Back to Checks
aws

AWS Well-Architected Tool workload has no high or medium risks

wellarchitected_workload_no_high_or_medium_risks
Service: wellarchitectedSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

AWS Well-Architected workloads are assessed for the presence and count of risks labeled HIGH or MEDIUM across the framework pillars. The result indicates whether any such risks remain recorded for the workload.

Prowler logoProwlerprowler-provider-aws

Risk

HIGH/MEDIUM risks indicate gaps that can drive:

  • Confidentiality loss (public data, excessive access)
  • Integrity issues (weak controls, unmonitored changes)
  • Availability failures (fragile resilience, poor recovery) Adversaries can exploit open endpoints and broad privileges to escalate, exfiltrate, and disrupt.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks wellarchitected_workload_no_high_or_medium_risks

Recommendation

Remediate findings, prioritizing HIGH then MEDIUM.

Enforce least privilege, strong encryption, and continuous logging/alerting; minimize public exposure with defense in depth; architect for resilience with tested recovery. Embed regular reviews in the SDLC and automate guardrails for consistency.

Remediation

Other

1In the AWS Console, open Services > Well-Architected Tool
2Select the workload to fix
3Open Improvement plan (or Answer questions) and filter to High and Medium risks
4For each listed question, open it and change the answer to the AWS recommended best-practice choices until the question's risk shows Low/None, then click Save
5Repeat until no High or Medium risks remain
6Go back to the workload overview and confirm High = 0 and Medium = 0

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.wellarchitected.wellarchitected_client import (
    wellarchitected_client,
)


class wellarchitected_workload_no_high_or_medium_risks(Check):
    def execute(self):
        findings = []
        for workload in wellarchitected_client.workloads:
            report = Check_Report_AWS(metadata=self.metadata(), resource=workload)
            report.status = "PASS"
            report.status_extended = f"Well Architected workload {workload.name} does not contain high or medium risks."
            if "HIGH" in workload.risks or "MEDIUM" in workload.risks:
                report.status = "FAIL"
                report.status_extended = f"Well Architected workload {workload.name} contains {workload.risks.get('HIGH' , 0)} high and {workload.risks.get('MEDIUM' , 0)} medium risks."

            findings.append(report)
        return findings

References