AWS Security: Scores, Findings and Permissions

Spotto's AWS Security page combines the Security Hub CSPM security score, configuration controls, GuardDuty threats and Inspector vulnerabilities. This guide explains the AWS security permissions and service coverage Spotto needs, so you can tell an unavailable assessment from a genuine zero score or an empty finding list.

Use this feature after your AWS accounts are connected to Spotto. Spotto collects evidence through the existing cross-account role. Security Hub CSPM, AWS Config, GuardDuty and Inspector have their own AWS charges; review the AWS security service pricing before enabling additional services. Spotto does not enable these services.

Prerequisites

• An AWS account connected to the correct Spotto company and ready for sync.
• Permission to view that account and Security in Spotto, with AWS preview access.
• An AWS administrator who can check the cross-account role and regional service settings.
• Security Hub CSPM, an enabled standard and the required AWS Config recording in each Region you want included in the posture assessment.
• GuardDuty and Inspector enabled where you want threat and vulnerability coverage. These sources are independent: their absence does not invalidate a complete CSPM score.

Permissions

The generated SpottoGuardrails inline policy includes an explicit, versioned allowlist of the collection reads below. It does not attach AWS ReadOnlyAccess or SecurityAudit. An SCP, permissions boundary, session policy or explicit deny can still block a read. See AWS permissions Spotto needs and what can still block access.

The security collector uses these read operations:

Source	Required reads
Security Hub CSPM	securityhub:DescribeHub, securityhub:GetEnabledStandards, securityhub:ListSecurityControlDefinitions, securityhub:BatchGetStandardsControlAssociations, securityhub:GetFindings, securityhub:ListEnabledProductsForImport, securityhub:ListFindingAggregators, securityhub:GetFindingAggregator, and securityhub:ListMembers for a delegated administrator account
GuardDuty	guardduty:ListDetectors, guardduty:GetDetector, guardduty:ListFindings, guardduty:GetFindings
Inspector	inspector2:BatchGetAccountStatus, inspector2:ListFindings

These are collection permissions. They do not authorize Spotto to enable a service, change a control, suppress a finding or remediate a resource. Preserve the generated trust policy and data guardrails when updating a role.

Configure AWS Security Coverage

1. Open the intended account and Region in the AWS console.
2. Confirm Security Hub CSPM is enabled and at least one security standard is enabled. AWS recommends the Foundational Security Best Practices standard.
3. Confirm AWS Config recording covers the resource types needed by those controls.
4. Check GuardDuty and Inspector in the same account and Region. Enable only the services and protection or scanning features approved for your account.
5. Check the Spotto role's policies and any organization restrictions against the read operations above.
6. Repeat for each Region you want assessed. Spotto includes every Region enabled for the account: all default Regions plus any you've opted in to.
7. Refresh the AWS account in Spotto and let its normal collection finish.

An aggregation Region or delegated administrator can hold findings for other accounts. Spotto's account view includes only evidence for the selected account and its enabled Regions.

Validate The Assessment

Open Security > Posture > Security and select the AWS account. Review the AWS Security Assessment section:

• Security Hub CSPM Score shows a percentage only when scoring evidence is complete and current for the account's Regions.
• Expand Assessment Details to review source coverage, Regions, source statuses and gaps.
• AWS Security Controls shows evaluated control status and standards.
• AWS Security Findings shows control, threat and vulnerability findings. Open a finding to inspect its affected resources and remediation text.
• Open Export in AWS Security Assessment for AWS Register (CSV) or Focused AWS Report (Word) to export the loaded native assessment evidence. Publication bounds and unavailable sources remain visible limitations.

The dashboard's Avg Secure Score averages available Azure and AWS account percentages. For example, an Azure subscription at 80% and an AWS account at 60% produce a Spotto average of 70%. Missing, stale and incomplete scoring evidence is excluded; a genuine available 0% is included. Review contributor coverage when interpreting the average.

AWS scoring counts unique passed controls divided by passed + failed + unknown controls. No-data and disabled controls are excluded; a failure in any included Region makes that control failed for the account view. GuardDuty threats and Inspector vulnerabilities appear in the finding list but do not change this control score. See AWS's score calculation.

The Spotto average combines percentages with different provider methods. It is distinct from AWS's organization score, which rolls up control status across accounts and Regions.

Existing AWS Security Recommendations

The AWS Security Recommendations section shows Security checks already collected for the selected account, separately from native CSPM controls and threat or vulnerability findings. For example, available checks can cover IAM access-key rotation, external access analysis, deprecated Lambda runtimes and S3 permissions. These recommendations can be present while Security Hub CSPM, GuardDuty or Inspector is not configured.

A missing CSPM percentage therefore does not mean Spotto has no security advice. Recommendation counts are not a substitute for an evaluated CSPM score. Review each check's priority, source, explanation and listed evidence. Reported affected counts may exceed the sampled items shown, and counts across checks can overlap.

The page uses the same summary and table patterns as Azure. The recommendation list leads with the check, impact and reported affected items. Expand a check for source information, review steps and sampled resource evidence. Account and company columns appear when multiple selected scopes need that context.

Coverage is summarized by service under Assessment Details, with the exact Region observations available in expandable details. Disabled, denied, partial and stale collection remain distinct. Choose the services and Regions you need through your approved AWS setup process; absence is not an instruction to enable every paid service in every Region.

The native CSV and Word actions cover CSPM controls, native findings and source coverage. Ordinary Security recommendations are shown separately. Security view and category access control the account checks; opening the general Recommendations page may require its own view permission.

Troubleshooting

Security Hub CSPM Is Not Enabled

What you're seeing: An unavailable score and a service-not-enabled reason, such as security-hub-not-subscribed-or-enabled.

Likely cause: The account has no active Security Hub CSPM subscription in an included Region. Read permission alone does not create an assessment.

How to fix: Ask the AWS administrator to verify the service, enabled standards and Config recording. After the approved service configuration is active, refresh the account. Initial evaluations and AWS console score updates can take time; an empty assessment is not a 100% score.

Access Is Denied

What you're seeing: A source coverage record reports access denied.

Likely cause: Required reads are missing, or an explicit deny, permissions boundary, SCP or session restriction overrides the attached policies.

How to fix: Check the role and organization restrictions for the affected source and Region. Use the generated customer instructions and exact reads above. Do not grant administrator access to make the error disappear. See access is denied even though the role allows it.

No Evaluated Controls Are Available

What you're seeing: The source can be read, but the security score is unavailable.

Likely cause: No standard is enabled, evaluations have not completed, all enabled controls have no data, or required Config recording is incomplete.

How to fix: Verify the standard and Config setup, allow evaluations to finish, then refresh. The score needs evaluated controls to calculate.

Some Sources Or Regions Are Unavailable

What you're seeing: Partial coverage, stale evidence or an unavailable source alongside other successfully collected evidence.

Likely cause: Services differ across Regions, a read failed, collection was bounded before completion, or a stored observation is too old.

How to fix: Review the individual source and Region records, repair the affected configuration or access, and refresh. Missing GuardDuty or Inspector coverage does not remove a valid complete CSPM score; incomplete CSPM coverage does.

The Finding List Is Empty

What you're seeing: No findings in the loaded assessment.

Likely cause: The assessed sources have no matching active findings, filters exclude them, or one or more sources were not assessed.

How to fix: Clear filters and inspect source coverage before interpreting the empty list. Contact Spotto support with the account ID, Region, source status and approximate collection time if the problem persists. Do not send access keys, session tokens or raw sensitive finding content.