See Which Cloud Config Breaks DPDPA Rule 6

The scanner requires a read-only IAM role with AWS's SecurityAudit managed policy (arn:aws:iam::aws:policy/SecurityAudit). This gives read access to security configuration metadata — it cannot read S3 object contents, database data, or any personal data. We use STS AssumeRole with an External ID for security — no access keys are stored in DPDPA Shield. You create the role in your AWS console and provide only the Role ARN.

The primary obligation is DPDPA Rule 6(1): Security Safeguards. Rule 6(1)(a) requires encryption of personal data in transit and at rest — directly mapped to RDS encryption and S3 encryption findings. Rule 6(1)(b) requires access control — mapped to IAM policy findings. Rule 6(1)(c) covers monitoring and logging — mapped to CloudTrail and CloudWatch findings. Each finding in the dashboard shows the exact rule clause it violates.

Phase 1 (current): S3 (public access blocking, default encryption), CloudTrail (multi-region logging enabled, log file validation), RDS (encryption at rest on all instances), IAM (password policy strength, MFA on root, access key rotation), CloudWatch (billing alarm, root account activity alarm). GCP and Azure support is on the roadmap for a future phase.

Each finding has a scoreImpact value (e.g., +12) that represents the compliance score points you gain by resolving it. The impact is calculated from the control weight, severity, and the number of active findings in that category. The total score improvement shown when you filter by severity tells you the maximum compliance score improvement available from fixing those issues.

Business plan: 1 connected AWS account. Enterprise plan: unlimited accounts. Each account has its own connection, scanning schedule, and findings list. The compliance score aggregates findings across all connected accounts.