{"id":50089,"date":"2026-11-12T19:26:31","date_gmt":"2026-11-12T13:56:31","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=50089"},"modified":"2026-11-12T19:26:38","modified_gmt":"2026-11-12T13:56:38","slug":"amazon-sp-api-dpp-checklist","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/security-audit\/amazon-sp-api-dpp-checklist\/","title":{"rendered":"Amazon SP-API DPP Checklist + Pentest Evidence Templates"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Access to Amazon\u2019s Selling Partner API comes with a condition: pass the Amazon data security assessment, and make sure the pentest report at the center of it says what you think it says.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most of the trouble we see isn\u2019t weak security, but rather a&nbsp;mismatch between what was tested and what the report claims was tested. One team\u2019s report listed its scope as Web App. The assessor flagged it, and the team spent time proving in writing that the APIs had been covered too.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide thus maps Amazon\u2019s Data Protection Policy (DPP) to the evidence an assessor expects to see, with fill-in templates for the pentest executive summary and engagement letter via an Amazon SP-API DPP checklist. Amazon decides whether an application meets its requirements through its own security-assessment process, and no vendor can promise approval. We won\u2019t either.<\/p>\n\n\n<div class=\"gb-container gb-container-e43a8917\">\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Key_takeaways\"><\/span><strong>Key takeaways<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Since the August update, Amazon has expanded vulnerability-scanning and penetration-testing requirements to include APIs explicitly. Your report should name APIs in scope and describe the API testing performed.<\/li>\n\n\n\n<li>More than security, the scope of the pentest can become a key contention, so name each asset explicitly: web app, APIs, cloud config, databases, storage.<\/li>\n\n\n\n<li>An unsigned, undated summary is worth very little to an assessor. Get the test dates in writing.<\/li>\n\n\n\n<li>Keep your scan logs. Fix deadlines can only be proven with dates.<\/li>\n<\/ul>\n\n<\/div>\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_the_Assessment_Works_and_Where_the_Pentest_Fits\"><\/span><strong>How the Assessment Works, and Where the Pentest Fits<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In simple terms, what applies to you from the Amazon SP-API DPP checklist, depends on your role.<\/p>\n\n\n\n<div id=\"tablepress-512-scroll-wrapper\" class=\"tablepress-scroll-wrapper\">\n<table id=\"tablepress-512\" class=\"tablepress tablepress-id-512 column1-color tablepress-responsive\">\n<thead>\n<tr class=\"row-1\">\n\t<th class=\"column-1\">Who<\/th><th class=\"column-2\">What applies<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"row-striping row-hover\">\n<tr class=\"row-2\">\n\t<td class=\"column-1\">All solution providers<\/td><td class=\"column-2\">DPP general security requirements, for every system that stores, processes or handles SP-API data.<\/td>\n<\/tr>\n<tr class=\"row-3\">\n\t<td class=\"column-1\">Restricted roles (PII)<\/td><td class=\"column-2\">Additional PII requirements, including the annual pentest and the remediation clocks.<\/td>\n<\/tr>\n<tr class=\"row-4\">\n\t<td class=\"column-1\">Public developers seeking restricted roles<\/td><td class=\"column-2\">An application review covering your PII data flows and protection controls, followed by a Phase 2 data security assessment of data-flow architecture and PII controls.<\/td>\n<\/tr>\n<tr class=\"row-5\">\n\t<td class=\"column-1\">Private developers<\/td><td class=\"column-2\">Still subject to the DPP, the Acceptable Use Policy and the Solution Provider Portal Agreement for the Amazon data they access.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<!-- #tablepress-512 from cache -->\n\n\n\n<p class=\"wp-block-paragraph\">While a pentest report tells an assessor the application was tested properly, it doesn\u2019t say anything about how you encrypt backups, who can still log in after leaving, or what happens in the first hour of an incident.