iso27001-auditor

An inspection drawing
of your AWS account.

iso27001-auditor scans EC2, RDS, EKS, ECS, IAM, S3, and a dozen other services from one read-only role, then marks up the account the way an inspector marks up a drawing — pass, warn, fail, with the fix noted right on the sheet.

View on GitHub Download ZIP (v1.0.0) Run it
Schematic of an AWS account with inspection stamps EC2 RDS EKS Account S3 IAM KMS PASS WARN FAIL PASS WARN PASS

18 controls checked · one read-only role

What it checks

Eighteen controls across every service a typical AWS footprint runs. A service you're not using shows a clean informational line, not a false failure.

ControlCoversChecks
A.5.15 / A.5.17Access & authenticationRoot/IAM MFA, password policy, stale keys
A.8.24CryptographyEBS/RDS/S3 encryption, KMS rotation
A.8.16MonitoringCloudTrail, GuardDuty, VPC Flow Logs
A.8.9Configuration managementAWS Config recorder status
A.8.12Data leakage preventionS3 public access, open security groups
A.8.13BackupRDS retention, AWS Backup coverage
A.8.20Network hardeningIMDSv2, public IP exposure
EKS / ECSContainer platformsControl-plane logging, privileged tasks, secrets encryption
ECRRegistry hardeningScan-on-push, encryption type, tag immutability
ElastiCache / RDSData storesEncryption, public access, deletion protection
DynamoDB / LambdaServerlessEncryption type, point-in-time recovery, public function URLs
SQS / SNS / EFSMessaging & storageEncryption at rest
SecretsManager / ACMSecrets & certificatesRotation status, certificate expiry

Get it running

One machine, one read-only role. Nothing installed in your account.

  1. 1

    Get the code

    Pulls the latest tagged release (a fixed snapshot, not the moving main branch):

    curl -L -o iso27001-auditor.zip \
  https://codeload.github.com/yousafkhamza/iso27001-auditor/zip/refs/tags/v1.0.0
unzip iso27001-auditor.zip && cd iso27001-auditor-1.0.0

    Or, if you have git: git clone --branch v1.0.0 https://github.com/yousafkhamza/iso27001-auditor.git

  2. 2

    Attach a read-only role

    The AWS-managed SecurityAudit policy covers everything the scan needs. See ACCESS.md for the exact action list if you'd rather hand-roll it.

  3. 3

    Install and run

    pip install -r requirements.txt
# add --break-system-packages only if pip refuses with
# "externally-managed-environment" (common on newer Debian/Ubuntu):
#   pip install -r requirements.txt --break-system-packages

python3 iso27001_auditor.py --regions us-east-1,eu-central-1 --out ./report
  4. 4

    Read the sheet

    Open ./report/iso27001-report.html. Every failing or warning control includes a fix, not just a red status. Exit code is 1 on any failure — wire it into CI for continuous checking.

Two roles, not one

The scan itself never needs write access. A second, separately scoped role is only required if you use the optional S3 push to publish the report — and even then it's limited to one bucket prefix, not account-wide S3 access.

Read the full access breakdown
Audit role Read-only, account-wide
S3 push role Write, one bucket prefix
Anything else Not required