5,99 €
Mehr erfahren.
- Herausgeber: BookRix
- Kategorie: Wissenschaft und neue Technologien
- Sprache: Englisch
Modern cloud environments move at machine speed—but most governance, risk, and compliance programs are still stuck in spreadsheets, PDFs, and quarterly panic audits.
If your AWS environment deploys faster than your compliance team can document, this book was written for you.
The Ultimate GRC Engineering for AWS is not a theory book. It is a hands-on, engineering-driven blueprint for transforming compliance from a business bottleneck into a fully automated, continuously enforced system—built natively on AWS services and designed to scale across real-world, multi-account cloud environments .
Instead of chasing audit findings after the fact, this guide shows you how to encode compliance directly into your infrastructure, pipelines, and runtime controls—so governance happens automatically, invisibly, and continuously
What Makes This Book Different
This book introduces GRC Engineering: the discipline of expressing governance, risk, and compliance as executable cloud artifacts.
You’ll learn how to:
- Turn policies into policy-as-code that block noncompliant infrastructure before it deploys
- Embed risk gates directly into CI/CD pipelines using AWS-native tools
- Implement continuous compliance monitoring with AWS Config, Security Hub, GuardDuty, and EventBridge
- Automate remediation using Lambda and Step Functions—without human bottlenecks
- Generate audit-ready evidence automatically, every minute of every day
- Map real AWS controls to HIPAA, SOC 2, PCI DSS v4.0, FedRAMP, and NIST frameworks
- Optimize compliance architectures so security doesn’t explode your AWS bill
No vendor lock-in.
No abstract diagrams.
No “security theater.”
Just repeatable, production-grade GRC systems that actually work.
Who This Book Is For
This guide is written for professionals who build, secure, or govern AWS environments at scale:
- Cloud & DevOps Engineers who need compliance to stop breaking deployments
- Security Architects & GRC Professionals translating frameworks into AWS reality
- CTOs, CISOs, and Technical Leaders who want compliance to accelerate—not block—innovation
- Auditors and Risk Officers who want live, verifiable evidence instead of screenshots
What You’ll Walk Away With
By the final chapter, you’ll have:
- A reference architecture for compliance-driven AWS environments
- End-to-end examples of compliance embedded into infrastructure and pipelines
- A repeatable model for continuous, auditable governance at cloud speed
- The ability to prove compliance at any moment—not just during audits
Stop chasing findings.
Stop freezing releases for audits.
Stop managing compliance manually.
Engineer it. Automate it. Prove it continuously.
👉 Buy a copy now.
Das E-Book können Sie in Legimi-Apps oder einer beliebigen App lesen, die das folgende Format unterstützen:
Veröffentlichungsjahr: 2026
Ähnliche
The Ultimate GRC Engineering for AWS
Automating Governance, Risk, and Compliance with Policy-as-Code, Continuous Monitoring, Cost-Optimized Guardrails, and Audit-Ready Eviden
Larry M. Scanlan
Copyright Notice
© 2025 Dustin C. Ralston. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means—electronic, mechanical, photocopying, recording, scanning, or otherwise—without the prior written permission of the author, except as permitted under Sections 107 and 108 of the United States Copyright Act or by the licensing terms explicitly stated herein.
This guide is provided “as is,” for educational and informational purposes only. While every effort has been made to ensure technical accuracy, neither the author nor any contributors accept responsibility for errors, omissions, or damages resulting from the use of the information contained herein.
Amazon Web Services, AWS, and all related marks are trademarks or registered trademarks of Amazon Technologies, Inc. or its affiliates. All other product names, trademarks, and registered trademarks are the property of their respective owners and are used for identification purposes only. The use of any trade name or trademark in this guide does not imply any affiliation with, or endorsement by, the trademark holder.
