AWS Well-Architected Security Pillar: the evidence behind each requirement

63 best practices. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Security Foundations

SEC01-BP01Separate workloads using accounts moderate SEC01-BP02Secure account root user and properties easy SEC01-BP03Identify and validate control objectives hard SEC01-BP04Stay up to date with security threats and recommendations hard SEC01-BP05Reduce security management scope hard SEC01-BP06Automate deployment of standard security controls easy SEC01-BP07Identify threats and prioritize mitigations using a threat model hard SEC01-BP08Evaluate and implement new security services and features regularly moderate

Identity & Access Management

SEC02-BP01Use strong sign-in mechanisms easy SEC02-BP02Use temporary credentials moderate SEC02-BP03Store and use secrets securely easy SEC02-BP04Rely on a centralized identity provider easy SEC02-BP05Audit and rotate credentials periodically easy SEC02-BP06Employ user groups and attributes moderate SEC03-BP01Define access requirements hard SEC03-BP02Grant least privilege access moderate SEC03-BP03Establish emergency access process easy SEC03-BP04Reduce permissions continuously easy SEC03-BP05Define permission guardrails for your organization moderate SEC03-BP06Manage access based on lifecycle moderate SEC03-BP07Analyze public and cross-account access moderate SEC03-BP08Share resources securely within your organization hard SEC03-BP09Share resources securely with a third party easy

Detection

SEC04-BP01Configure service and application logging easy SEC04-BP02Capture logs, findings, and metrics in standardized locations easy SEC04-BP03Correlate and enrich security alerts hard SEC04-BP04Initiate remediation for non-compliant resources moderate

Infrastructure Protection

SEC05-BP01Create network layers easy SEC05-BP02Control traffic flow within your network layers moderate SEC05-BP03Implement inspection-based protection easy SEC05-BP04Automate network protection easy SEC06-BP01Perform vulnerability management easy SEC06-BP02Provision compute from hardened images moderate SEC06-BP03Reduce manual management and interactive access easy SEC06-BP04Validate software integrity hard SEC06-BP05Automate compute protection easy

Data Protection

SEC07-BP01Understand your data classification scheme hard SEC07-BP02Apply data protection controls based on data sensitivity easy SEC07-BP03Automate identification and classification moderate SEC07-BP04Define scalable data lifecycle management hard SEC08-BP01Implement secure key management moderate SEC08-BP02Enforce encryption at rest easy SEC08-BP03Automate data at rest protection hard SEC08-BP04Enforce access control easy SEC09-BP01Implement secure key and certificate management easy SEC09-BP02Enforce encryption in transit easy SEC09-BP03Authenticate network communications easy

Incident Response

SEC10-BP01Identify key personnel and external resources hard SEC10-BP02Develop incident management plans hard SEC10-BP03Prepare forensic capabilities hard SEC10-BP04Develop and test security incident response playbooks hard SEC10-BP05Pre-provision access hard SEC10-BP06Pre-deploy tools moderate SEC10-BP07Run simulations hard SEC10-BP08Establish a framework for learning from incidents hard

Application Security

SEC11-BP01Train for application security moderate SEC11-BP02Automate testing throughout the development and release lifecycle easy SEC11-BP03Perform regular penetration testing hard SEC11-BP04Conduct code reviews easy SEC11-BP05Centralize services for packages and dependencies hard SEC11-BP06Deploy software programmatically easy SEC11-BP07Regularly assess security properties of the pipelines hard SEC11-BP08Build a program that embeds security ownership in workload teams moderate