compliance

On Jul 27, 2026, AWS launched the Security Hub MCP App preview—8 read-only tools that bring exposure findings, attack paths, and remediation guidance into Claude Desktop at no additional cost for Security Hub customers.

For a card-acquiring fintech (~12M authorizations/mo), Payment Cryptography + PCI-scoped account cut HSM rack lease −$18k/mo — fraud review queue p95 2.4s → 380ms after EventBridge Pipes idempotency fix.

On a B2B SaaS crossing Series A (~$18.5k/mo AWS), running the funding-stage gate checklist before the B round cut diligence prep from 11 weeks to 4 — Organizations split, WAF, and SOC2 evidence path without re-platforming.

On a defense-subcontract SaaS (~$42k/mo AWS, CUI in scope), choosing GovCloud (US) over commercial US-East cut inherited-control review from 11 weeks to 4 — after mapping 47 customer-responsibility controls in the SSP inheritance worksheet.

Production checklist for Prowler and AWS Security Hub — multi-account setup, scheduled scans, finding workflows, and remediation patterns on AWS.

On June 15, 2026 AWS made Console Private Access work without internet — VPC endpoints route 100% of browser traffic. First-party benchmark: 161 interface endpoints and ~$263/mo for a 12-service 3-AZ pilot in us-east-1.

Control Tower gets you an org; it does not tell you how many OUs you need or which policy type owns VPC public access. Since re:Invent 2024 you have four layers — SCP, RCP, declarative, and tag policies — and RCP coverage grew through Feb 2026 (DynamoDB). A composite 60-account enterprise cut exception SCP attachments from 14 ad-hoc to 3 time-boxed RFCs in two quarters by moving accounts out of "temporary" prod OUs.

Security Hub detects control failures. It is not the compliance pipeline — and treating it as one is why teams still scramble for evidence at audit time. The four jobs are distinct: AWS Config detects drift, conformance packs deploy rules org-wide as immutable bundles, SSM Automation remediates the safe class, and evidence accrues via conformance-pack exports plus Security Hub control status (Audit Manager only if you onboarded before it closed to new customers on 30 April 2026). Here is the tool-per-job matrix, a conformance pack with auto-remediation, and the auto-remediation gotcha to design around.

The AWS European Sovereign Cloud reached GA in Brandenburg on January 15, 2026—but most EU SaaS workloads still fit standard EU regions plus DPA/SCC. This guide separates data at rest, inference routing (Bedrock geographic vs global profiles), and when sovereign cloud is worth the premium.

After Security Hub Essentials consolidated Inspector and CSPM into per-resource pricing (example: 500 units ≈ $1,875/mo), most AWS-only estates should run native first. This guide scores when Wiz/Orca-class tools earn a line item—and when paying twice for the same CVE is the real failure mode.

Production CloudTrail: multi-region org trails, log validation, CMK, Lake + Athena. July 2026 checklist — Event History is not enough.

EBS default encryption per Region, CMK lifecycle, block public snapshots. July 2026 baseline checklist — retrofit is expensive.