Table of Contents
Introduction
Chapter 1 – The New Reality of GRC in the Cloud Era
1.1 From Policy-Driven to Code-Driven Compliance
1.2 Why Traditional GRC Fails in AWS
1.3 Shared Responsibility & the “Blast Radius” Mindset
1.4 Mapping Cloud Velocity to Regulatory Expectations
1.5 Laying the Cultural Groundwork for GRC Engineering
Chapter 2AWS Foundations for Governance
2.1Multi-Account Strategy & Landing Zones
2.2Organizations, SCPs, and Guardrails
2.3IAM Fundamentals for Least Privilege
2.4Tagging & Resource Hierarchies for Policy Enforcement
2.5Region, Availability-Zone, and Edge-Location Considerations
Chapter 3 – Infrastructure as Code: The Compliance Backbone
3.1 Choosing Between CloudFormation, CDK, and Terraform
3.2 Policy-as-Code Patterns (Open Policy Agent, AWS CDK Aspects)
3.3 Version Control & Change Management for IaC Repos
3.4 Drift Detection and Remediation Loops
3.5 Evidence Collection from IaC Pipelines
Chapter 4 — CI/CD Risk Gates & Security Controls
4.1 Embedding Static and Dynamic Scans in Pipelines
4.2 Secrets Management & Key Rotation Automation
4.3 Automated Policy Checks with AWS CodePipeline & CodeBuild
4.5 Attesting Builds for Audit Trails
Chapter 5 — Continuous Compliance Monitoring
5.1 AWS Config Rules & Conformance Packs
5.2 Security Hub, Detective & GuardDuty Integration
5.3 Real-Time Alerting with EventBridge & SNS
5.4 Automated Remediation via Lambda & Step Functions
5.5 Building Custom Dashboards for Compliance KPIs
Chapter 6 — Data Protection & Privacy Engineering
6.1 Encryption in Transit and at Rest
6.2 Tokenization & Data Masking Patterns
6.3 Managing Data Residency & Sovereignty
6.4 Backup, Archival & Data Lifecycle Policies
6.5 Privacy Impact Assessments (PIA) in AWS
Chapter 7 — Identity, Access, and Zero-Trust Architectures
7.1 Federation with IAM Identity Center, SAML, and OIDC
7.2 Fine-Grained IAM Policies & Permission Boundaries
7.3 Session Management & Conditional Access Controls
7.4 Network Segmentation with Security Groups & NACLs
7.5 Service-to-Service Authentication (STS, Roles Anywhere)
Chapter 8 — Logging, Observability & Evidence Management
8.1CloudTrail Lake, CloudWatch Logs & Kinesis Firehose
8.2Log Normalization & Retention Policies
8.3Immutable Audit Stores (S3 Object Lock & QLDB)
8.4Metrics, Traces, & Events for Compliance
8.5Automating Evidence Packaging for Auditors
Chapter 9 — Framework-as-Code: HIPAA, SOC 2, PCI DSS & FedRAMP
9.1Control Mapping Methodology
9.2Pre-built & Custom Conformance Packs
9.3Continuous Control Validation Pipelines
9.4Reporting & Attestation Automation
9.5Handling Overlapping & Conflicting Controls
Chapter 10 — Incident Response Engineering
10.1 Cloud-Native Forensics Toolkit Setup
10.2 Automated Triage & Containment Runbooks
10.3 Evidence Preservation for Legal Hold
10.4 Post-Incident Reviews & Control Improvements
10.5 Meeting SLA & Regulatory Notification Timelines
Chapter 11 — Cost-Optimized Compliance Architectures
11.1Balancing Resilience, Security and Spend
11.2Using Savings Plans & Spot for Non-Sensitive Workloads
11.3Intelligent Tiering for Audit Logs
11.4Rightsizing Guardrails without Sacrificing Coverage
11.5Building Business Cases for Compliance Investments
Chapter 12 — Third-Party & Supply-Chain Risk Management
12.1Vetting SaaS and Marketplace Integrations
12.2Artifact & SBOM Management in AWS
12.3Continuous Vendor Monitoring & Contract Clauses
12.4Shared Log Access & Evidence Exchange
12.5Exit Strategies and Data Portability
Chapter 13 — Governance at Scale: Control Tower & Beyond
13.1Control Tower Lifecycle & Customizations
13.2Account Factory Patterns for Business Units
13.3Guardrails vs. Bespoke SCPs
13.4Delegated Admin & Centralized Services Accounts
13.5Measuring Governance Maturity
Chapter 14 — Human Factors & Organizational Change
14.1 Building Cross-Functional GRC Squads
14.2 Training Engineers to Think Like Auditors
14.3 Policy Documentation as Living Code Repos
14.4 Gamifying Compliance Metrics
14.5 Executive Dashboards & Board-Level Reporting
Chapter 15 — Future-Proofing: AI, Serverless, and Multicloud Pressures
15.1 AI/ML Workloads and Emerging Regulatory Landscapes
15.2 Serverless Governance Patterns (Lambda, Fargate, Step Functions)
15.3 Kubernetes & EKS Compliance Considerations
15.4 Extending Guardrails to Azure & GCP
15.5 Preparing for Quantum-Resistant Cryptography
Conclusion
Appendix
Appendix AAWS Service–to–Framework Quick Reference
Appendix B — Policy-as-Code Cheat Sheet
Appendix CAcronyms & Abbreviations
Appendix DCost-Optimization Formulas & Benchmarks
Appendix ERegulatory & Road-Map Timeline (2024 → 2030)
Appendix FQuick-Select Incident-Response Commands
Introduction
“How many critical findings do we have open?”
