Connector · Amazon Web Services
CIS benchmarks for AWS.
Four benchmarks. Read-only.
ConfigCobra scans your AWS environment against four CIS AWS benchmarks — 306 controls — through a read-only IAM role that ConfigCobra assumes.
- CIS controls
- 306
- CIS AWS benchmarks
- 4
- Access
- Read-only
- Connection
- Assume-role
Four CIS AWS benchmarks. One scan.
Foundations v7.0.0 plus Compute Services v2.0.0, Database Services v2.0.0 and Storage Services v1.0.0.
See the benchmark breakdown →From connection to findings.
One read-only connection covers all four benchmarks.
Connect
A read-only IAM role. Nothing more.
ConfigCobra assumes a read-only IAM role, protected with an external ID, and never writes to your AWS.
Scan
306 controls across four benchmarks.
Foundations v7.0.0 (70), Compute Services v2.0.0 (82), Database Services v2.0.0 (98) and Storage Services v1.0.0 (56), in one scan.
See the benchmarks →Evidence
See exactly what failed.
Each finding comes with its evidence: the setting, what the benchmark expects and what the scan found.
Cloud Security Posture Management →Priority
Fix the important ones first.
Every control carries a severity estimate — ConfigCobra's prioritisation, since CIS publishes no severity.
Inventory
Your AWS resources, in one inventory.
AWS resources sit next to your other clouds, with a per-cloud and an "All clouds" view and findings linked to the objects they concern.
Explore the inventory →Impact
See what a fix changes before you apply it.
For a failing control, ConfigCobra lists the resources and identities the fix would affect, with an impact level, so nothing breaks by surprise.
Remediation impact analysis →Read-only. Never writes to your AWS.
ConfigCobra connects through an IAM role that it assumes.
- Read-only
IAM role (assume-role)A read-only IAM role that ConfigCobra assumes.
- Role trust
External IDThe assumed role is protected with an external ID.
What you can do on AWS.
Assess your AWS environment against the CIS AWS benchmarks and see every resource in the inventory.
- Assess
Cloud Security Posture Management (CSPM)
CIS benchmark assessment with a score, findings and a severity estimate per control
Learn more → - See
Inventory & Insights
Every user, app, device and resource in one inventory, with built-in risk views
Learn more → - Fix
Remediation
See what a fix changes in your tenant before you apply it, then use the generated script
Learn more → - Keep
Monitoring & Drift
Daily scans, drift detection and email alerts when a control regresses
Learn more → - Prove
Reports & Evidence
PDF reports with evidence and a timestamped snapshot, plus a read-only auditor seat
Learn more → - Ask
AI Assistant (MCP)
Ask your AI assistant about your posture, using live ConfigCobra scan data
Learn more →
One console for
Frequently asked questions
Is AWS support available?
Yes. ConfigCobra for AWS is available. Start a free trial, or ask us for a quote.
Which CIS benchmarks does ConfigCobra check for AWS?
CIS Amazon Web Services Foundations Benchmark v7.0.0 (70 controls), CIS AWS Compute Services Benchmark v2.0.0 (82), CIS AWS Database Services Benchmark v2.0.0 (98) and CIS AWS Storage Services Benchmark v1.0.0 (56) — 306 controls in total.
What access does ConfigCobra need in AWS?
Read-only access through an IAM role that ConfigCobra assumes, protected with an external ID. ConfigCobra never writes to your AWS.
Does AWS appear in the ConfigCobra inventory?
Yes. AWS resources appear in the inventory next to your other connected clouds, with a per-cloud view and an "All clouds" view.
See it on your own tenant
Read-only access — ConfigCobra never changes your tenant.