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Be careful not to just pour effort into the test and leave the rest until the assessor asks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some such requirements that shape the pentest and possibly its scope the most include:<\/p>\n\n\n\n<div id=\"tablepress-513-scroll-wrapper\" class=\"tablepress-scroll-wrapper\">\n<table id=\"tablepress-513\" class=\"tablepress tablepress-id-513 column1-color tablepress-responsive\">\n<thead>\n<tr class=\"row-1\">\n\t<th class=\"column-1\">Requirement<\/th><th class=\"column-2\">Source<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"row-striping row-hover\">\n<tr class=\"row-2\">\n\t<td class=\"column-1\">Annual pentest, industry-recognized methodology<\/td><td class=\"column-2\">Vulnerability Management guide<\/td>\n<\/tr>\n<tr class=\"row-3\">\n\t<td class=\"column-1\">Scope covering network, cloud, web apps, APIs, databases and file\/object storage<\/td><td class=\"column-2\">Vulnerability Management guide; policy update, Aug 25, 2026<\/td>\n<\/tr>\n<tr class=\"row-4\">\n\t<td class=\"column-1\">Retest after remediation<\/td><td class=\"column-2\">Vulnerability Management guide<\/td>\n<\/tr>\n<tr class=\"row-5\">\n\t<td class=\"column-1\">Scans every 30 days, after significant changes, plus code scans before release<\/td><td class=\"column-2\">Vulnerability Management guide<\/td>\n<\/tr>\n<tr class=\"row-6\">\n\t<td class=\"column-1\">Critical findings fixed in 7 days, high in 30<\/td><td class=\"column-2\">Vulnerability Management guide<\/td>\n<\/tr>\n<tr class=\"row-7\">\n\t<td class=\"column-1\">Report with recommended actions<\/td><td class=\"column-2\">Vulnerability Management guide<\/td>\n<\/tr>\n<tr class=\"row-8\">\n\t<td class=\"column-1\">WAF on internet-facing endpoints, encrypted credentials at rest, named incident contact (IMPOC)<\/td><td class=\"column-2\">Policy update, Aug 25, 2026<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<!-- #tablepress-513 from cache -->\n\n\n\n<p class=\"wp-block-paragraph\">Most people read the <a href=\"https:\/\/developer.amazonservices.com\/policy-update-for-sp-api\" target=\"_blank\" rel=\"noopener\">August update<\/a> too late. It extended pentest and scanning expectations to APIs and added the WAF, credential-encryption, and incident-contact requirements. Continued use of SP-API counts as accepting it, so check any report scoped before 25 August against the new language before it goes to an assessor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Amazon does offer a voluntary <a href=\"https:\/\/developer-docs.amazon\/sp-api\/docs\/policies-and-agreements\" target=\"_blank\" rel=\"noopener\"><strong>self-assessment questionnaire<\/strong><\/a> under Policies and Agreements, which can be a useful internal readiness exercise, but it doesn\u2019t replace the formal assessment with a control map to list each DPP control against an owner, current state, evidence location, gap, and due date.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Amazon_SP-API_DPP_Checklist\"><\/span><strong>Amazon SP-API DPP Checklist<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Treat this as a working list. Amazon\u2019s wording changes, so confirm it against your own assessment request.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1. Access management<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Access is limited to authorized personnel, removed promptly when someone leaves or changes role, and revoked for unused or compromised programmatic access.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Amazon\u2019s updated policy explicitly requires a 30-minute lockout after ten failed login attempts. Multi-factor authentication is a strong supporting control, but confirm the exact requirement in your own assessment request before presenting it as mandatory.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Some of the key evidence you\u2019ll need includes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Access-review log<\/li>\n\n\n\n<li>Joiner-mover-leaver procedure<\/li>\n\n\n\n<li>Export or screenshot of role assignments<\/li>\n\n\n\n<li>Offboarding ticket<\/li>\n\n\n\n<li>API key and token revocation record<\/li>\n\n\n\n<li>MFA and lockout configuration<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2. Encryption<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Encrypt PII at rest with AES-128 or stronger (AES-256 preferred), or RSA-2048 or stronger. SP-API credentials must also be encrypted at rest and stored securely. Teams tend to evidence one of these and forget the other.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Some of the key evidence you\u2019ll need includes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Encryption configuration for databases, disks, backups, and object storage<\/li>\n\n\n\n<li>KMS, i.e., key-management evidence, plus TLS configuration<\/li>\n\n\n\n<li>Secret-manager inventory and a code search showing no hardcoded credentials<\/li>\n\n\n\n<li>Key-rotation policy<\/li>\n\n\n\n<li>Cloud configuration review for the platforms you run on.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Note: In our experience, assessors have asked for this to back up encryption, MFA, lockout, and WAF claims, even if cloud config review isn\u2019t a named Amazon requirement.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3. Logging and monitoring<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Log every channel that provides access to information, protect the logs from tampering, and test your alerting. An alert that has never fired in a test is an assumption.