The CISO’s voice echoed across the video bridge, but the DevOps lead hesitated. The answer changed every time Terraform pushed to production—and that was almost hourly. Somewhere in the console, AWS Config was flagging S3 buckets, GuardDuty was hollering about credential exfiltration patterns, and half-implemented FedRAMP controls were still tagged TODO. The real number of findings? Nobody knew. The meeting ended with a familiar refrain: “We’ll pull the spreadsheets together.”
They never really caught up.
Why This Book Exists
Cloud has rewired the speed of business. Infrastructure that once took quarters to provision now materializes in minutes. But the governance, risk, and compliance (GRC) machinery designed for datacenters—policy sign-offs, quarterly audits, PDF evidence packets—never got the memo. In Amazon Web Services, a single developer can introduce fifty resources with one terraform apply, and each resource instantly inherits a jungle of regulatory obligations: encryption modes, retention periods, cross-region controls, incident-response hooks, logging destinations, cost tags, you name it.
Legacy GRC models try to hold this back with binders, change-advisory boards, and “thou-shalt-not” network diagrams. The result is predictable: innovation throttles, developers hide “shadow stacks” in personal accounts, and compliance gaps widen until they flare into seven-figure fines—or worse, headlines.
AWS itself keeps pushing the envelope. In June 2025, AWS Control Tower added seven new frameworks, including PCI DSS v4.0 and updated SOC 2 mappings, all inside its Control Catalog. Organizations woke up compliant on Monday only to discover brand-new controls on Tuesday. The ground beneath our feet is moving, and manual GRC cannot keep pace.
This book answers the one question that now matters: How do we turn compliance into code, embed it in every layer of the AWS stack, and make it scale at cloud speed?
GRC Engineering in One Sentence
GRC engineering is the discipline of expressing governance, risk, and compliance intent as artifacts the cloud can execute automatically—policy-as-code, controls-as-pipelines, evidence-as-data.
That sounds academic; in practice it means Terraform modules that refuse to deploy non-encrypted RDS instances, CI/CD gates that block any build missing a software bill of materials, Lambda responders that quarantine rogue IAM users in under sixty seconds, and dashboards that surface auditor-ready evidence the moment a control fires. It is security, compliance, and operational resilience wired directly into your delivery engine, not stapled on after release.
Who Should Read This Book
Cloud & DevOps Engineers
who live in Git repos and pipelines and need hands-on code to keep releases green
and
compliant.
Security Architects & GRC Analysts
responsible for translating frameworks—HIPAA, SOC 2, FedRAMP—into AWS realities.
Technical Leaders & CTOs
seeking to turn compliance from an innovation tax into a market differentiator.
Auditors & Risk Officers
who want to interrogate live evidence rather than rummage through spreadsheets.
If your badge lets you touch an AWS account and your organization cares about external trust—privacy, security, uptime—you are in the right place.
How This Book Is Structured
The journey spans 15 chapters, grouped into four progressive arcs:
Foundations (Chs 1-4)
– We explore why classical GRC fails in cloud, lay multi-account landing zones, and weaponize Infrastructure as Code (IaC) plus CI/CD gates.
Live Controls (Chs 5-9)
– Continuous monitoring with AWS Config, GuardDuty, and Security Hub; data-protection engineering; identity & zero-trust; evidence pipelines; and full framework-as-code implementations for HIPAA, SOC 2, PCI DSS, and FedRAMP.
Scale & Sustainability (Chs 10-14)
– Incident-response automation, cost-optimized guardrails, supply-chain risk, Control Tower customizations, and the human-change layer that makes GRC stick.
