Client's auditor wants us to create an 'AWS security audit role' in our cloud account — how much permission should we grant?

The key distinction here is ReadOnlyAccess vs. SecurityAudit. If you attach ReadOnlyAccess, the auditor can download files from your object storage and snoop around database metadata way too much. A security auditor only needs the SecurityAudit policy and maybe a few scoped-down monitoring dashboards if requested.

Don't skip these three steps for a secure audit role: 1) Add an unguessable, random ExternalId condition to the trust policy. 2) Set the role's MaxSessionDuration to one hour. 3) Restrict the role to their specific office IP block using an IP address condition in the policy.

Very few audit frameworks actually require an external auditor to log into a live AWS account directly. Most of the time, exported configuration reports and CLI dumps are plenty. Have you asked them in writing why they can't just accept configuration reports before letting them into the account?

Correction: I misremembered the figure, it was a bit lower.

A bilateral NDA must be signed with the auditing firm before provisioning any access. The scope of the audit, targeted resources, and session logging liabilities must be clearly spelled out. No account credentials or roles should be shared before the legal baseline is sorted out.

We went through two similar audits last year. We only kept the role active for a 72-hour window and capped the session duration at 3 hours. The auditor ended up running just 42 unique API calls, got their data, and wrapped up. We deleted the role right after the window closed, zero headaches.

totally normal to panic a bit the frst time this comes up then don't worry, if you tell their auditor "per our internal security policy we cannot provision direct console users but we can set up an audit role with an external ID," you'll actually come across as very professional.

once you set up the role filter by the role name in cloudtrail every now and then to see what theyre up to. I mean if they start poking around random services just call them out on it.

Don't waste time overthinking it: go to IAM, create a new role select another AWS account enter their account ID check the box to require an external ID, attach only the SecurityAudit policy, and save.

Let me share my experience. The real issue isn't the number, but what it's based on.

I'm also curious if anyone does it differently.

Looking at it as a process, the picture changes. When you try to change everything at once, nothing settles.

That's all, sorry if I went on too long.

There's also a measurement aspect to this. An automated scan report is not the same as a penetration test.

I'm also curious if anyone does it differently.

You're right.

If you're going this route, sort this out first. Just because everyone does it doesn't mean it's right.

Payment information changes are never verified through the channel they came from. I'm also curious if anyone does it differently.

You're right, I've been down that road too. Forgotten test environments are more often the entry point than live systems.

My perspective changed after experiencing that. Processes without records never improve, because you don't know what to fix.

An automated scan report is not the same as a penetration test. Proven by experience.

I didn't know that.

I went through the same thing.

Let me clarify the technical side. Most time waste accumulates in tasks waiting for approval.

Of course, it varies if your situation is different.