AWS Amplify Security Review
Amplify denies everything by default, but the rules, keys and settings your team added decide what is actually exposed. We test those rules, your API keys, your build output and branch access. CREST-certified testers, fixed price from £3,350 for a 3-day single-estate scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
owner is the field Amplify Data auto-populates with a user’s identity when a model uses the allow.owner() rule, and every request is authorised against it. Get that rule, or a related guest or API key rule, wrong and the API enforces the wrong boundary with complete confidence.
Why Amplify security depends on the rules your team wrote
Amplify Data’s authorisation rules are, in the vendor’s own words, deny by default: nothing is exposed unless a rule says so. In practice a schema combines a handful of building blocks, allow.owner() for a record’s creator, allow.authenticated() for any signed-in user, allow.guest() for Amazon Cognito’s unauthenticated identity, and allow.publicApiKey() for anyone holding the AppSync API key, and Amplify’s own customise your auth rules guide sets out that multiple rules on one model are combined with OR, not AND. A getting-started schema left in production, where every model without its own rule falls back to a global allow.publicApiKey(), turns that safety net into full CRUD for anyone with the key.
Amplify Gen 2 enables guest access by default, so every new app issues Amazon Cognito identity pool credentials to visitors who never sign in, unless a project explicitly disables it. Those same guest and authenticated identities are what Storage’s access rules key off: allow.guest and allow.entity(‘identity’) scope files to a path built from the caller’s identity ID, and a subpath’s permissions override its parent rather than adding to it, so a narrower rule further down a path can quietly remove access the parent path appeared to grant. Amplify’s storage documentation also notes that a user placed in a Cognito group is switched onto that group’s role, so permissions written for authenticated users stop applying to them unless the group is granted the same access explicitly.
None of this sits inside AppSync or Cognito at all. Amplify’s own guidance is explicit that environment variable values are rendered in plaintext to the build artifacts and warns against storing secrets in them, and separately that a frontend framework’s own prefixed variables, such as React’s REACT_APP_ or Gatsby’s GATSBY_, are bundled straight into the production build the browser downloads. A branch or preview deployment carries the same risk in a different shape: Amplify Hosting leaves every branch reachable at its own URL until access control is switched on, per branch or globally, so an unreleased feature or a staging copy of live data can sit at a guessable subdomain with no password unless someone configured one.
SCOPE
What we review in an AWS Amplify app
Data Model Authorisation Rules
Every model in the Amplify Data schema is checked against the allow.owner(), allow.authenticated(), allow.guest() and allow.publicApiKey() rules configured on it. We test what each rule actually exposes through the generated AppSync API, not just what the schema file says it should.
Field-Level Authorisation Overrides
A rule added at field level replaces the model-level rule for that field rather than adding to it, so a field meant to be locked down more tightly can end up with looser access if the field-level rule is incomplete. We test every field-level override against the model-level rule it replaces.
Global and Combined Authorisation Rules
A global authorisation rule left over from a getting-started schema, or several authorisation rules on the same type, are combined with OR instead of needing every rule to match. We check the schema for a leftover global rule and for combinations that grant more than any single rule intended.
Cognito User Pool and Identity Pool Configuration
Amplify Gen 2 enables guest access by default, issuing an unauthenticated identity pool role to every visitor who has not signed in. We review whether guest access is intended for your app, what the unauthenticated role can reach, and how the user pool’s own login methods and self-signup settings are configured.
Storage Access Rules and Path Overrides
Storage paths are denied to everyone until a rule grants guest, authenticated, group or per-identity access, and a rule on a subpath overrides its parent’s permissions rather than adding to them. We test each path against the access level it should carry, including what happens when a user’s Cognito group switches them off the authenticated role.
API Keys and Their Expiry
Where a model uses allow.publicApiKey(), anyone holding a valid AppSync API key can perform whatever the rule allows, no Cognito identity required. We check where keys are configured to expire, how key rotation is handled, and whether a key has reached client-side code or a public repository.
Build Secrets and Environment Variables in the Frontend Bundle
Amplify’s own guidance warns that environment variable values render in plaintext into the build artifacts, and that a frontend framework’s own prefixed variables are bundled straight into the production build the browser downloads. We check what actually ships in your build output against what Amplify’s separate secret management feature was meant to keep out of it.