The Road Ahead (Ch 15)
– Serverless, AI/ML, multicloud, quantum-resistant crypto—how to keep guardrails relevant when the next wave arrives.
Each chapter follows a Problem → Impact → Solution rhythm to match real-world firefighting: we define the risk, quantify business fallout, then walk step-by-step through a buildable solution. Sidebars labelled Engineer Focus, Auditor Lens, or Leadership Insight let mixed audiences zero in on what they need.
End-of-chapter labs provide Terraform, CDK, or CloudFormation snippets plus success criteria you can validate in a sandbox. Want to see a sample lab? Flip to Chapter 5 and enable an AWS Config conformance pack in under fifteen minutes—complete with an automatic Lambda fixer when tags go missing.
Guiding Principles
Code Before Prose
– Screenshots age; code lives in source control. You’ll find runnable examples first, narrative second.
Automation as Currency
– If a control cannot be enforced or evidenced automatically, we treat it as technical debt.
Least Astonishment
– We favor AWS native services for guardrails (Config, Control Tower, CloudWatch, SNS, Lambda) before bespoke engines. No third-party magic required.
Cost & Performance Conscious
– Every pattern includes spend impacts and latency trade-offs. Governance that breaks your bill is governance nobody deploys.
Audit-Ready by Default
– Evidence is captured once and stored immutably—no “audit freeze” weeks.
A Short Tour of the Book
Chapter
“In One Breath”
Hands-On You’ll Do
1. The New Reality of GRC in the Cloud Era
Understand why control debt explodes in AWS and how shared responsibility shifts.
Build a “blast-radius map” for your org.
2. AWS Foundations for Governance
Land multi-account architecture with Service Control Policies (SCPs), tagging, and network segmentation.
Use AWS Organizations to enforce mandatory encryption.
3. Infrastructure as Code: The Compliance Backbone
Treat control objectives like unit tests in your Terraform/CDK pipelines.
Add OPA policy checks to terraform plan.
4. CI/CD Risk Gates & Security Controls
Insert SAST, DAST, and secrets rotation into CodePipeline without adding hours to build time.
Create a pre-merge Github Action that fails on unscanned container images.
5-9. Continuous Controls & Framework-as-Code
Monitor, remediate, and evidence 24×7; map HIPAA, SOC 2, PCI DSS, FedRAMP controls into AWS Config.
Deploy a conformance pack across 50+ accounts and auto-quarantine non-compliant S3 buckets.
10. Incident Response Engineering
Automate forensics capture and SLA notifications; preserve chain-of-custody automatically.
Launch a Step-Functions playbook that snapshots EC2 volumes and locks CloudTrail logs.
11. Cost-Optimized Compliance Architectures
Rightsize guardrails; shift logs to tiered storage; use Savings Plans where safe.
Calculate cost deltas between “gold-plated” and “right-sized” compliance footprints.
12-13. Supply-Chain & Governance at Scale
Vet SaaS vendors, manage SBOMs, customize Control Tower, delegate admin.
Spin up an Account Factory module with environment-specific guardrails.
14. Human Factors & Org Change
Build cross-functional GRC squads and gamify metrics so engineers want to play.
Set up a Slack leaderboard for “mean time to remediate” competitions.
15. Future-Proofing
AI/ML, serverless, multicloud, and quantum—guardrails that evolve.
Prototype a Lambda@Edge policy engine that blocks unsanctioned AI model endpoints.
By the end, you will have a living reference implementation—code, patterns, and workflows you can clone, refactor, and push to prod.
Setting Up Your Lab
All examples target the AWS Free Tier or low-cost services. You’ll need:
An AWS account with
AdministratorAccess
(ideally a fresh sandbox).
Terraform 1.7+ or AWS CDK v3 if you prefer TypeScript/Python.
Git, Docker, and your favorite IDE.
Optional: access to AWS Control Tower if your organization enables it; many examples will still work in standalone accounts.
Where possible, labs include an “instant-launch” CloudFormation button for speed. If your organization blocks third-party code, skip ahead to Appendix A for manual CLI commands.
Why We Lean on AWS Native
Third-party security platforms can be valuable, yet every extra moving piece expands your attack surface and licensing bill. AWS continues to inject compliance horsepower straight into the platform—witness hands-on workshops at re:Inforce 2025 that used CloudWatch, CloudTrail, and AWS Config to build real-time detection and response without leaving the console. This book shows you how to ride those native improvements first; bolt-ons come later, and only if needed.
