AWS Well-Architected Framework v10

ActiveCommon framework

Best for: Any organization running workloads on AWS that needs to evaluate architectural decisions against AWS best practices. Most relevant for teams preparing for Well-Architected Reviews with a Solutions Architect, companies pursuing AWS Partner certifications, or engineering teams that need to justify infrastructure decisions to leadership. No revenue or size threshold applies. A startup with a single account benefits as much as an enterprise managing hundreds.

Mandatory?	Voluntary — AWS best-practice framework
Who validates?	Self-assessment via AWS Well-Architected Tool; optional AWS partner review
Renewal	No fixed cycle; review at architecture changes
Scope	All AWS workloads; six pillars including Security
Governing body	Amazon Web Services (AWS), AWS Well-Architected Framework v10. Official source

Get started

Point the module source at the AWS Well-Architected Framework v10 endpoint and pin a version range you reviewed:

module "..." {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

awswellarchitected.compliance.tf lists every AWS Well-Architected Framework v10 module with its versions, inputs and outputs.

Enforce 72 AWS Well-Architected Framework v10 controls with one registry endpoint change.

Start free trial Get started

What compliance.tf covers and what you handle

Area	Compliance.tf automates	You handle
Account Governance	Runs controls checking AWS Organizations membership, security contact registration, and account contact detail completeness. Covers account_alternate_contact_security_registered, account_maintain_current_contact_details, and account_part_of_organizations.	Defining and enforcing the organizational unit (OU) structure, setting up Service Control Policies (SCPs), and maintaining a process to update contacts when personnel change.
API Security and Access Control	Checks API Gateway REST and HTTP API configurations for missing authorizers, public endpoint exposure, WAF association, and SSL certificate attachment, across both V1 and V2 APIs.	Designing the authorization strategy (Cognito, Lambda authorizer, IAM), writing and maintaining authorizer logic, and configuring WAF rules appropriate to your threat model.
Certificate Lifecycle	Detects ACM certificates expiring within 30 days and verifies certificate transparency logging is enabled. Flags API Gateway stages missing SSL certificates.	Investigating why auto-renewal failed for flagged certificates, managing certificates outside ACM (such as imported certificates), and monitoring Certificate Transparency logs for unauthorized issuance.
Resilience and Multi-AZ Architecture	Validates that EC2 auto scaling groups span multiple Availability Zones per the Reliability pillar.	Determining the right number of AZs for your RPO/RTO targets, testing failover scenarios, and ensuring application-level state management supports AZ loss.
Sensitive Data Exposure	Scans EC2 auto scaling launch configuration user data fields for embedded secrets, passwords, and sensitive configuration values.	Migrating secrets to AWS Secrets Manager or Parameter Store, rotating any exposed credentials, and implementing preventive controls such as SCPs or CI/CD pipeline scanning.
Session and Timeout Configuration	Evaluates AppStream fleet timeout settings (idle disconnect, session disconnect, max user duration) and internet access configuration against recommended thresholds.	Adjusting timeout values to match actual user workflow requirements and configuring VPC egress controls for fleets with internet access disabled.

Controls by category

72 of 123 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 51 are Mapped only: AWS Well-Architected Framework v10 lists them, no compliance.tf module checks them.

API Gateway Security

This is where most findings accumulate. Reviewers look for unauthenticated API methods, publicly accessible REST API endpoints that should be private, and stages missing WAF associations or access logging. A recurring gap is V2 (HTTP API) routes left with no authorization type because teams assume V1 settings carry over.

Control	Status
API Gateway methods should require an authorizer	Mapped
API Gateway routes should require an authorization type	Enforced
API Gateway V2 routes should require an authorizer	Enforced
API Gateway stages should have logging enabled	Mapped

AppStream Fleet Configuration

The two things reviewers want to see: internet access disabled on fleets (traffic should route through a VPC with controlled egress) and session timeouts configured to reduce idle exposure windows. Evidence is pulled from fleet configuration details in the AppStream console or via describe-fleets API calls.

Control	Status
AppStream fleets should have default internet access disabled	Mapped
AppStream fleets should have idle disconnect timeout set to 10 minutes or less	Mapped
AppStream fleets should limit maximum user duration to 10 hours or less	Mapped
AppStream fleets should have session disconnect timeout set to 5 minutes or less	Mapped

Certificate and Encryption Management

Auditors check for expiring ACM certificates and confirm transparency logging is enabled to catch misissued certificates. For API Gateway, they want to see SSL certificates attached to custom domain stages. Expired certificates cause outages, and teams frequently miss renewals when auto-renewal fails silently due to DNS validation issues.

