Recommendation Matrix

The priority column is conditional, not descriptive. No value in it may be emitted for a requirements-only or ADVISORY answer, or for any recommendation whose gap is not established by validated negative evidence. Reading a trigger row for its recommendation carries no priority with it. Every recommendation that creates or selects a logging, export, notification, publishing, trail or delivery-channel destination inherits the parent Skill’s encryption, destination-policy and notification-recipient requirements. Inline clauses are reminders; unverified KMS, TLS, policy, recipient, retention or delivery controls remain UNKNOWN.

Centralized log store rows: the Security Reference Architecture names Amazon CloudWatch the recommended primary option for centralized log collection and analytics, with Amazon Security Lake the secondary option for organizations with existing investments or subscriber-based access requirements. The Security Lake source rows below stay correct for an existing deployment and no row here implies the service is going away. Read the log-store decision (opens in a new tab) before recommending either store.

Contents

• Baseline: account activity and stated conditions
• Triggered by compute
• Triggered by containers
• Triggered by data
• Triggered by network and edge
• Triggered by certificates
• Triggered by organization context
  • Standards hygiene
  • Organization posture
• Priority assignment
• Report format
• Focused suitability beyond enablement

Baseline: account activity and stated conditions

These use account activity plus the row-specific conditions rather than a workload trigger.

Triggered by compute

For scanner/coverage nuances, read runtime and workload coverage (opens in a new tab).

Triggered by containers

For agent rollout or image relevance, read runtime and workload coverage (opens in a new tab).

Triggered by data

For RDS eligibility or selective malware scope, read AI and malware scope (opens in a new tab). For discovery completeness or export evidence, read the relevant Macie decision (opens in a new tab).

Triggered by network and edge

For the conditional Network Firewall rows, unresolved topology, intent or compatibility is an UNKNOWN evidence disposition, not a recommendation priority. Assign High only to a verified gap; unassessed or advisory-only decisions have no gap priority.

For origin bypass, read endpoint coverage (opens in a new tab); for inspection paths, read routed inspection (opens in a new tab).

Triggered by certificates

ACM cannot be “enabled” — it is always available. These are monitoring gaps rather than enablement gaps, and the priority reflects that an unmonitored expiry is an outage, not a breach.

Triggered by organization context

Standards hygiene

Triggered by pass 2 rather than pass 1 — these are findings about how enabled standards are configured.

The guide’s transition guidance is to enable both versions simultaneously to compare coverage, then retire the old one. Flag a long-lived overlap, not the overlap itself.

Organization posture

Delegated administrator placement per the Security Reference Architecture: GuardDuty, Security Hub, Inspector, Macie, Detective and Security Incident Response in one security tooling account; Security Lake in the Log Archive account; CloudWatch in a dedicated Monitoring account in the Security OU. With Control Tower, the security tooling account is the existing Audit or Security account. Flag any divergence.

Priority assignment

• Critical — no threat detection or posture baseline at all; org-wide coverage gap that grows with every new account; internet-facing HTTP resource with application logic and no L7 protection
• High — a deployed resource type has no corresponding detection; a prerequisite for an enabled service is missing; findings are fragmented across regions
• Medium — coverage exists but is untuned; a defense-in-depth service is absent; cost optimization available without losing visibility
• Low — configuration polish; documentation of accepted risk

Report format

Summarize scope, evidence completion, and limitations first. Use counts and masked identifiers by default; identifier disclosure requires an explicit request, and raw responses require an explicit raw-output request. Never include credentials, account emails, target payloads, or secret origin headers, even in requested raw output. Recommendation priorities below are workflow-authored; preserve source findings severity and AttackSequence/Exposure-first ordering in separate findings summaries.

For each recommendation:

Guide section: n/a is correct and expected for IAM Access Analyzer, AWS Security Incident Response, CloudWatch, the AutoEnableOrganizationMembers: ALL pass condition, the DNS Firewall fail-open check, the PCI DSS v3.2.1 retirement fact, and the priority ranking itself. AWS Config cites the CSPM guide’s standalone case. Do not invent a citation to fill the field — an unsourced recommendation labelled as such is more useful than a fabricated reference.

Focused suitability beyond enablement

For a confirmed need below, read the linked file and relevant section before resolving that decision. Load only relevant sections, not every domain. Existing protections and planned workloads can trigger these decisions; inventory alone cannot establish the need. Use the workflow’s bounded evidence and handoff rules. Requirements-only advice is ADVISORY.