Proof of concept viewer

Scan your AWS account. Keep auditable evidence.

A read-only scanner captures your account's security configuration as tamper-evident snapshots, maps each piece of evidence to the controls it supports — ISO 27001, CIS, SOC 2, NIST 800-53 — and records the gaps honestly.

Everything on this page runs in your browser. Scan files you load here are parsed locally and never uploaded anywhere.

STEP 01

Grant read-only access

The scanner needs read-only visibility into your AWS account. Two ways to provide it:

Recommended: cross-account role

Deploy our CloudFormation template (infra/onboarding-role.yaml) in your account. It creates a role that trusts the scanner with a unique ExternalId, and nothing else.

You keep control: delete the role at any moment to revoke access
Sessions last one hour and every access appears in your own CloudTrail
No credentials are ever exchanged or stored

Quick start: read-only keys

For a first try, create an IAM user with the SecurityAudit and ViewOnlyAccess managed policies and export its keys as environment variables where you run the CLI.

Fine for evaluating against a dev account
Rotate or delete the key when you are done

What the access can and cannot do

Granted (configuration reads only)

IAM users, roles, policies, MFA and key-age posture
S3, EBS, RDS encryption and public-exposure settings
VPC topology: security groups, routes, peering, endpoints
KMS key inventory and rotation status
CloudTrail and AWS Config recording status

Explicitly denied (your data stays yours)

S3 object contents, DynamoDB items, SQS messages
Secrets Manager values, SSM parameters, KMS decrypt
Lambda and CodeBuild environment variables
CloudWatch log contents, Athena results, EC2 console output
ECR image layers, CloudFormation template bodies

STEP 02

Run the scan

The scanner is a Node 20 CLI. One command captures the evidence and writes a self-contained scan report:

# with a deployed role (production path)
npx tsx src/cli.ts scan --role-arn arn:aws:iam::YOUR_ACCOUNT:role/regx-evidence-scanner --external-id YOUR_EXTERNAL_ID

# or with read-only keys in the environment (quick start)
npx tsx src/cli.ts scan --regions "us-east-1,eu-west-1"

# optional: pull 90 days of CloudTrail history and usage data on first connect
npx tsx src/cli.ts scan --backfill

Output lands in out/<scan-id>/: one scan-report.json plus a snapshot file per captured artifact, each with its SHA-256 hash
Scans are chained: each report embeds the previous manifest hash, so history is tamper-evident
On Windows, call the CLI directly as shown — and quote comma-separated region lists

STEP 03

Load the results here

Drop your scan-report.json — or the whole scan folder

Loading the folder also lets this page verify every snapshot hash and preview the raw evidence. Nothing leaves your browser.

Scan results

Evidence coverage of mapped ISO 27001 controls

This view maps captured evidence to the controls it supports. It is not a compliance verdict: pass/fail evaluation arrives with the rules engine, and ISO 27001 controls outside this list require organizational evidence a scanner cannot capture.

Controls and their evidence

Each control lists the artifacts captured this scan that an auditor can use as supporting evidence. A recorded gap — an API that answered with an error or an absent configuration — is itself evidence and shown as such.

Evidence inventory

Artifact	Region	SHA-256	Verification	Controls

Recorded gaps

The scan records what it could not capture. These entries are stored in the report and carried in the audit trail.

Evidence integrity

This scan's manifest hash

Previous manifest hash (chain)

Verify snapshot files

Load the snapshot files from your scan folder and this page recomputes every SHA-256 locally and compares it against the manifest.

Sign in