Control	Status
ACM certificates should have transparency logging enabled	Enforced
API Gateway REST API stages should have a client certificate configured	Mapped

Additional controls (113)

AWS CloudTrail (4)

Control	Status
CloudTrail trails should have at least one enabled trail present in a region	Mapped
CloudTrail trails should be integrated with CloudWatch logs	Mapped
CloudTrail trails should have logs encrypted using a customer managed KMS key	Mapped
CloudTrail trails should have log file validation enabled	Mapped

AWS IAM (9)

Control	Status
IAM password policies should have minimum length set to 14 or greater	Mapped
IAM password policies should require at least one lowercase letter	Mapped
IAM password policies should require at least one number	Mapped
IAM password policies should require at least one symbol	Mapped
IAM password policies should require at least one uppercase letter	Mapped
IAM password policies should prevent password reuse	Mapped
IAM password policies should have strong configurations with minimum length of 8 or greater	Mapped
IAM password policies should have strong configurations	Mapped
IAM password policies should expire passwords within 90 days or less	Mapped

AWS KMS (1)

Control	Status
KMS CMK rotation should be enabled	Enforced

AWS Lambda (2)

Control	Status
Lambda functions CORS configuration should not allow all origins	Enforced
Lambda functions should restrict public URL	Enforced

Amazon CloudFront (5)

Control	Status
CloudFront distributions should require encryption in transit	Enforced
CloudFront distributions should have field level encryption enabled	Enforced
CloudFront distributions access logs should be enabled	Enforced
CloudFront distributions should use the recommended TLS security policy	Enforced
CloudFront distributions should have AWS WAF enabled	Enforced

Amazon CloudWatch (2)

Control	Status
CloudWatch alarms should have an action configured	Enforced
CloudWatch log groups should have retention period of at least 365 days	Enforced

Amazon CloudWatch Logs (1)

Control	Status
Log groups should have encryption at rest enabled	Enforced

Amazon DynamoDB (2)

Control	Status
DynamoDB tables should have AWS KMS encryption enabled	Enforced
DynamoDB tables should have encryption enabled	Enforced

Amazon DynamoDB Accelerator (1)

Control	Status
DynamoDB Accelerator (DAX) clusters should be encrypted at rest	Mapped

Amazon EBS (2)

Control	Status
Attached EBS volumes should have encryption enabled	Enforced
EBS snapshots should be encrypted	Mapped

Amazon EC2 (3)

Control	Status
EC2 instances should have IAM profile attached	Enforced
EC2 instances should not have a public IP address	Enforced
EC2 instances should use IMDSv2	Enforced

Amazon ECR (1)

Control	Status
ECR repositories should have image scan on push enabled	Enforced

Amazon EFS (2)

Control	Status
EFS file systems should have encryption at rest enabled	Enforced
EFS file systems should be encrypted with CMK	Enforced

Amazon EKS (4)

Control	Status
EKS clusters should have control plane audit logging enabled	Enforced
EKS clusters endpoint public access should be restricted	Enforced
EKS clusters endpoint should restrict public access	Enforced
EKS clusters should be configured to have kubernetes secrets encrypted using KMS	Mapped

Amazon OpenSearch Service (8)

Control	Status
OpenSearch domains should have audit logging enabled	Enforced
OpenSearch domains should have Cognito authentication enabled for Kibana	Enforced
OpenSearch domains should have encryption at rest enabled	Enforced
OpenSearch domains should use HTTPS	Enforced
OpenSearch domains should be in a VPC	Mapped
OpenSearch domains internal user database should be disabled	Enforced
OpenSearch domains should have logging to CloudWatch Logs enabled	Enforced
OpenSearch domains node-to-node encryption should be enabled	Enforced

Amazon RDS (10)

Control	Status
RDS DB clusters should have automatic minor version upgrade enabled	Enforced
RDS DB instance automatic minor version upgrade should be enabled	Enforced
RDS DB instances should be integrated with CloudWatch logs	Enforced
RDS DB instance encryption at rest should be enabled	Enforced
RDS DB instances should have logging enabled	Enforced
RDS for MariaDB DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should not use public subnet	Enforced
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should prohibit public access	Enforced
RDS for SQL Server DB instances should publish logs to CloudWatch Logs	Enforced

Amazon Redshift (5)

Control	Status
Redshift clusters should have audit logging enabled	Enforced
Redshift clusters should have automatic upgrades to major versions enabled	Enforced
Redshift clusters should have audit logging and encryption enabled	Enforced
Redshift clusters should have required maintenance settings	Enforced
Redshift clusters should prohibit public access	Enforced

Amazon Route 53 (2)

Control	Status
Route 53 domains should have privacy protection enabled	Mapped
Route 53 domains should have transfer lock enabled	Mapped

Amazon S3 (14)