A Word on Frameworks & Acronyms
We reference HIPAA, SOC 2, PCI DSS v4.0, FedRAMP, ISO 27001, and NIST CSF throughout. You do not need to memorize every citation before diving in. Each framework-as-code chapter begins with a “30-Second Cheat Sheet” summarizing control families and AWS service mappings. Feel free to skim the cheat sheets, then jump straight to the labs.
Guardrails, Not Handcuffs
GRC engineering is sometimes mistaken for “lock everything down.” In reality, good guardrails unlock innovation: they absorb the undifferentiated heavy lifting of compliance so developers can iterate faster. When a fintech startup wired AWS Config conformance packs across 120 accounts, they cut audit prep from eight weeks to two days—and deployed new features twice as often because engineers no longer feared the control matrix. That success story echoes across industries: healthcare, media, public sector.
Reading This Book Two Ways
Cover-to-Cover
– Ideal for green-field initiatives or major compliance overhauls.
Reference-Style
– Already struggling with IAM sprawl? Jump to Chapter 7. Need instant FedRAMP artifacts? Chapter 9 awaits.
Either route gains from the same principle: ship thin vertical slices—one control objective, one pipeline gate, one dashboard tile at a time—then iterate. Compliance need not be a moonshot.
Conventions
Code Blocks
use monospace and are executable as-is unless marked // pseudocode.
CLI Commands
begin with $.
Callouts
:
☑
️
Audit Evidence Tip
💡
Cost Watch
🚩
Security Smell
Figures
follow AWS architecture-icon guidelines.
Sidebars
are in gray boxes for quick scanning.
The Payoff
By mastering the patterns in these pages, you will:
Shrink audit cycles
from months to minutes with evidence-as-data.
Slash risk exposure
via automated remediation—no pager at 3 a.m. for a public S3 bucket.
Accelerate releases
because guardrails are baked into CI/CD instead of bolted onto staging.
Win executive trust
with real-time compliance KPIs.
Differentiate competitively
by proving to customers—and regulators—that security is not an afterthought but an engineering discipline.
Ready?
Close the spreadsheet. Crack open your IDE. Let’s turn compliance into code—and make your AWS environment an engine of trust, speed, and continuous assurance.
Turn the page to Chapter 1, where we explore why governance debt balloons in cloud and how the blast-radius mindset reframes every control you’ll ever write. Your journey from policy pages to pipeline power begins now.
Chapter 1 – The New Reality of GRC in the Cloud Era
1.1 From Policy-Driven to Code-Driven Compliance
For two decades “compliance” has largely meant documents: thick policy manuals, quarterly control attestations, PDF screenshots, and turgid spreadsheets full of check-boxes. That paper engine worked—barely—when infrastructure changed only at quarter-end. In 2025, however, a single terraform apply can erect an entire VPC, three micro-services, an Aurora cluster, and a CloudFront distribution in under four minutes. The delta between policy and reality no longer spans weeks; it spans heartbeats.
Code-driven compliance flips the paradigm. Instead of telling humans what to do and hoping they remember, we tell machines what “good” looks like and let them enforce, detect, and remediate at machine speed. The shift is analogous to unit-testing in software: once a requirement is expressed as executable code, it runs every time, everywhere, identically.
# Example 1-1 – Terraform pre-condition that forbids public S3 buckets
resource "aws_s3_bucket" "media" {
lifecycle {
precondition {
}
}
}
Here, if an engineer tries to skip the aws_s3_bucket_public_access_block resource, the plan fails in seconds. No committee meeting, no Change Advisory Board ticket—just deterministic enforcement. Policy becomes immutable law baked into the CI/CD path.
Three building blocks make code-driven compliance work:
Infrastructure-as-Code (IaC)
—CloudFormation, CDK, or Terraform store every resource definition in version control.
Policy-as-Code engines
—Open Policy Agent (OPA), HashiCorp Sentinel, CDK Aspects, or Regula evaluate compliance rules during plan time.
Event-driven remediation
—AWS Config, EventBridge, and Lambda detect drift after deployment and auto-correct.
The benefit matrix is immediate:
Legacy Model
Code-Driven Model
Manual checklists at release
Automated pipeline gates at merge
“Audit freeze” every quarter
Evidence emitted continuously
Dev teams interpret policy ad hoc
Policy embedded as deterministic tests
Retroactive findings ⇒ re-work
Shift-left findings ⇒ instant feedback
By the end of this book you’ll wield those same building blocks to make compliance predictable, provable, and painless.
