SP-API Guard FAQ

How is Selling Partner API Guard different from existing AWS security services and other third party tools?

Selling Partner API Guard checks your controls in the context of the Amazon's Data Protection Policy. It is not designed to replace other security services you are currently using for non-Selling Partner API compliance purpose.

What are the benefits of using Selling Partner API Guard?

Time savings - Selling Partner API Guard maps your controls to policy requirements, which means that you don’t need to manually collect documentation and screenshots. It also recommends remediation steps so that you can quickly revise your architecture.
Control over your assessments - For every scan, you can choose whether or not to share your findings report with Amazon. Selling Partner API Guard gives you full ownership to continuously assess and manage your security.
Support - The Selling Partner API Team offers you Solution Architect support for remediation and Developer Support in troubleshooting so that you can focus on growing your business.

What if I’m not currently using some of the AWS services that Selling Partner API Guard scans?

Selling Partner API Guard will enable necessary underlying AWS services in order to perform scans. After the scans are complete (24 hours), Selling Partner API Guard will automatically turn off any services that were activated for the scan.

Will Selling Partner API Guard affect my existing AWS services?

No, the AWS services that you already use will not be affected. Selling Partner API Guard will perform scans independently of your current setup, and will not alter any existing configurations.

How does Selling Partner API Guard protect my company’s confidential data?

Selling Partner API Guard follows the Least Privilege Principle by only collecting data that is necessary to set up the tool, including account information and IAM roles to grant a trust relationship. Selling Partner API Guard findings reports contain information about type and severity of security risk, policy reference, and remediation recommendations. Selling Partner API Guard will also collect operational information necessary to improve its scan rules such as error rates. However, it does not collect data about the specific tools within your environment or proprietary information itself, nor does it share that information with Amazon.

How do I submit a feature request?

You can open a support case with Developer Support.