Branch and Preview Deployment Access Control
Every connected branch gets its own Amplify Hosting URL, reachable by anyone who has it until access control is switched on for that branch or globally. We check which branches carry unreleased features or a copy of production data, and whether they are actually password protected.
Connected AWS Permissions and IAM Roles
Amplify provisions the Cognito identity pool behind your app, including the authenticated and unauthenticated IAM roles attached to it, and exposes them through the same CDK escape hatch used to change guest access. We review those roles, and any resource policies attached to them, for access wider than the app actually needs.
Custom Business Logic Beyond Amplify’s Generated Resources
Custom queries and mutations backed by a Lambda handler, and any Lambda function your team wired into the app outside what Amplify provisions, carry the same execution-role and event-trust risks as any Lambda function. If your estate includes standalone functions beyond the Amplify app itself, our serverless review covers them.
OUR PROCESS
AWS Amplify Application Security Review: From Scope to Attestation
Scope and Access
We agree the branches, environments and test accounts in scope, including whether guest access, a custom domain or password-protected branches need to be part of the review.
Map Authorisation Rules and Roles
We map every Data model’s authorisation rules, Storage path, Cognito group and API key against the access it should carry before any exploitation starts.
Manual Testing
CREST-certified testers exploit gaps between guest, owner, group and API key rules, and check build output and branch URLs for exposed secrets.
Reporting and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, and a free retest once fixes are deployed.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Amplify pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent AWS Amplify Application Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Amplify For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From AWS Amplify Application Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Amplify app?
Test accounts covering every role your Data schema defines, including a guest path if guest access is enabled, plus read access to your amplify/backend.ts, data and storage resource definitions so we can map the rules you have configured. For the hosting side we need the branch URLs in scope and, if any are password protected, the credentials to reach them.
Will testing touch our live data?
We test whichever environment you give us access to. If that is a production Amplify branch, we agree exclusions upfront, such as destructive writes and any Storage paths holding real customer files, and we do not run those tests against live data without agreement in writing.
How long does an Amplify security review take?
A single Amplify app or estate sits in our 3-day single-estate scope, with a report typically landing around 5 to 8 working days after kickoff. An app with a large number of custom roles, groups or a wide storage path structure moves into a wider scope.
Do you test both Amplify Gen 1 and Gen 2 apps?
Yes. Gen 2 backends are defined in TypeScript with defineData, defineAuth and defineStorage; Gen 1 apps configured through the Amplify CLI use the older public, protected and private storage prefixes and a category-based auth setup. We adjust our checks to whichever generation your app runs, and confirm which one during scoping.
What is out of scope for a single-estate Amplify review?
The underlying AWS services Amplify provisions, AppSync, Cognito, S3, DynamoDB and Lambda, are tested through your app’s configuration of them, not as standalone infrastructure. If your estate includes Lambda functions or an API surface well beyond what Amplify generates, that is scoped and quoted as a separate serverless or API review.
Do you need our AWS account credentials?
No. We work from application-level test accounts, a test API key and the branch URLs in scope. Where reviewing IAM role configuration directly is more reliable than inferring it through testing, read-only access to the relevant Amplify app and Cognito identity pool in the AWS console is enough; we never need write access to your AWS account.
Does AWS have a customer penetration-testing policy we need to follow?
AWS’s own customer penetration-testing policy lists AWS AppSync, AWS Lambda and Amazon CloudFront, the services behind an Amplify app’s API, functions and hosting, among the services customers may test without prior approval. Amazon Cognito and Amazon S3 are not named on that list either way, and AWS does not permit testing of its own infrastructure or services rather than your configuration of them. We confirm the current policy and any account-specific restrictions during scoping.
What if our app uses a custom domain or CloudFront distribution in front of Amplify Hosting?
We test whatever the domain actually resolves to, including any caching, header or redirect behaviour a CloudFront distribution adds in front of Amplify Hosting. Tell us about any CDN, WAF or additional proxy in the path during scoping so we can account for it.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Amplify review
Amplify denies everything by default, but the rules, keys and settings your team added decide what is actually exposed. We test those rules, your API keys, your build output and branch access. CREST-certified testers, fixed price from £3,350 for a 3-day single-estate scope, quoted within 24 hours.