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Some of the key evidence you\u2019ll need includes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log-retention policy<\/li>\n\n\n\n<li>Centralized log sample<\/li>\n\n\n\n<li>Alert-rule export and an alert test record<\/li>\n\n\n\n<li>Access-control settings on log stores<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4. <a href=\"https:\/\/developer-docs.amazon\/sp-api\/docs\/protecting-amazon-sp-api-applications-incident-response\" target=\"_blank\" rel=\"noopener\">Incident response (24-hour notice)<\/a><\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Amazon expects a senior-management-approved plan, reviewed every six months, with defined roles, escalation paths, and a named incident contact (IMPOC). Notice goes to dpp@amazon.com within 24 hours of detection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Some of the key evidence you\u2019ll need includes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Approved plan with a review sign-off within the last six months<\/li>\n\n\n\n<li>IMPOC name, role, email, and phone, confirmed current and shared with Amazon<\/li>\n\n\n\n<li>Escalation path and contact list<\/li>\n\n\n\n<li>Incident ticket template<\/li>\n\n\n\n<li>The 24-hour notification procedure<\/li>\n\n\n\n<li>Incident documentation, remediation actions and corrective controls, retained so they can be produced on request<\/li>\n\n\n\n<li>Evidence of tabletop or operational testing<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>5. <a href=\"https:\/\/developer-docs.amazon\/sp-api\/docs\/protecting-amazon-api-applications-data-encryption-and-recovery\" target=\"_blank\" rel=\"noopener\">Retention and deletion<\/a><\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Delete information within 30 days from live stores, backups, and other copies to keep your PII exposure low. Anonymization or hashing doesn\u2019t count.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Some of the key evidence you\u2019ll need includes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data-retention schedule<\/li>\n\n\n\n<li>Deletion job logs<\/li>\n\n\n\n<li>PII inventory or data-flow map<\/li>\n\n\n\n<li>Deletion verification across live systems and backups<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>6. Vulnerability management<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Amazon wants a pentest within the last 12 months, scans on a 30-day cycle and after significant changes, and critical and high findings closed within 7 and 30 days, with a retest to show it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Some of the <a href=\"https:\/\/developer-docs.amazon\/sp-api\/docs\/vulnerability-management\" target=\"_blank\" rel=\"noopener\">key evidence<\/a> you\u2019ll need includes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Pentest report from the last 12 months, naming the methodology<\/li>\n\n\n\n<li>Scan reports every 30 days and after significant changes<\/li>\n\n\n\n<li>Code scans before each release<\/li>\n\n\n\n<li>Tickets showing critical and high findings closed on time<\/li>\n\n\n\n<li>Retest results<\/li>\n\n\n\n<li>A recommended actions section in the report<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>7. Backups and disaster recovery<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Documented procedures to restore PII availability, a geographically separated backup site, defined RTO and RPO, and restore tests that are actually documented.<\/p>\n\n\n\n<div id=\"tablepress-514-scroll-wrapper\" class=\"tablepress-scroll-wrapper\">\n<table id=\"tablepress-514\" class=\"tablepress tablepress-id-514 column1-color tablepress-responsive\">\n<thead>\n<tr class=\"row-1\">\n\t<th class=\"column-1\">Requirement<\/th><th class=\"column-2\">Evidence to retain<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"row-striping row-hover\">\n<tr class=\"row-2\">\n\t<td class=\"column-1\">Recovery procedures<\/td><td class=\"column-2\">DR plan, runbook, owners, escalation path<\/td>\n<\/tr>\n<tr class=\"row-3\">\n\t<td class=\"column-1\">Separate backup site<\/td><td class=\"column-2\">Architecture diagram, region or AZ evidence, configuration export<\/td>\n<\/tr>\n<tr class=\"row-4\">\n\t<td class=\"column-1\">RTO and RPO<\/td><td class=\"column-2\">Approved targets, service mapping, recovery workflow<\/td>\n<\/tr>\n<tr class=\"row-5\">\n\t<td class=\"column-1\">Restore testing<\/td><td class=\"column-2\">Schedule, test date, result, issues found, corrective actions, approver sign-off<\/td>\n<\/tr>\n<tr class=\"row-6\">\n\t<td class=\"column-1\">Backup protection<\/td><td class=\"column-2\">Encryption-at-rest config, access controls, retention or immutability settings<\/td>\n<\/tr>\n<tr class=\"row-7\">\n\t<td class=\"column-1\">Deletion across copies<\/td><td class=\"column-2\">Procedure covering backups, archives and replicas, plus deletion logs<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<!