Skip to main content

AWS Audit

AWS audit security: access and data

An audit requires access to your AWS account. Here is exactly what that access allows, where your data goes and how long it is kept.

Limited, revocable access

  • You deploy an IAM role in your own account. Only the SilamirAuditExecutor role of the Silamir production account (929713278836) can assume it.
  • Access requires a unique External ID, generated for you: it protects against the confused deputy attack.
  • Sessions last one hour at most. Temporary credentials are never stored.
  • Deleting the CloudFormation stack revokes access immediately.

The role's exact permissions

The role carries three AWS managed policies and one additional read policy:

  • ReadOnlyAccess: read the configuration of your services;
  • job-function/Billing: read billing data, for the FinOps domain;
  • AWSSupportAccess: read Trusted Advisor checks, exposed through the AWS Support API;
  • read access to Cost Explorer, Security Hub and Compute Optimizer.
Good to know: ReadOnlyAccess also allows reading some data (for example S3 object content), and AWSSupportAccess allows opening support cases. Silamir collectors only call configuration and metadata APIs; they do not read the content of your data and never open a support case. No permission allows creating, modifying or deleting your resources.

View the CloudFormation template

Where your data goes

  • Collection, analysis, storage and email delivery all take place in the eu-west-3 region (Paris).
  • Only AWS Marketplace subscription notifications go through us-east-1 (United States), a region imposed by AWS Marketplace. They only contain the Marketplace customer identifier and the subscribing account ID.
  • AI (Anthropic Claude models) is invoked through Amazon Bedrock with European inference profiles. Data sent to the models is not used to train them and is not shared with Anthropic.

How it is protected

  • Encryption at rest with dedicated AWS KMS keys (S3 artefacts, DynamoDB tables), rotated yearly; TLS encryption in transit.
  • Collection runs in a private VPC; S3, DynamoDB, STS and Bedrock are reached through VPC endpoints.
  • Downloads require a code sent to the verified address; each link expires after 10 minutes.
  • The portal is protected by AWS WAF and strict security headers (CSP, HSTS), and loads no third-party script.

How long

  • Collected data and reports: deleted automatically after 7 days.
  • Anonymised statistics (no name, email, account ID or identifying ARN): kept for 10 years to improve the service.
  • Technical logs: 90 days.
  • Customer account data: for the duration of the contract; deleted on request. Details are in the privacy policy.

Read the privacy policy

Subprocessors

Amazon Web Services (hosting, Amazon Bedrock, AWS Marketplace). No other third party receives your data.

Report a vulnerability

Write to security@silamir.com. Please do not disclose the vulnerability publicly before we reply.