Control	Status
S3 buckets should not use ACLs for user access control	Enforced
S3 buckets should have default encryption enabled	Enforced
S3 buckets should have default encryption enabled using KMS	Enforced
S3 buckets should have lifecycle policies configured	Enforced
S3 buckets should have logging enabled	Enforced
S3 buckets should have MFA delete enabled	Mapped
S3 buckets should not be accessible to all authenticated users	Enforced
S3 buckets should have object logging enabled	Mapped
S3 buckets should have policies that prohibit public access	Enforced
S3 buckets should prohibit public read access	Enforced
S3 buckets should prohibit public write access	Enforced
S3 buckets with versioning enabled should have lifecycle policies configured	Enforced
S3 buckets should have versioning enabled	Enforced
S3 public access should be blocked at account level	Enforced

Amazon SNS (1)

Control	Status
SNS topics should be encrypted at rest	Enforced

Amazon SQS (2)

Control	Status
SQS queues should have encryption at rest enabled	Enforced
SQS queues should be encrypted with KMS CMK	Enforced

Amazon SageMaker (6)

Control	Status
SageMaker models should be in a VPC	Mapped
SageMaker models should have network isolation enabled	Mapped
SageMaker notebook instances should not have direct internet access	Mapped
SageMaker notebook instance encryption should be enabled	Mapped
SageMaker notebook instances should be in a VPC	Mapped
SageMaker notebook instances root access should be disabled	Mapped

Amazon VPC (3)

Control	Status
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888	Enforced
VPC security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports (IPv4)	Mapped
VPC security groups should not allow ingress from ::/0 to remote server administration ports	Mapped

Elastic Load Balancing (10)

Control	Status
ELB application and classic load balancer logging should be enabled	Enforced
ELB load balancers should prohibit public access	Enforced
ELB application load balancers should be configured with defensive or strictest desync mitigation mode	Enforced
ELB application load balancers should be configured to drop HTTP headers	Enforced
ELB application load balancers should drop invalid HTTP headers	Enforced
ELB application and network load balancers should use recommended security policies	Enforced
ELB application and network load balancer listeners should use secure protocols	Enforced
ELB classic load balancers should span multiple availability zones	Mapped
ELB network load balancers should have TLS listener security policy configured	Mapped
ELB listeners should use approved SSL/TLS protocol versions	Mapped

Other (13)

Control	Status
CloudFormation stacks should have notifications enabled	Mapped
Elasticsearch domains should have audit logging enabled	Mapped
Elasticsearch domains should have cognito authentication enabled	Mapped
ES domain encryption at rest should be enabled	Mapped
Elasticsearch domains should have internal user database enabled	Mapped
Elasticsearch domain should send logs to CloudWatch	Mapped
Elasticsearch domain node-to-node encryption should be enabled	Mapped
API Gateway V2 stages should have access logging configured	Enforced
Glue data catalog metadata encryption should be enabled	Mapped
Glue data catalog connection password encryption should be enabled	Mapped
Glue jobs bookmarks encryption should be enabled	Mapped
Glue jobs CloudWatch logs encryption should be enabled	Mapped
Glue jobs S3 encryption should be enabled	Mapped

Framework	Control overlap	Note
ISO/IEC 27001:2022	High 73%
NIST Cybersecurity Framework v2.0	High 61%
PCI DSS v4.0	High 61%

Frequently asked questions

Does the Well-Architected Framework require a formal audit or certification?

No. WAF is a self-assessment framework with no certification body, no external auditor requirement, and no pass/fail outcome. You conduct reviews using the AWS Well-Architected Tool in the console, which produces a list of high-risk issues and improvement plans. AWS Solutions Architects can assist but are not auditors.

How does WAF v10 differ from earlier versions?

The "v10" label is a benchmark or package version label, not an AWS official framework version number. AWS updates Well-Architected guidance continuously across all six pillars. The most significant historical change was adding the Sustainability pillar in 2021. In the AWS Well-Architected Tool, you can update existing workload reviews to newer lens versions.

Can I use WAF review results to satisfy compliance requirements for other frameworks like SOC 2 or ISO 27001?

Not directly. WAF findings can inform remediation priorities and provide evidence of architectural review discipline, but no compliance framework accepts a WAF review as a substitute for its own assessment. Mapping WAF controls to SOC 2 or ISO 27001 controls can reduce duplicate effort, but each framework still requires its own evidence collection.

How long does a Well-Architected Review take?

A small, well-documented workload typically takes 2 to 4 hours. Complex workloads involving multiple teams can take days. The bottleneck is usually getting the right people (developers, ops, security) in the same room. Automated checks via compliance.tf can pre-populate technical findings and cut that time down.

Should every AWS workload go through a WAF review?

AWS recommends it, but in practice, prioritize production workloads handling sensitive data or business-critical functions. Development and sandbox workloads can be reviewed less frequently. A common policy is to require a WAF review before production launch and annually after that.

Enforce 72 AWS Well-Architected Framework v10 controls with one module source change.