-- #tablepress-514 from cache -->\n\n\n\n<h3 class=\"wp-block-heading\"><strong>8. Network and endpoint controls<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Firewalls, anti-malware, secure connections, a WAF on internet-facing endpoints, device-storage encryption, screen lock and failed-login lockout.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Some of the key evidence you\u2019ll need includes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WAF configuration<\/li>\n\n\n\n<li>Firewall rules<\/li>\n\n\n\n<li>Endpoint policy and MDM or device-encryption evidence<\/li>\n\n\n\n<li>Lockout configuration<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_Pentest_Evidence_Pack\"><\/span><strong>The Pentest Evidence Pack<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">While Amazon doesn\u2019t prescribe a report format, the evidence pack you submit should be able to answer the assessor\u2019s questions before they ask them. In practice an ideal pentest evidence includes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>A signed, dated executive summary<\/li>\n\n\n\n<li>An engagement letter with test dates<\/li>\n\n\n\n<li>A named methodology (OWASP WSTG, PTES and NIST SP 800-115 are the usual ones), with manual and automated testing both stated<\/li>\n\n\n\n<li>A scope listing every asset, including APIs, databases, and object storage<\/li>\n\n\n\n<li>Findings by severity<\/li>\n\n\n\n<li>Remediation status<\/li>\n\n\n\n<li>Limitations and exclusions<\/li>\n\n\n\n<li>Tester names and authorization<\/li>\n\n\n\n<li>Retest results<\/li>\n\n\n\n<li>Recommended actions<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pro tip:<\/strong> The exact production URLs and asset identifiers from your Amazon submission should appear in the report and any supporting evidence. Any mismatch between what you submitted and what was tested invites questions and inevitably a longer timeline.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Template_Executive_Summary\"><\/span><strong>Template: Executive Summary<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Copy this into your own document and fill in the brackets. The testing firm should complete and sign it. This is a working format, not an Amazon-issued form, and a pentest lead should review it before you submit it for a final review.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<h3 class=\"wp-block-heading\">PENETRATION TEST EXECUTIVE SUMMARY<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Client\/Solution Provider: [Company legal name]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Application\/System: [Product or system name]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Amazon SP-API App ID (if applicable): [App ID]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Test period: [Start date] to [End date]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Report date: [Date]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Report version: [v1.0]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Testing organization: [Firm or internal team]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Lead tester: [Name, title]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Tester(s): [Names]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Authorization: [Engagement letter reference \/ approver name and date]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Business objective:<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>[One or two sentences on the system, its SP-API integration,<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>and the purpose of the assessment.]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Scope tested:<\/strong><\/em><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em>Web application: [URL(s) \/ environment(s)]<\/em><\/li>\n\n\n\n<li><em>APIs: [Public endpoints, SP-API integration endpoints, admin APIs]<\/em><\/li>\n\n\n\n<li><em>Cloud environment: [Account(s), services, regions]<\/em><\/li>\n\n\n\n<li><em>Databases: [Types and environments]<\/em><\/li>\n\n\n\n<li><em>Object\/file storage: [S3 buckets or equivalent]<\/em><\/li>\n\n\n\n<li><em>Network boundaries: [External-facing systems, firewalls, VPNs]<\/em><\/li>\n\n\n\n<li><em>Exclusions: [Assets, environments or attack types excluded]<\/em><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Methodology:<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>[Named methodology, e.g. OWASP WSTG \/ PTES \/ NIST SP 800-115, and phases:<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>planning, discovery, exploitation, analysis, reporting, remediation<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>validation. State that testing combined manual and automated techniques.]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Overall result:<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>[Pass \/ Pass with observations \/ Fail]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>[One-paragraph plain-English conclusion.]