Cloud Security Assessment Report

Document Control

Table of Contents

1. Executive Summary Overall risk, key statistics
2. Scope and Methodology Assets, standards, tools, risk ratings
3. Findings Summary All 12 findings, CVSS scoring, status
4. Detailed Findings 4 written up in full, 12 listed
5. Test Cases Control tested, DPP section, result
6. Compliance Evidence Package DPP, SOC 2 and ISO 27001:2022 coverage
7. Programme Appendix Finding to DPP control mapping
8. Appendix Team, distribution, glossary
9. Disclaimer Limitations and sample notice

Executive Summary

Cybersecify performed a configuration review of Acme SaaS's AWS account and Amazon EKS cluster in support of the Amazon SP-API Data Protection Policy submission. The review covered where Amazon Information is stored, who and what can reach it, where copies of it travel, how long it is kept, and which third parties receive it.

The perimeter and cryptography are in good order. The edge firewall enforces, transport is encrypted end to end, data at rest is encrypted under customer managed keys, MFA is universal and the root account is dormant. The findings are not about those controls; they are about copies of Amazon data that sit outside their reach.

Two conditions are severe. The bucket holding nightly order exports carries a wildcard principal, so any AWS account holder can read and overwrite files containing buyer names, addresses and order detail. Separately, a snapshot of the production order database is restored into the development account on a schedule, putting live buyer records in front of fourteen engineers in an environment with none of the production monitoring. Two further items are high: an administrative access key that has been active for 412 days, and buyer data forwarded to an observability provider that has never been assessed.

Key Statistics

Business Impact Summary

The pattern across these findings is that Amazon Information has escaped the environment built to protect it. The export bucket moves it outside the account entirely, the development restore moves it outside the production control set, the cross region replication moves it outside the registered country, and the observability and model providers move it outside the assessed supply chain. None of these requires an attacker to defeat a control; each is a copy made deliberately for an operational reason, with the protection left behind. Retention compounds it: three years of buyer records are held where thirty days would do, so any one of these paths exposes far more than it needs to.

Scope and Methodology

This was an authenticated configuration review of the AWS account and Amazon EKS cluster using a read only role. No destructive actions were performed and no production data was exported. Findings are drawn from the observed configuration state during the engagement window.

In Scope Assets

Out of Scope

Destructive or availability affecting testing; changes to production configuration; exploitation of third party managed services beyond observing their configuration; application layer testing, which is covered in the separate web application report.

Methodology and Standards

Tools

Testing Approach

Authenticated, read only configuration review of the AWS account and the Amazon EKS cluster. Automated benchmark tooling was used for breadth and every reported finding was manually verified against the live configuration. No destructive actions were performed and no production data was exported.

Risk Rating Definitions

Severity is assigned from the CVSS v3.1 base score. Ratings describe the risk the condition presents in this environment, not a generic product rating.

Deliverables and Retest

This v1.0 report is the report of record for its scope. A full retest of every finding is carried out within 30 calendar days of delivery. The v2.0 retest report, showing each finding as closed, partially closed, or accepted as a documented risk, is issued within 3 business days of the retest completing. A Letter of Attestation, signed by the OSCP certified lead tester, follows the retest and confirms that an independent manual penetration test was performed to Amazon's requirements. The Letter is supporting evidence for the SP-API Data Protection Policy submission and is not a certification.

Policy Basis for the Mapping

Every DPP citation in this report refers to a numbered requirement in the Amazon Data Protection Policy as published: Section 1, General Security Requirements (1.1 Network Protection through 1.7 Request for Deletion or Return), and Section 2, Additional Security Requirements Specific to Personally Identifiable Information (2.1 Data Retention through 2.7 Vulnerability Management). No control domain is inferred or renumbered. Where a finding touches more than one requirement, each is cited.

Amazon Required Report Elements

This report is structured to cover the six elements Amazon expects of a penetration test report submitted in support of SP-API DPP approval. Amazon reviews and decides on the submission; this report is independent, third party evidence and not an approval.

Findings Summary

The assessment produced 12 findings: 2 Critical, 2 High, 4 Medium, 2 Low and 2 Informational. Four are grouped as P1 because each of them, on its own, places Amazon Information outside the control set that the submission attests to.

Severity Distribution

All Findings

This is a redacted sample. The table above lists the full finding set by title; Section 4 gives complete write ups for a representative finding in each priority band (P1, P2, P3) and across the severity range, so the reader can see the exact format, evidence, and Amazon DPP mapping without reproducing every finding. A real engagement report details every finding in full.

