tools and options compared."
url: https://audit.aws.silamir.com/en/resources/how-to-audit-aws-account
lang: en
updated: 2026-10-10
---

Guide

# How to audit an AWS account: method, tools and checklist

Auditing an AWS account means checking, with read-only access, how its security, costs and resilience are configured, then turning the gaps into a prioritized action plan. This guide gives the method step by step, the native AWS tools, and the options to run it yourself or have it done.

Published October 10, 2026 · 4 min read

## In short

- **Scope first**: which account, which regions, which goal (security, costs, compliance, before a migration…).
- **Read-only access**: a dedicated IAM role with the `ReadOnlyAccess` managed policy, protected by an External ID if a third party performs the audit.
- **Ten areas to review**: inventory, IAM, logging, data protection, network, exposed applications, secrets and encryption, resilience, costs, containers and serverless.
- **A reference framework**: the CIS AWS Foundations Benchmark v5.0 and AWS Foundational Security Best Practices (FSBP) for security, the Well-Architected Framework for the rest.
- **A prioritised plan**: P0 / P1 / P2 actions, ranked by the risk they remove and the effort they require.

## The method in seven steps

- **1. Define the scope.** List the accounts, the regions actually used and the reason for the audit. An audit before a board meeting, a migration or a DORA review does not stress the same points.
- **2. Grant read-only access.** Create an IAM role with `ReadOnlyAccess` (plus read access to billing data for costs). No user with permanent access keys, no write permission.
- **3. Take the inventory.** Resources per region, tags, owners. Forgotten resources (a test instance, a public snapshot) are often the most exposed.
- **4. Check the security baseline.** Root user, MFA, access keys, CloudTrail, GuardDuty, encryption, public buckets, security groups open to the Internet: the CIS v5.0 and FSBP controls.
- **5. Review architecture and costs.** Backups and multi-AZ, network segmentation, Savings Plans coverage, oversized or unused resources.
- **6. Prioritise.** Rank the findings by severity, then by the attack scenarios they make possible: a gap that opens a path to sensitive data comes first.
- **7. Remediate and measure again.** Fix the P0s first, then run the audit again to prove the progress at a given date.

## The native AWS tools that help

| AWS service | What it brings to the audit | Limit |
| --- | --- | --- |
| **AWS Security Hub** | Continuous assessment against FSBP, CIS v5.0, PCI DSS or NIST | To enable per account and region; findings to triage, no report |
| **AWS Config** | Configuration history and compliance rules | Rules to choose and maintain |
| **AWS Trusted Advisor** | Checks on costs, security, limits and fault tolerance | Full set of checks depends on the support plan |
| **IAM Access Analyzer** | Resources shared outside the account or made public | IAM and sharing only |
| **Amazon GuardDuty** | Threat detection (compromised credentials, suspicious traffic) | Detects incidents, does not audit configuration |
| **Cost Explorer and Compute Optimizer** | Spend analysis, rightsizing and commitment recommendations | Costs only, no link with security |
| **AWS Well-Architected Tool** | Questionnaire per workload over the six pillars | Declarative: answers come from your teams, not from the configuration |

These services are complementary, but none of them alone produces a cross-domain, prioritised review with deliverables for management.

## Three ways to run the audit

| Option | Effort | Turnaround | What you get |
| --- | --- | --- | --- |
| **In-house, with native tools or open source (Prowler, ScoutSuite)** | High: install, run, triage, interpret, write up | Days to weeks, depending on availability | Raw results to analyse yourself |
| **Consulting firm** | Interviews, access, reviews | Several days to several weeks | Written report and debrief, can cover organisation and processes |
| **Silamir automated audit** | Deploy a read-only role, choose the regions | Usually 30–60 minutes | 10 domain reports, attack scenarios, P0/P1/P2 plan, executive summary and board deck, for 299 USD |

## When an automated audit is not enough

- You need continuous monitoring: enable Security Hub and GuardDuty, an audit is a snapshot at a given date.
- You are preparing a certification (ISO 27001, SOC 2): the accredited auditor will also review your processes.
- You need a human penetration test of your applications.
- Your workloads are not on AWS, or the question concerns your organisation more than your configuration.

## Auditing an AWS account: frequently asked questions

**What access does an AWS audit need?**

Read-only access is enough: an IAM role with the ReadOnlyAccess managed policy, plus read access to billing data to analyse costs. A third-party auditor should assume that role with an External ID, never receive access keys.

**How long does an AWS account audit take?**

Collection takes minutes; analysis and write-up take most of the time. Manually, count several days per account. The Silamir automated audit delivers its reports in 30–60 minutes for one account and the regions you choose.

**How much does an AWS audit cost?**

In-house, the cost is your teams' time. A consulting engagement is priced on quotation, according to the number of days. The Silamir automated audit costs 299 USD per audit, billed on your AWS invoice through AWS Marketplace.

**How often should an AWS account be audited?**

At least once a year, and before any major event: a migration, an external audit, a fundraising or acquisition, a DORA review. Between two audits, continuous services such as Security Hub and GuardDuty take over.

**Which standard should an AWS security audit follow?**

The CIS AWS Foundations Benchmark v5.0 for the account baseline and AWS Foundational Security Best Practices for service-level controls. They overlap in part: using both gives the best coverage.

## Where does your AWS account stand?

Ten questions, three minutes, no access to your account: a security score, a FinOps score and the article to read for each of your three weakest points. Your answers stay in your browser.

[Take the free self-assessment](https://audit.aws.silamir.com/en/resources/aws-self-assessment)

## Read next

- **[AWS security checklist](https://audit.aws.silamir.com/en/resources/aws-security-checklist)**: AWS security best practices checklist: 40 items to secure an AWS account, from the root user, IAM and CloudTrail to GuardDuty, encryption, networking and backups.
- **[Well-Architected review cost](https://audit.aws.silamir.com/en/resources/aws-well-architected-review-cost)**: The Well-Architected Tool is free: a review costs time, in-house or with a partner. Options compared, AWS funding and what an automated audit adds.
- **[AWS audit in a single night](https://audit.aws.silamir.com/en/resources/aws-audit-in-a-single-night-ai)**: Read-only access, ten domains analysed in parallel, attack paths and FinOps: how AI is reinventing the AWS security and FinOps audit.

## Ready to audit your AWS account?

Subscribe on AWS Marketplace, deploy the read-only role and get your reports within the hour.

[Subscribe on AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-llvpm5sa4mljs) · [See how it works](https://audit.aws.silamir.com/en/how-it-works)