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Findings summary:<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Critical: [n]&nbsp; High: [n]&nbsp; Medium: [n]&nbsp; Low: [n]&nbsp; Informational: [n]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Key risks:<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>1. [Finding title &#8211; severity &#8211; business impact]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>2. [Finding title &#8211; severity &#8211; business impact]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>3. [Finding title &#8211; severity &#8211; business impact]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Remediation status:<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>[All critical\/high remediated and retested \/ exceptions listed below]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Retest date: [Date]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Retest result: [Pass \/ outstanding items]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Recommended actions:<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>[List]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Limitations:<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>[Constraints, credentials, excluded systems, time window]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Sign-off:<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Tester name\/signature\/date: ______________________<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Client approver name\/signature\/date: ______________<\/em><\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Template_Engagement_Letter\"><\/span><strong>Template: Engagement Letter<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Like the summary, this should come from the testing firm. It records who tested, what was covered, and when.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<h3 class=\"wp-block-heading\">PENETRATION TESTING ENGAGEMENT LETTER<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Date: [Date]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Client: [Company legal name]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Address: [Address]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Authorized representative: [Name, title, email]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Testing provider: [Company or individual]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Lead tester: [Name, title]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Contact: [Email \/ phone]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>1. Purpose<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>[Testing provider] will perform a penetration test of [system\/application]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>to identify exploitable security weaknesses and provide remediation guidance.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>2. Authorization<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>The Client authorizes testing of only the systems and assets listed below,<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>during the agreed window and within the agreed scope.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>3. Test window<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Start: [Date\/time, timezone]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>End: [Date\/time, timezone]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Emergency stop contact: [Name, phone, email]<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>4. Scope<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>In scope:<\/em><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em>Web application: [URLs \/ environments]<\/em><\/li>\n\n\n\n<li><em>APIs: [Endpoints, including SP-API-facing endpoints]<\/em><\/li>\n\n\n\n<li><em>Cloud environment: [Accounts, services, configurations]<\/em><\/li>\n\n\n\n<li><em>Databases: [Systems and environments]<\/em><\/li>\n\n\n\n<li><em>Object storage: [Buckets \/ storage services]<\/em><\/li>\n\n\n\n<li><em>Network components: [Firewalls, routers, VPN endpoints]<\/em><\/li>\n\n\n\n<li><em>Mobile\/desktop applications: [If applicable]<\/em><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Out of scope:<\/em><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em>[Third-party SaaS, payment processing, physical sites, etc.]<\/em><\/li>\n\n\n\n<li><em>[Prohibited attack types, e.g. DoS, destructive testing, social engineering]<\/em><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>5. Methodology<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Testing will follow: [OWASP WSTG\/PTES\/NIST SP 800-115\/other].<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Activities may include reconnaissance, vulnerability identification,<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>controlled exploitation, configuration review, API testing and reporting.