Data Extraction Guide
for Amazon Web Services
Step-by-step instructions for your IT or Cloud team to extract AWS security configuration data as CSV files for the V/ergent cloud security assessment. Uses the AWS CLI — no live API access granted to V/ergent. Includes Release 5 programme packs: 50 cross-system SoD rules across all 10 platforms.
Recommended extraction path
Use the V/ergent extractor first. It writes CSVs to a timestamped folder under C:\Vergent\Export, then you upload that folder into the audit project.
Manual path if automated extraction is blocked
Use the required-file list below as the manual checklist. Keep filenames unchanged, leave unavailable files empty with only headers, and record any missing source in the upload notes before running the audit.
Extract-VergentAWS.ps1 which uses the AWS CLI to extract all 13 files automatically. Requires PowerShell 5.1+ and AWS CLI v2 installed on Windows.| Requirement | Details | Notes |
|---|---|---|
| AWS CLI v2 | Installed and configured with aws configure | Download: aws.amazon.com/cli |
| IAM User / Role | Attach V/ergent_ReadOnly policy (see Section 3) | Or use SecurityAudit AWS managed policy as alternative |
| PowerShell | PowerShell 5.1+ (built into Windows 10/11) | Required for Extract-VergentAWS.ps1 |
| AWS Region | Primary region where workloads run | IAM and S3 exports are global regardless of region |
| Permissions | See IAM policy in Section 3 | Minimum: ReadOnlyAccess + iam:GenerateCredentialReport |
All files are CSV format. The PowerShell script produces these exact filenames.
IAM Credential Report
All IAM users: MFA status, access key age, password last used, root account key status. Generated by AWS.
IAM Users & Groups
All IAM users with their group memberships and directly attached policies.
IAM Policies (Customer-Managed)
Customer-created IAM policies with policy document summaries for wildcard action/resource analysis.
IAM Roles & Trust Policies
All IAM roles with trust policy principals and attached policies for cross-account/wildcard trust analysis.
S3 Bucket Inventory
All S3 buckets: public access block settings, versioning, encryption, logging, and MFA delete status.
EC2 Security Groups
All security group inbound rules: port ranges, protocols, and CIDR ranges. Identifies open SSH/RDP.
VPC & Flow Logs Config
All VPCs with flow log status, internet gateway attachment, and default VPC identification.
EC2 Instances
Running EC2 instances: public IPs, IAM role attachment, security groups, EBS volume encryption status.
CloudTrail Trails
All CloudTrail trails: multi-region status, global service events, log validation, CloudWatch integration.
AWS Config Compliance Rules
AWS Config rule compliance status — identifies non-compliant resources against CIS/security benchmarks.
KMS Keys & Rotation
Customer-managed KMS keys: key state, automatic rotation status, and alias names.
RDS Instances
All RDS instances: encryption at rest, public accessibility, backup retention, deletion protection.
Account Password Policy & Root Config
IAM password policy settings and root account MFA/access key status.
Native coverage: 15 IAM cross-account / privilege-escalation patterns (AWS-CSOD-001..015).
Plus the three Release 5 programme packs that run alongside this platform's audit:
- AML / Wolfsberg Programme Controls — 25 controls spanning sanctions-list cadence, PEP / KYC review, CTR / SAR filing, structuring detection, transaction-monitoring tuning. Wired into all 7 ERP connectors (skips on cloud-only audits). Guide.
- Cross-System SoD — 50 multi-ERP conflict patterns spanning SAP × Oracle × D365 × NetSuite × Sage × AWS × Azure. Detects fraud paths a single-system review will never see. Guide.
- SAP Fraud Patterns — 30 SAP-GRC-parity patterns (STAD audit-log delete, debugger replace in PROD, Z* shadow SAP_ALL, dormant SAP_ALL, posting-period unlock + GL post, etc.). Guide.
Every finding carries citations across 13 frameworks (COSO 2013, COBIT 2019, NIST CSF 2.0, ISO 27001:2022, CIS v8, SOX ITGC, SOC 2 TSC, PCI DSS v4, HIPAA, DORA, NIS2, GDPR, Kenya DPA) — 11 of 13 at ≥75% mapped coverage. See the Check Packs page for per-pack framework coverage badges.