Infra Audit7 min readUpdated November 4, 2026

Audit Your AWS Account Without Admin Access

Every command in this audit is list, get or describe. Nothing changes, nothing restarts, and the findings carry evidence from the API itself.

A read-only audit covers exposure (buckets, security groups, snapshots), IAM (keys, trust policies, dormant users), detection (CloudTrail, GuardDuty, budgets) and expiry (runtimes, certificates, RIs). All of it with list/get/describe calls only.

Exposure: buckets, security groups, snapshots, Lambda URLs, ECR policies. IAM: key ages, trust policies, dormant users, PassRole wildcards. Detection: is CloudTrail multi-region, is GuardDuty on, do budgets exist. Expiry: Lambda runtimes, ACM certificates, Reserved Instances, EKS versions. Each layer has dedicated commands in the audit skill, and each maps to a documented incident.

See How We Work

In This Guide

The four layers of the audit

Exposure: buckets, security groups, snapshots, Lambda URLs, ECR policies. IAM: key ages, trust policies, dormant users, PassRole wildcards. Detection: is CloudTrail multi-region, is GuardDuty on, do budgets exist. Expiry: Lambda runtimes, ACM certificates, Reserved Instances, EKS versions. Each layer has dedicated commands in the audit skill, and each maps to a documented incident.
Exposure: buckets, security groups, snapshots, Lambda URLs, ECR policies. IAM: key ages, trust policies, dormant users, PassRole wildcards. Detection: is CloudTrail multi-region, is GuardDuty on, do budgets exist. Expiry: Lambda runtimes, ACM certificates, Reserved Instances, EKS versions. Each layer has dedicated commands in the audit skill, and each maps to a documented incident.

The verdict model

Every finding carries one of three verdicts. CONFIRMED means the evidence is in the API response. NEEDS_VALIDATION means the signal needs context only the client has. REJECTED means the check ran and the account is clean on that point.
Every finding carries one of three verdicts. CONFIRMED means the evidence is in the API response. NEEDS_VALIDATION means the signal needs context only the client has. REJECTED means the check ran and the account is clean on that point. The rejected list is what separates an audit from a scanner: it proves the checks ran, not just that something was found.

What the first audit usually finds

On canary accounts and real ones alike: a public bucket nobody remembers creating, IAM keys older than a year, CloudTrail in a single region, no budgets, and at least one expiry inside 90 days. All configuration-level, all fixable in an afternoon. The expensive findings are the ones nobody looked for.
On canary accounts and real ones alike: a public bucket nobody remembers creating, IAM keys older than a year, CloudTrail in a single region, no budgets, and at least one expiry inside 90 days. All configuration-level, all fixable in an afternoon. The expensive findings are the ones nobody looked for.

Get the skill

The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times.
The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times. The full canary report is in the repository under docs/runs. Copy the skill into any coding agent, point it at your stack, and get the same report for your account.

4 Tips to Get Started

1

Create a dedicated IAM user with only list, get and describe permissions. Never hand out admin for an audit.

2

Run the audit monthly. Drift between audits is where incidents start.

3

Treat every finding as confirmed, needs_validation or rejected. Priority only on confirmed items.

4

Re-run the same commands after each fix. The re-run is the proof the fix landed.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Related Guides

Is My S3 Bucket Public? How to Check in One Command

One command tells you if your S3 bucket is public, and one curl proves it. The policy check shows intent, the anonymous request shows reality.

The Most Common AWS Misconfiguration (It Is One Line of Config)

Public buckets and Principal * policies cause most disclosed AWS incidents. Each is one line of config with account-wide blast radius. Here is the pattern.

Terraform State File Leak: Every Secret in Plaintext

terraform.tfstate stores database passwords, IAM keys and TLS private keys in plaintext. sensitive=true hides nothing. Here is how leaks happen and the check.

Docker Socket Mounted in a Container: Root on the Host, No Exploit Needed

A container with /var/run/docker.sock mounted controls the host daemon and can mount your entire filesystem. No kernel exploit required. Here is the mechanism and the check.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

How do I audit my AWS account for security?

Run a read-only audit: list every bucket and check its policy status, list security groups and check public-IP attachment, list snapshots and their sharing permissions, list IAM users and keys with their ages, check CloudTrail, GuardDuty and budgets, and check runtime and certificate expiry dates. Every command is list, get or describe, so nothing can break.

Can an audit be done without giving full admin access?

Yes. Read-only IAM policies covering list/get/describe across the services in scope are enough for a full audit. The roqy audit skill's canary runs used a PowerUser-scoped identity with zero write operations, and secrets are never printed in the report.

How often should an AWS account be audited?

Monthly at minimum, plus after every infrastructure change. Configuration drifts between audits: a new bucket, a new key, a policy edit. A monthly re-run catches drift within weeks instead of after an incident.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works