Disclaimer: Internal engineering gap-check only. Not a formal QSA assessment. Formal compliance requires a Qualified Security Assessor (QSA). Read-only automated collection; no AWS resources were modified.
Vulnerability management, runtime currency, WAF coverage, and CI/CD change-control posture.
InspectorEoL runtimesWAF coverageCI/CD control
6.3 — Vulnerability Identification & Patch Management
Amazon Inspector v2 is DISABLED — automated detection of overdue OS/library patches is not available. Marked for manual review.
Note: SSM Run Command inspection unavailable in this environment (aws-cli send-command incompatibility; prior attempt returned send-failed) — instance-level checks require manual review.
6.3 — Lambda Runtime Currency
| Runtime | Functions | Status | Note |
|---|
| nodejs20.x | 42 | Compliant | Supported |
| nodejs12.x | 6 | Gap | End-of-life / deprecated |
| dotnet6 | 3 | Compliant | Supported |
| python3.7 | 3 | Gap | End-of-life / deprecated |
| dotnetcore3.1 | 2 | Gap | End-of-life / deprecated |
6.4 — Web Application Protection (WAF)
| Public Distribution | WAF Web ACL | Status |
|---|
| adm**** | Attached | Compliant |
| api**** | Attached | Compliant |
| log**** | Attached | Compliant |
| for**** | None | Gap |
| log**** | Attached | Compliant |
| for**** | None | Gap |
| por**** | None | Gap |
6.5 — Change Control (CI/CD Pipelines)
| Pipeline | Stages | Stage Names | Manual Approval |
|---|
| rev**** | 4 | Source, Build, Approve, Deploy | Compliant |
Control Mapping
| Control | Description | Status | Evidence |
|---|
| 6.3.1 | Identify security vulnerabilities (scanning) | Gap | Amazon Inspector state=DISABLED |
| 6.3.3 | Critical/High patches applied within defined window | Needs Review | Inspector disabled — patch-currency cannot be auto-verified; manual review required |
| 6.3.3 (Lambda) | Serverless runtimes on supported versions | Gap | 3 EoL runtime group(s): nodejs12.x×6, python3.7×3, dotnetcore3.1×2 |
| 6.3.3 (RDS) | Database auto minor version upgrade enabled | Compliant | 2/2 DBs auto-upgrade minor versions |
| 6.4.2 | WAF in front of public web apps | Gap | 4/7 CloudFront distributions have a WAF Web ACL; 1 ACL(s) total |
| 6.5.1 | Change control with review/approval (pipeline) | Compliant | 1 pipeline(s); manual-approval stage present |
| 6.5.1 (Secrets) | No plaintext secret-like values in build config | Compliant | 0 suspicious plaintext env var(s) |
| 6.4.1 (Segmentation) | Environment separation (VPC peering review) | Compliant | 0 active VPC peering connection(s) — verify prod/non-prod isolation |
Recommendations
HighUpgrade Lambda functions on end-of-life runtimes (nodejs12.x×6, python3.7×3, dotnetcore3.1×2) to supported versions — EoL runtimes stop receiving security patches.
HighEnable Amazon Inspector to continuously detect vulnerable OS packages and libraries (PCI 6.3.1/6.3.3).
MediumAttach an AWS WAF Web ACL to the 3 public distribution(s) currently without WAF (PCI 6.4.2).
ProcessMaintain SDLC / secure-coding standards and track bespoke software vulnerabilities (PCI 6.2).