Check ID: wellarchitected_workload_no_high_or_medium_risks
Provider: AWS
Service: wellarchitected
Severity: MEDIUM
Categories: resilience
Resource type: Other

​
What this check verifies

AWS Well-Architected workloads are assessed for the presence and count of risks labeled HIGH or MEDIUM across the framework pillars. The result indicates whether any such risks remain recorded for the workload.

​
Risk

HIGH/MEDIUM risks indicate gaps that can drive:
  • Confidentiality loss (public data, excessive access)
  • Integrity issues (weak controls, unmonitored changes)
  • Availability failures (fragile resilience, poor recovery) Adversaries can exploit open endpoints and broad privileges to escalate, exfiltrate, and disrupt.

​
Recommendation

Remediate findings, prioritizing HIGH then MEDIUM. Enforce least privilege, strong encryption, and continuous logging/alerting; minimize public exposure with defense in depth; architect for resilience with tested recovery. Embed regular reviews in the SDLC and automate guardrails for consistency.

​
Remediation

Dashboard steps
  1. In the AWS Console, open Services > Well-Architected Tool
  2. Select the workload to fix
  3. Open Improvement plan (or Answer questions) and filter to High and Medium risks
  4. For each listed question, open it and change the answer to the AWS recommended best-practice choices until the question’s risk shows Low/None, then click Save
  5. Repeat until no High or Medium risks remain
  6. Go back to the workload overview and confirm High = 0 and Medium = 0

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = wellarchitected_workload_no_high_or_medium_risks. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks