AWS Well-Architected Framework v10
Best for: Any organization running workloads on AWS that needs to evaluate architectural decisions against AWS best practices. Most relevant for teams preparing for Well-Architected Reviews with a Solutions Architect, companies pursuing AWS Partner certifications, or engineering teams that need to justify infrastructure decisions to leadership. No revenue or size threshold applies. A startup with a single account benefits as much as an enterprise managing hundreds.
| Mandatory? | Voluntary — AWS best-practice framework |
| Who validates? | Self-assessment via AWS Well-Architected Tool; optional AWS partner review |
| Renewal | No fixed cycle; review at architecture changes |
| Scope | All AWS workloads; six pillars including Security |
🏛 Amazon Web Services (AWS) · AWS Well-Architected Framework v10 Official source →
Get Started
module "..." {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Account Governance: Runs controls checking AWS Organizations membership, security contact registration, and account contact detail completeness. Covers account_alternate_contact_security_registered, account_maintain_current_contact_details, and account_part_of_organizations.
- API Security and Access Control: Checks API Gateway REST and HTTP API configurations for missing authorizers, public endpoint exposure, WAF association, and SSL certificate attachment. Covers 7 API Gateway controls across both V1 and V2 APIs.
- Certificate Lifecycle: Detects ACM certificates expiring within 30 days and verifies certificate transparency logging is enabled. Flags API Gateway stages missing SSL certificates.
- Resilience and Multi-AZ Architecture: Validates that EC2 auto scaling groups span multiple Availability Zones per the Reliability pillar.
- Sensitive Data Exposure: Scans EC2 auto scaling launch configuration user data fields for embedded secrets, passwords, and sensitive configuration values.
- Session and Timeout Configuration: Evaluates AppStream fleet timeout settings (idle disconnect, session disconnect, max user duration) and internet access configuration against recommended thresholds.
What you handle
- Account Governance: Defining and enforcing the organizational unit (OU) structure, setting up Service Control Policies (SCPs), and maintaining a process to update contacts when personnel change.
- API Security and Access Control: Designing the authorization strategy (Cognito, Lambda authorizer, IAM), writing and maintaining authorizer logic, and configuring WAF rules appropriate to your threat model.
- Certificate Lifecycle: Investigating why auto-renewal failed for flagged certificates, managing certificates outside ACM (such as imported certificates), and monitoring Certificate Transparency logs for unauthorized issuance.
- Resilience and Multi-AZ Architecture: Determining the right number of AZs for your RPO/RTO targets, testing failover scenarios, and ensuring application-level state management supports AZ loss.
- Sensitive Data Exposure: Migrating secrets to AWS Secrets Manager or Parameter Store, rotating any exposed credentials, and implementing preventive controls such as SCPs or CI/CD pipeline scanning.
- Session and Timeout Configuration: Adjusting timeout values to match actual user workflow requirements and configuring VPC egress controls for fleets with internet access disabled.
Controls by Category
API Gateway Security (4 controls)
This is where most findings accumulate. Reviewers look for unauthenticated API methods, publicly accessible REST API endpoints that should be private, and stages missing WAF associations or access logging. A recurring gap is V2 (HTTP API) routes left with no authorization type because teams assume V1 settings carry over.
AppStream Fleet Configuration (4 controls)
The two things reviewers want to see: internet access disabled on fleets (traffic should route through a VPC with controlled egress) and session timeouts configured to reduce idle exposure windows. Evidence is pulled from fleet configuration details in the AppStream console or via describe-fleets API calls.
Certificate and Encryption Management (2 controls)
Auditors check for expiring ACM certificates and confirm transparency logging is enabled to catch misissued certificates. For API Gateway, they want to see SSL certificates attached to custom domain stages. Expired certificates cause outages, and teams frequently miss renewals when auto-renewal fails silently due to DNS validation issues.