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>6. Data handling<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>The testing provider will not retain, disclose or use Client data except as<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>necessary to perform and document the engagement. Evidence will be stored<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>securely and deleted or returned according to: [retention\/destruction terms].<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>7. Deliverables<\/strong><\/em><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em>Scope confirmation<\/em><\/li>\n\n\n\n<li><em>Penetration test report and executive summary<\/em><\/li>\n\n\n\n<li><em>Findings and remediation recommendations<\/em><\/li>\n\n\n\n<li><em>Retest report, where applicable<\/em><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>8. Confidentiality<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Both parties will keep engagement details, findings, credentials and data<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>confidential except where disclosure is legally required or authorized in writing.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>9. Signatures<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Client authorized representative: ______________&nbsp; Date: ______<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Testing provider authorized representative: ______&nbsp; Date: ______<\/em><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Before submitting the same, do have some qualified legal and security professionals review this to confirm&nbsp; scope boundaries, rules of engagement, emergency contacts, data handling, liability and jurisdiction language, and whether you need an engagement letter, a statement of work, or a rules-of-engagement document.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Scope_Wording_that_Wont_Get_Flagged\"><\/span><strong>Scope Wording that Won\u2019t Get Flagged<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most scope problems come down to vague wording issues, i.e.,&nbsp; a scope that says Web App leaves the assessor to guess whether the APIs were tested, and they will ask for written proof.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The solution is simple: name every asset class, and name it the way your submission does.<\/p>\n\n\n\n<div id=\"tablepress-515-scroll-wrapper\" class=\"tablepress-scroll-wrapper\">\n<table id=\"tablepress-515\" class=\"tablepress tablepress-id-515 column1-color tablepress-responsive\">\n<thead>\n<tr class=\"row-1\">\n\t<th class=\"column-1\">Vague scope<\/th><th class=\"column-2\">Say this instead<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"row-striping row-hover\">\n<tr class=\"row-2\">\n\t<td class=\"column-1\">Web App<\/td><td class=\"column-2\">Web app and APIs, with API testing aligned to the OWASP API Security Top 10<\/td>\n<\/tr>\n<tr class=\"row-3\">\n\t<td class=\"column-1\">Cloud<\/td><td class=\"column-2\">Cloud configuration review, naming the platform (AWS, Azure, Cloudflare)<\/td>\n<\/tr>\n<tr class=\"row-4\">\n\t<td class=\"column-1\">Database<\/td><td class=\"column-2\">Databases, naming the engine and environment<\/td>\n<\/tr>\n<tr class=\"row-5\">\n\t<td class=\"column-1\">Storage<\/td><td class=\"column-2\">Object or blob storage, naming the service<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<!-- #tablepress-515 from cache -->\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sample scope statement<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In scope: the production web application at <a href=\"https:\/\/app.example.com\" target=\"_blank\" rel=\"noopener\">https:\/\/app.example.com<\/a>, its REST APIs, SP-API integration endpoints, AWS environment 123456789012 in us-east-1, associated RDS\/PostgreSQL databases, S3 buckets storing seller or order data, IAM policies and cloud configuration, and public-facing network boundaries.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sample API coverage statement<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">API testing here addresses authentication, authorization, object-level access control, injection, mass assignment, excessive data exposure, unrestricted resource consumption, security misconfiguration, and inventory and versioning risks, consistent with the OWASP API Security Top 10.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Have your pentest lead confirm the exact wording against your own submission.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Scan_Evidence_Keep_the_30-day_Logs\"><\/span><strong>Scan Evidence: Keep the 30-day Logs<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Scans are the part teams forget. Amazon expects them at least every 30 days, after significant network, application, or infrastructure changes, and as code scans before each release. A fix deadline only means something if the log shows when the finding was detected and when it was closed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reconstructing six months of scan history in the week an assessor asks for it is where gaps appear, and human error peaks as they become harder to explain months after the fact. Instead, collect the data as you go, keep the raw scanner output, remediation tickets, change requests and retest evidence, not just the final PDF.