Priority Definitions

Findings are grouped by remediation priority for the Amazon SP-API Data Protection Policy submission. P1 findings block the submission and must be remediated and retested before the Letter of Attestation is issued. P2 findings are DPP relevant but not submission blocking; they strengthen the attestation and should be remediated on the stated timeline. P3 findings are lower priority hardening items that improve the overall security posture and are addressed in the normal hardening cycle.

Detailed Findings

All 12 findings are listed below in their priority bands. Four carry the complete write up the source report publishes: CS-2026-C01 and CS-2026-C02 from P1, CS-2026-C06 from P2 and CS-2026-C12 from P3. The other eight carry the severity, both CVSS scores, the test case and the DPP mapping the report records for them, and are marked where the write up is not reproduced in this redacted sample.

P1 · DPP Submission Blockers

aws s3api get-bucket-policy --bucket acme-order-exports
  Statement: Principal "*" | Action [s3:GetObject, s3:PutObject] | Resource arn:aws:s3:::acme-order-exports/exports/*
aws s3api get-public-access-block --bucket acme-order-exports
  BlockPublicPolicy: true   (does not restrict cross account principals granted by policy)

aws rds describe-db-instances --profile dev
  acme-dev-orders   restored from: arn:aws:rds:...:snapshot:prod-orders-nightly
aws rds describe-db-snapshots --profile dev --query 'DBSnapshots[].SourceRegion'
  source: production account 222233334444
  developer group policy: rds-db:connect on acme-dev-orders   (14 principals)

P2 · Attestation Strengthening Findings

aws s3api get-bucket-lifecycle-configuration --bucket acme-order-exports
  NoSuchLifecycleConfiguration
SELECT MIN(fulfilled_at), COUNT(*) FROM orders WHERE buyer_email IS NOT NULL;
  2023-02-11 | 1,284,663    (buyer PII retained on fulfilled orders beyond three years)

P3 · Lower Priority Hardening Findings

kubectl get deploy support-summariser -o jsonpath='{.spec...env}'
  MODEL_ENDPOINT=https://api.<provider>.example/v1/responses
  request body: { "input": "<raw buyer message thread>" }    (no redaction step observed)

Test Cases

Each test case maps to the assessed control and the finding that resulted. Every case below returned a FAIL and corresponds to a confirmed finding; controls confirmed working are recorded in the Compliance Evidence Package.

Compliance Evidence Package

This section maps findings and positive controls to the published Amazon Data Protection Policy, the SOC 2 Trust Services Criteria, and ISO 27001:2022 Annex A. Every DPP citation in this report refers to a numbered requirement in the policy as published by Amazon: Section 1, General Security Requirements, and Section 2, Additional Security Requirements Specific to Personally Identifiable Information. The table below covers all fourteen requirements, not only those where a finding was raised. This assessment is independent evaluation evidence. Cybersecify is not a CPA firm and does not perform the SOC 2 examination, is not ISO 27001 or SOC 2 certified, and does not approve the DPP submission.

A. Positive Controls Confirmed

B. Amazon DPP Section Coverage

C. SOC 2 Trust Services Criteria Coverage

D. ISO 27001:2022 Annex A Coverage

Programme Appendix

Finding to DPP control mapping and priority band coverage for the SP-API Data Protection Policy submission programme.

Appendix

A. Testing Team and Authorisation

Certification verifiable via the assessor's Credly badge issued by OffSec.

B. Report Distribution

C. Glossary

Disclaimer

Limitations of Testing

Penetration testing is inherently limited by the scope, time, and resources allocated to the engagement. No individual or organisation can guarantee identifying all security issues. The testing performed is conducted on a best effort basis, and the findings reported herein are specific to the environment provided for testing.

Scope of Findings

The reported findings apply exclusively to the tested environment and configurations during testing. Information systems rely on human factors and can be inherently vulnerable to human error. While Cybersecify has endeavoured to identify significant security vulnerabilities in the analysed systems, it is impossible to assure that all potential vulnerabilities have been discovered. This document does not constitute legal advice.

Continued Vigilance

Security is an ongoing process. Regular assessments and updates to security measures are essential to maintaining a strong security posture. Cybersecify recommends periodic penetration testing and continuous monitoring to adapt to new threats and vulnerabilities.

Sample Notice

This is a redacted sample report for a fictional company, Acme SaaS Pvt. Ltd., produced to demonstrate the structure, finding format, and compliance mapping of a Cybersecify Amazon SP-API Data Protection Policy engagement. The company, domains, addresses, identifiers, and findings are illustrative and do not describe any real client or assessment.

Cyber Secify Consulting (OPC) Private Limited  ·  contact@cybersecify.com  ·  Bengaluru, India