01
Create a read-only credential
Create the credential in Amazon Web Services with the minimum read scope, paste it into devguard, and the connection is live. The integration page in the product spells out the exact permissions.
devguard signs read-only IAM Query API calls with SigV4 and checks the account-security basics auditors ask about first: MFA on the root account and a strong IAM password policy.
3 read-only checks, run on a schedule. Each failure becomes a finding linked to a control — every check is listed, none are “coming soon”.
Fails if the AWS account root user does not have multi-factor authentication enabled. Reads the IAM account summary and asserts AccountMFAEnabled is 1.
root-mfa-enabled
Fails if the IAM account password policy has a minimum length below the configured threshold (default 14) or does not require symbols, numbers, uppercase, and lowercase characters.
iam-password-policy-strong
Fails if the AWS account root user has any active access keys. Reads the IAM account summary and asserts AccountAccessKeysPresent is 0.
root-no-access-keys
Bring your current platform's test list — we'll map it against these checks, gap by gap
Setup is minutes, not a migration project — and every step stays on your side
Create the credential in Amazon Web Services with the minimum read scope, paste it into devguard, and the connection is live. The integration page in the product spells out the exact permissions.
The first run starts right after connecting, then repeats on a schedule. Results are timestamped, so your evidence has a history, not a snapshot.
Passing results attach as evidence to the controls they support; failures become findings you triage. When the audit comes, the proof is already connected.
Open any page for its full check register.
You create and scope every credential yourself, and you can revoke it at any time. Checks only read; results and evidence are stored in Switzerland and stay exportable.
Yes. The checks authenticate with a credential you create and scope yourself, and only ever read configuration. devguard holds no write access to Amazon Web Services and remediates nothing silently.
A failed check becomes a finding linked to the control it supports, with the evidence attached. You decide the treatment — nothing pages your engineers and nothing is auto-remediated.
Checks run from Swiss infrastructure, and results and evidence are stored in Switzerland. Everything is exportable — your evidence stays yours.
A read-only IAM policy covering GetAccountSummary and GetAccountPasswordPolicy is enough. Attach it to a dedicated IAM user created for devguard, and nothing else.
No. Every call is a signed read. devguard has no write permissions, and the checks fail loudly rather than remediate silently.
20 minutes on how you run certification today. Bring your current test or control list and we'll map it against these checks — honestly, gap by gap.