When did you last verify a restore — not a backup?
Backups are easy to schedule and almost never tested. Give us a read-only role and we will tell you, per resource, how old your last verified restore is — in one page you can put in front of an auditor.
- RDS, Aurora and S3 in one scan, metadata only
- No S3 object, no database row, no snapshot is ever read
- Short-lived STS session, ExternalId, least privilege
- One-page PDF: retention, last backup, restore age, verdict
Three steps, about eight minutes
The hard part of any cross-account product is not the code, it is the access. We keep it to one stack: a role, an ExternalId, and a policy that can only describe things.
Create the read-only role
Launch the template in the account you want assessed. It creates one IAM role that trusts only our account, only with your ExternalId.
Launch CloudFormation stackPaste the role ARN
Copy the role ARN from the stack outputs (and the ExternalId you generated above) into the form. Nothing else is needed: no agent, no credentials, no network path into your VPC.
Read the verdict
We scan, compute the restore age of every resource, and give you a one-page PDF plus a shareable link. If it says “never”, you will know before your auditor does.
Preview the PDFMultiple accounts? Use the same template as a CloudFormation StackSet — create a StackSet and deploy it to the OU you care about.
What the role can do — and what it cannot
Read the policy before you deploy it. It is the same file we publish in the repo, with no hidden extras and no wildcard write actions.
Reads (metadata only)
- RDS/Aurora: instances, clusters, snapshots, retention, latest restorable time
- S3: bucket list, versioning, replication, lifecycle, inventory config
- AWS Backup: plans, selections, restore jobs and restore testing plans
- STS: assumes the role for a 15-minute session, then discards it
22 describe/list actions — metadata verbs only, never a data read.
Never
- No s3:GetObject, s3:ListBucket — we cannot see your objects
- No database connection, no query, no row
- No cloudtrail:LookupEvents, no CloudWatch, no logs
- No write, delete or restore permission of any kind
- No CloudFormation/S3 template URL from you: we fetch nothing from your account
# The trust policy created by readonly-role.yaml
Principal:
AWS: arn:aws:iam::<scanner-account-id>:root
Action: sts:AssumeRole
Condition:
StringEquals:
sts:ExternalId: !Ref ExternalIdAudit trail: every scan starts with sts:AssumeRole in your CloudTrail, with our session name and the ExternalId. You can revoke access in one click by deleting the stack.
What the report says
Facts, dated. Not a compliance stamp, not a dashboard: a one-page artefact with a table per resource and a sentence your auditor can read in five seconds.
Restore age
Days since the last restore we can verify in AWS Backup's restore history. If there is none, it says never; if we could not read the API, it says unknown. We never guess.
Coverage
Every resource is classified as protected or not: automated backlog retention, manual snapshots, AWS Backup plan membership, S3 versioning, replication.
The sentence
“Your oldest verified restore is 412 days old.” One line, on the page, in the PDF, in the email you forward to your auditor.