<\/p>\n\n\n\n<div id=\"tablepress-516-scroll-wrapper\" class=\"tablepress-scroll-wrapper\">\n<table id=\"tablepress-516\" class=\"tablepress tablepress-id-516 column1-color tablepress-responsive\">\n<thead>\n<tr class=\"row-1\">\n\t<th class=\"column-1\">Date<\/th><th class=\"column-2\">Trigger<\/th><th class=\"column-3\">Asset<\/th><th class=\"column-4\">Scan type<\/th><th class=\"column-5\">Tool<\/th><th class=\"column-6\">Crit<\/th><th class=\"column-7\">High<\/th><th class=\"column-8\">Med<\/th><th class=\"column-9\">Low<\/th><th class=\"column-10\">Fix due<\/th><th class=\"column-11\">Status<\/th><th class=\"column-12\">Evidence<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"row-striping row-hover\">\n<tr class=\"row-2\">\n\t<td class=\"column-1\">[Date]<\/td><td class=\"column-2\">Monthly<\/td><td class=\"column-3\">[Production web app]<\/td><td class=\"column-4\">External vuln scan<\/td><td class=\"column-5\">[Tool]<\/td><td class=\"column-6\">[n]<\/td><td class=\"column-7\">[n]<\/td><td class=\"column-8\">[n]<\/td><td class=\"column-9\">[n]<\/td><td class=\"column-10\">[Date]<\/td><td class=\"column-11\">[Status]<\/td><td class=\"column-12\">[Link]<\/td>\n<\/tr>\n<tr class=\"row-3\">\n\t<td class=\"column-1\">[Date]<\/td><td class=\"column-2\">Infra change<\/td><td class=\"column-3\">[AWS \/ API gateway]<\/td><td class=\"column-4\">Change-triggered<\/td><td class=\"column-5\">[Tool]<\/td><td class=\"column-6\">[n]<\/td><td class=\"column-7\">[n]<\/td><td class=\"column-8\">[n]<\/td><td class=\"column-9\">[n]<\/td><td class=\"column-10\">[Date]<\/td><td class=\"column-11\">[Status]<\/td><td class=\"column-12\">[Link]<\/td>\n<\/tr>\n<tr class=\"row-4\">\n\t<td class=\"column-1\">[Date]<\/td><td class=\"column-2\">Release [ver]<\/td><td class=\"column-3\">[Repository]<\/td><td class=\"column-4\">SAST \/ DAST<\/td><td class=\"column-5\">[Tool]<\/td><td class=\"column-6\">[n]<\/td><td class=\"column-7\">[n]<\/td><td class=\"column-8\">[n]<\/td><td class=\"column-9\">[n]<\/td><td class=\"column-10\">Before release<\/td><td class=\"column-11\">[Status]<\/td><td class=\"column-12\">[Link]<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<!-- #tablepress-516 from cache -->\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_Astra_can_Help\"><\/span><strong>How Astra can Help<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An SP-API pentest is a scope and evidence exercise, so we build ours that way. Scope is named to the DPP: web app, APIs, cloud, databases, and storage.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"2078\" height=\"1764\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/01\/b15f7b7b-my.getastra.com_overview_productapi-security-1.png\" alt=\"API dashboard overview\" class=\"wp-image-45210\" srcset=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/01\/b15f7b7b-my.getastra.com_overview_productapi-security-1.png 2078w, \/cdn-cgi\/image\/width=1536,height=1304,fit=crop,quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/01\/b15f7b7b-my.getastra.com_overview_productapi-security-1.png 1536w, \/cdn-cgi\/image\/width=2048,height=1739,fit=crop,quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/01\/b15f7b7b-my.getastra.com_overview_productapi-security-1.png 2048w\" sizes=\"auto, (max-width: 2078px) 100vw, 2078px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You get a signed, dated executive summary, an engagement letter with test dates, and a retest. AI-powered testing starts within 24 hours while certified human pentesters run the manual work. Amazon decides the outcome. We make sure the evidence holds up.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.getastra.com\/contact-us\">Get started today!<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Final_Thoughts\"><\/span><strong>Final Thoughts<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The August update is a useful reminder that the SP-API bar moves. APIs were added to the pentest scope, a WAF and a named incident contact became requirements, and anyone who kept using the API accepted all of it without a form to sign.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The next revision will probably tighten something else, and a team that scrambles for evidence every time will always be a step behind it. The ones who cope best treat the assessment as a by-product of how they already work, so nothing has to be reconstructed when Amazon asks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">None of that is hard, but it does mean someone has to own it before the deadline is tomorrow. Security that can\u2019t be shown to an assessor is, for the purposes of keeping API access, security you haven\u2019t got. A penetration test report template is only as good as what it lets someone else verify, which is the best reason to get the paperwork right.