1.2 Why Traditional GRC Fails in AWS
1.2.1 Velocity MismatchAWS releases new features weekly; teams deploy hundreds of times per day. Traditional GRC moves on a 90-day cadence. The mismatch produces evidence decay—the moment a worksheet is filed, reality has already drifted.
1.2.2 Resource EphemeralityInstances spin up for ten minutes during a load test, then vanish. Classic asset inventories—and the controls that rely on them—assume servers are immortal. When the thing you’re trying to control disappears before you can audit it, your whole model collapses.
1.2.3 Control GranularityLegacy frameworks often speak at datacenter scale (“Lock the server room”). AWS demands per-resource granularity (“This specific S3 object must be encrypted with SSE-KMS”). Translating coarse policy into fine-grained enforcement manually is error-prone and unscalable.
1.2.4 Human BottlenecksThe average security questionnaire travels through five human hand-offs before a ticket closes. In CI/CD such drag is unacceptable. Engineers bypass the queue with “shadow IT,” spawning personal AWS accounts outside governance. Shadow stacks become time-bombs that explode during audit.
1.2.5 Framework VolatilityOn 13 June 2025 AWS Control Tower added seven new frameworks—including PCI DSS v4.0 and an updated SOC 2 catalog—to its Control Catalog, instantly exposing organizations to fresh obligations. When frameworks evolve overnight, spreadsheet-based tracking cannot keep pace.
These five forces conspire to break the old GRC machine. The remedy is not “try harder” but re-engineer governance to operate at the same velocity as the cloud itself.
1.3 Shared Responsibility & the “Blast Radius” Mindset
Amazon’s Shared Responsibility Model draws a clean line: AWS secures the cloud; you secure what you build in the cloud. Many compliance teams pay lip service to the doctrine yet cling to a datacenter reflex—treating every account, VPC, or subnet as if it were behind one big firewall. That illusion evaporates the moment an IAM policy scopes s3:* across *.
1.3.1 Defining Blast Radius
Blast radius is the maximum damage a single misconfiguration can inflict before protective layers kick in. Think physics: how far will the explosion travel? In cloud GRC, blast radius is measured in data records, customer segments, or business processes exposed.
Low blast radius:
A dev sandbox with dummy data.
Moderate blast radius:
A staging VPC containing partial customer records.
High blast radius:
A production data lake replicating globally.
Your goal is never “zero” blast radius—unrealistic—but predictable, bounded blast radius.
1.3.2 Techniques to Shrink Blast Radius
Layer
Guardrail
Outcome
Identity
IAM permission boundaries restrict the maximum rights of any role—even if an admin slips.
Limits privilege escalation paths.
Network
VPCs segmented by workload; no 0.0.0.0/0 inbound unless via WAF
Containment in case of compromise.
Data
S3 bucket keys scoped per environment; KMS key policies enforce separation
Prevents cross-environment data leakage.
Account
AWS Organizations with Service Control Policies (SCPs) blocking dangerous APIs
Stops account-wide catastrophic calls like iam:DeletePolicy.
Blast-radius thinking is liberating: instead of chasing every micro-risk, you engineer structural boundaries that halt lateral movement automatically.
1.4 Mapping Cloud Velocity to Regulatory Expectations
Regulators still speak in the language of days and months, while CI/CD speaks in seconds. Bridging the two timelines without throttling innovation hinges on continuous compliance—the ability to prove, at any instant, that every relevant control is effective.
1.4.1 Event-Driven Evidence
Modern frameworks (PCI DSS v4.0, SOC 2 2023 update) increasingly accept machine-generated evidence: logs, immutable configuration histories, automated test results. AWS doubled down by allowing AWS Config rules to inherit framework classifications—PCI, FedRAMP, NIST, etc.—announced 30 June 2025. This mapping means that when a rule evaluates COMPLIANT, it simultaneously satisfies its mapped control.
1.4.2 Service Tiers for Control Cadence
Service Category
Control Refresh
Typical AWS Evidence Source
Realtime (≤ 1 min)
Encryption keys active, IAM role misuse
CloudTrail Lake, GuardDuty
Near-Realtime (≤ 1 hr)
Security group drift, S3 public access
