AWS Well-Architected Security Pillar: the evidence behind every control

63 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Security Foundations

SEC01-BP01Separate workloads using accounts hard SEC01-BP02Secure account root user and properties easy SEC01-BP03Identify and validate control objectives hard SEC01-BP04Stay up to date with security threats and recommendations hard SEC01-BP05Reduce security management scope hard SEC01-BP06Automate deployment of standard security controls easy SEC01-BP07Identify threats and prioritize mitigations using a threat model hard SEC01-BP08Evaluate and implement new security services and features regularly moderate

Identity & Access Management

SEC02-BP01Use strong sign-in mechanisms easy SEC02-BP02Use temporary credentials moderate SEC02-BP03Store and use secrets securely moderate SEC02-BP04Rely on a centralized identity provider easy SEC02-BP05Audit and rotate credentials periodically easy SEC02-BP06Employ user groups and attributes hard SEC03-BP01Define access requirements hard SEC03-BP02Grant least privilege access hard SEC03-BP03Establish emergency access process moderate SEC03-BP04Reduce permissions continuously moderate SEC03-BP05Define permission guardrails for your organization hard SEC03-BP06Manage access based on lifecycle moderate SEC03-BP07Analyze public and cross-account access moderate SEC03-BP08Share resources securely within your organization hard SEC03-BP09Share resources securely with a third party hard

Detection

SEC04-BP01Configure service and application logging easy SEC04-BP02Capture logs, findings, and metrics in standardized locations moderate SEC04-BP03Correlate and enrich security alerts moderate SEC04-BP04Initiate remediation for non-compliant resources moderate

Infrastructure Protection

SEC05-BP01Create network layers moderate SEC05-BP02Control traffic flow within your network layers moderate SEC05-BP03Implement inspection-based protection moderate SEC05-BP04Automate network protection easy SEC06-BP01Perform vulnerability management easy SEC06-BP02Provision compute from hardened images hard SEC06-BP03Reduce manual management and interactive access easy SEC06-BP04Validate software integrity hard SEC06-BP05Automate compute protection easy

Data Protection

SEC07-BP01Understand your data classification scheme hard SEC07-BP02Apply data protection controls based on data sensitivity hard SEC07-BP03Automate identification and classification easy SEC07-BP04Define scalable data lifecycle management hard SEC08-BP01Implement secure key management moderate SEC08-BP02Enforce encryption at rest hard SEC08-BP03Automate data at rest protection moderate SEC08-BP04Enforce access control moderate SEC09-BP01Implement secure key and certificate management easy SEC09-BP02Enforce encryption in transit moderate SEC09-BP03Authenticate network communications easy

Incident Response

SEC10-BP01Identify key personnel and external resources hard SEC10-BP02Develop incident management plans hard SEC10-BP03Prepare forensic capabilities hard SEC10-BP04Develop and test security incident response playbooks moderate SEC10-BP05Pre-provision access hard SEC10-BP06Pre-deploy tools hard SEC10-BP07Run simulations hard SEC10-BP08Establish a framework for learning from incidents hard

Application Security

SEC11-BP01Train for application security hard SEC11-BP02Automate testing throughout the development and release lifecycle moderate SEC11-BP03Perform regular penetration testing hard SEC11-BP04Conduct code reviews hard SEC11-BP05Centralize services for packages and dependencies hard SEC11-BP06Deploy software programmatically easy SEC11-BP07Regularly assess security properties of the pipelines moderate SEC11-BP08Build a program that embeds security ownership in workload teams moderate