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span><strong>FAQ<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1794385590669\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Does a vendor\u2019s report guarantee approval?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Amazon decides whether an application meets its requirements through its own security-assessment process. A complete, accurate evidence pack compiled via the Amazon SP-API DPP checklist supports that process and makes questions easier to answer, but no vendor can promise approval, and anyone who does is overselling what a report can do.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794385599670\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>How often do I need a pentest?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Pentests need to be done annually, using an industry-recognized methodology such as OWASP WSTG, PTES, or NIST SP 800-115, while vulnerability scans are done at least every 30 days, and again after significant network, application, or infrastructure changes. Code scans before each release sit alongside both<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794385611037\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Does the pentest need to cover APIs?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes, the August 25, 2026 policy update extended pentest and scanning requirements to APIs, so a report scoped before that date may no longer be enough. Name your APIs in the scope, and state that testing followed the OWASP API Security Top 10, so nobody has to ask.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794385620835\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Do I need a retest?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. Amazon expects a proper retest to confirm that identified vulnerabilities were actually fixed post-remediation, whereby critical findings are due within 7 days and high within 30, so plan the retest around those clocks and keep the results, with dates, alongside the original report and remediation tickets.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794385631323\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Are these templates official Amazon forms?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. They are working formats, built around what assessors commonly ask to see, and a pentest lead should review them before use. Amazon doesn\u2019t issue a standard report form, so follow any instructions in your own assessment request first, and treat these as a starting point.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1794385642589\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Does SP-API Guard replace a pentest?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No, SP-API Guard is an assessment aid that returns a recommendation report for identified gaps within about a day. Amazon separately requires scans, change-triggered scans, pre-release code scans, and the annual pentest, so keep the Guard report, remediation tickets, and fix evidence, with dates, as supporting records.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Access to Amazon\u2019s Selling Partner API comes with a condition: pass the Amazon data security assessment, and make sure the pentest report at the center of it says what you think it says. Most of the trouble we see isn\u2019t weak security, but rather a&nbsp;mismatch between what was tested and what the report claims was &#8230; <a title=\"Amazon SP-API DPP Checklist + Pentest Evidence Templates\" class=\"read-more\" href=\"https:\/\/www.getastra.com\/blog\/security-audit\/amazon-sp-api-dpp-checklist\/\" aria-label=\"Read more about Amazon SP-API DPP Checklist + Pentest Evidence Templates\">Read more<\/a><\/p>\n","protected":false},"author":111,"featured_media":50101,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[340],"tags":[],"class_list":["post-50089","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-audit"],"_links":{"self":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/50089","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/users\/111"}],"replies":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/comments?post=50089"}],"version-history":[{"count":2,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/50089\/revisions"}],"predecessor-version":[{"id":50257,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/50089\/revisions\/50257"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media\/50101"}],"wp:attachment":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media?parent=50089"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/categories?post=50089"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/tags?post=50089"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}