Discuss a project

DL-SEC-02 · Secure / Amazon assessment

Amazon audit readiness for SP-API apps

Amazon assesses developers' apps against its security and data-protection requirements. We find the gaps first, fix them in code and infrastructure, run the penetration test and assemble the evidence.

Discuss a project Scope
51.4344.0060°04SECUREDETAIL 04 · SECURE · DL-SEC-02

Why SP-API apps fail Amazon's security audit

  1. 1.

    Controls described in policies but missing in the code

  2. 2.

    No penetration test, or one that tested the wrong system

  3. 3.

    Evidence collected at the last minute and inconsistent

  4. 4.

    Rejected on several controls, with a deadline to fix them

The SP-API app is assessed for gaps; fixes and a penetration test feed one evidence pack, which the developer submits for Amazon's assessment.accessscopedocumentedreportsubmitYOUR SP-API APPcode / cloudREADINESSgaps / fix / testPENETRATION TESTapp + infrastructureEVIDENCE PACKmatches the codeAMAZON ASSESSMENTsubmitted by you
  1. 01YOUR SP-API APPcode / cloudREADINESSgaps / fix / testaccess
  2. 02READINESSgaps / fix / testPENETRATION TESTapp + infrastructurescope
  3. 03READINESSgaps / fix / testEVIDENCE PACKmatches the codedocumented
  4. 04PENETRATION TESTapp + infrastructureEVIDENCE PACKmatches the codereport
  5. 05EVIDENCE PACKmatches the codeAMAZON ASSESSMENTsubmitted by yousubmit
Fig. 01From gaps to evidenceThe SP-API app is assessed for gaps; fixes and a penetration test feed one evidence pack, which the developer submits for Amazon's assessment.Scale NTS

What the engagement covers.

  1. 01

    Gap assessment

    Each of Amazon's controls checked against what the code and cloud actually do.

  2. 02

    Remediation

    Gaps closed in code and infrastructure, not only in the documents.

  3. 03

    Penetration test

    Application and infrastructure tested, findings fixed and retested.

  4. 04

    Evidence pack

    Policies, screenshots and reports that tell one consistent story.

  5. 05

    Follow-up

    Amazon's questions and rejected controls handled before the deadline.

How it runs.

  1. P01

    Scope

    Which app, data and infrastructure Amazon will look at.

  2. P02

    Assess

    Every control checked in the real system.

  3. P03

    Fix

    Gaps closed, or fix-ready tickets for your team.

  4. P04

    Test

    Penetration test, fixes, retest.

  5. P05

    Submit

    Evidence assembled; follow-up questions answered with you.

What you get.

ItemDeliverableQty

  1. 01Gap assessment against Amazon's controls1
  2. 02Remediation in code and infrastructure1
  3. 03Penetration test report with retest1
  4. 04Evidence pack ready to submit1

Stack06

  • Amazon SP-API
  • Data Protection Policy
  • Login with Amazon
  • AWS
  • Encryption at rest
  • Secrets management

Related projects.

  1. DL-006Adapter for Amazon SP-API authenticationOrion · USA03Build04Secure
  2. DL-052Amazon SP-API security and restricted data readiness for a SaaS platformName withheld · Israel01Audit04Secure
  3. DL-037Restricted data access approvals for Amazon software teamsName withheld · Poland04Secure
  4. DL-038Security readiness review for a multi-tenant SP-API appName withheld · Israel01Audit04Secure
All case studies

Questions engineers ask us.

Q01Can you guarantee we pass?

No. Amazon decides. We make sure the app meets the controls and the evidence matches the system.

Q02We were rejected on several controls. Can you help?

Yes. We start with the rejected controls and the deadline, fix them in the system and update the evidence.

Q03Do we need a penetration test?

If one is required, it has to cover the system that handles Amazon data. We scope it that way and retest after the fixes.

Q04How is this different from Amazon PII access?

PII access is the application for restricted roles. Audit readiness prepares an app for Amazon's security assessment, whether or not it holds PII.

Related services.

Assessment on the calendar?

Tell us what Amazon asked for and by when. We reply with the gaps to check first.

Discuss a project