Last week a software company emailed me. They build on Amazon's Selling Partner API and needed their yearly pen test report. By the next email the real story came out. They had already run a test themselves. The work wasn't the problem, they told me. Independence was.
So I went and read what Amazon actually publishes. It's less clear than you'd want, and that's worth knowing before you spend the time.
What Amazon's text says
The Data Protection Policy has one short rule, in section 2.7.2: "Solution Provider must perform penetration testing at least every 365 days using an industry-recognized methodology." It doesn't say who has to do the testing.
Amazon's security control guidance gets closer. It says to test "using qualified security professionals or third-party firms." Read that literally and a qualified in-house team could count.
And I couldn't find an approved tester list, a required certification, or a signature format in the pages I read. So if anyone tells you they're Amazon approved, ask them to show you where.
So why the pushback on independence?
I don't know exactly what Amazon's reviewer said. I only have my customer's summary, and it's one case. But the logic isn't hard to follow. A report written by the people who built the system is them grading their own homework, however good they are. The written rule leaves room for in-house testers. A reviewer reading your report may still want more.
Plan for the stricter reading. If Amazon has already questioned your report, ask them in writing what they'll accept before you pay anyone, including me.
What an independent sign-off looks like
This part is my advice, not Amazon's wording. Your report should make these things obvious to someone who has never heard of you:
- Who tested. A named tester at a named company. They didn't build the system, don't run it, and don't report to the team that does.
- What was tested, and when. The scope, the test dates, and the report date.
- How it was tested. A named methodology, such as the OWASP Testing Guide or PTES, since the policy asks for an industry-recognized one.
- A signature. Someone at the testing company puts their name on it. An attestation letter covering the scope and dates is the easy thing to hand over.
What the report has to cover
My customer sent a list of what they needed in the report: test dates, methodology, findings by severity, remediation status for critical and high findings, application functionality, access controls, and system configuration. That lines up with Amazon's vulnerability management guide, which says testing must assess "external-facing components, application functionality, access controls, system configurations, and interfaces."
The same guide adds a few things people miss:
- The report must include a recommended actions section.
- After you fix things, you run a second test to confirm the fixes worked.
- Critical vulnerabilities get seven days to resolve, and high ones get 30.
Amazon also updated these rules effective August 25, 2026, with expanded testing requirements that specifically include APIs. So don't assume last year's report template still fits.
Two things that catch people out
You can't order the result. The list I got came with example values already filled in, including zero findings. A real report records the dates you actually tested and whatever actually turned up. If you find something, you fix it, retest, and the report shows it as fixed. That's a fine outcome.
An outside scan won't cover this. Access controls, MFA and sessions all sit behind the login, and a lot of SP-API apps are mostly API with very little web UI. Testing that takes real accounts. That's the difference between authenticated and unauthenticated testing, and it's why I told this customer our $495 external test wasn't the right fit.
Don't leave it to the end
An authenticated test takes back and forth. You set up a test account for each role, get MFA working on them, agree a test window, and allow a source IP. Then comes testing, fixes, and the retest. I had to tell this customer I couldn't do all that in the week they asked. So work backward from your Amazon date and start early.
If you need one, here's how our authenticated pen test works. It comes with a retest and an attestation letter. I can't promise Amazon will accept any given report, and nobody else can either. What I can give you is an outside tester's name on an honest one.