Additional Controls (113)
AWS CloudTrail (4)
AWS IAM (9)
AWS Lambda (2)
Amazon CloudFront (4)
compliance.tf moduleCloudFront distributions should have field level encryption enabledcompliance.tf moduleCloudFront distributions access logs should be enabledcompliance.tf moduleCloudFront distributions should have AWS WAF enabledcompliance.tf moduleAmazon CloudWatch (2)
Amazon CloudWatch Logs (1)
Amazon DynamoDB (2)
Amazon DynamoDB Accelerator (1)
Amazon EBS (3)
Amazon EC2 (4)
Amazon EFS (2)
Amazon EKS (4)
compliance.tf moduleEKS clusters endpoint public access should be restrictedcompliance.tf moduleEKS clusters endpoint should restrict public accesscompliance.tf moduleEKS clusters should be configured to have kubernetes secrets encrypted using KMScompliance.tf moduleAmazon OpenSearch Service (8)
compliance.tf moduleOpenSearch domains should have Cognito authentication enabled for Kibanacompliance.tf moduleOpenSearch domains should have encryption at rest enabledcompliance.tf moduleOpenSearch domains should use HTTPScompliance.tf moduleOpenSearch domains should be in a VPCcompliance.tf moduleOpenSearch domains internal user database should be disabledcompliance.tf moduleOpenSearch domains should have logging to CloudWatch Logs enabledcompliance.tf moduleOpenSearch domains node-to-node encryption should be enabledcompliance.tf moduleAmazon RDS (10)
compliance.tf moduleRDS DB instances should be integrated with CloudWatch logscompliance.tf moduleRDS DB instance encryption at rest should be enabledcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS for MariaDB DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should not use public subnetcompliance.tf moduleRDS for PostgreSQL DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleRDS for SQL Server DB instances should publish logs to CloudWatch Logscompliance.tf moduleAmazon Redshift (5)
compliance.tf moduleRedshift clusters should have automatic upgrades to major versions enabledcompliance.tf moduleRedshift clusters should have audit logging and encryption enabledcompliance.tf moduleRedshift clusters should have required maintenance settingscompliance.tf moduleRedshift clusters should prohibit public accesscompliance.tf moduleAmazon Route 53 (2)
Amazon S3 (14)
compliance.tf moduleS3 buckets should have default encryption enabledcompliance.tf moduleS3 buckets should have default encryption enabled using KMScompliance.tf moduleS3 buckets should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should have MFA delete enabledcompliance.tf moduleS3 buckets should not be accessible to all authenticated userscompliance.tf moduleS3 buckets should have object logging enabledS3 buckets should have policies that prohibit public accesscompliance.tf moduleS3 buckets should prohibit public read accesscompliance.tf moduleS3 buckets should prohibit public write accesscompliance.tf moduleS3 buckets with versioning enabled should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have versioning enabledcompliance.tf moduleS3 public access should be blocked at account levelcompliance.tf moduleAmazon SQS (2)
Amazon SageMaker (7)
Amazon VPC (1)
Elastic Load Balancing (10)
compliance.tf moduleELB load balancers should prohibit public accesscompliance.tf moduleELB application load balancers should be configured with defensive or strictest desync mitigation modecompliance.tf moduleELB application load balancers should be configured to drop HTTP headerscompliance.tf moduleELB application load balancers should drop invalid HTTP headerscompliance.tf moduleELB application and network load balancers should use recommended security policiescompliance.tf moduleELB application and network load balancer listeners should use secure protocolscompliance.tf moduleELB classic load balancers should span multiple availability zonescompliance.tf moduleELB network load balancers should have TLS listener security policy configuredcompliance.tf moduleELB listeners should use approved SSL/TLS protocol versionscompliance.tf moduleOther (13)
compliance.tf moduleGlue data catalog metadata encryption should be enabledGlue data catalog connection password encryption should be enabledGlue jobs bookmarks encryption should be enabledGlue jobs CloudWatch logs encryption should be enabledGlue jobs S3 encryption should be enabledRelated Frameworks
AWS Foundational Security Best Practices — 🟡 Medium overlap (55%)
AWS Foundational Security Best Practices (FSBP) shares many of the same underlying controls, particularly around API Gateway, ACM, and auto scaling. FSBP is more prescriptive and audit-oriented, while WAF is advisory and architecture-focused.
NIST 800-53 Rev 5 — 🟡 Medium overlap (30%)
The Security pillar of WAF maps loosely to NIST 800-53 control families such as AC (Access Control), SC (System and Communications Protection), and SI (System and Information Integrity). WAF lacks the granularity of 800-53 and does not cover administrative or physical controls.
NIST CSF v1.0 — ⚪ Low overlap (25%)
The NIST Cybersecurity Framework shares conceptual alignment with WAF's Security and Reliability pillars. CSF's Protect and Detect functions map to WAF security controls, but CSF addresses organizational governance topics that WAF does not cover.