✓ Human-authored analysis; AI used for formatting and proofreading.
Two approaches to the same regulation
AWS provides a HIPAA Security Conformance Pack which is a CloudFormation template that deploys ~100 AWS Config managed rules across S3, IAM, EC2, RDS, ELB, Lambda, VPC, CloudTrail, and more.
Stave provides a HIPAA profile consisting of 14 controls + 3 compound risk detectors focused on S3 and IAM, evaluated offline against JSON snapshots with duration tracking and regulatory citations.
They solve the same regulation at different depths.
Conformance Pack
The pack deploys AWS Config rules as CloudFormation resources:
S3BucketPublicReadProhibited:
Properties:
ConfigRuleName: s3-bucket-public-read-prohibited
Scope:
ComplianceResourceTypes:
- AWS::S3::Bucket
Source:
Owner: AWS
SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
Type: AWS::Config::ConfigRule
Each rule is an opaque AWS-managed check. You deploy the template, AWS Config evaluates your resources continuously, and results appear in the Config dashboard.
Strengths:
- Covers 20+ AWS services in one template
- ~100 rules including S3, IAM, EC2, RDS, ELB, Lambda, VPC, CloudTrail, KMS, Secrets Manager, SageMaker, DynamoDB, Redshift, OpenSearch
- Continuous evaluation — no manual snapshots
- Native AWS integration — no external tools
Limitations:
- Requires AWS Config enabled ($0.003 per rule evaluation per resource)
- Requires live AWS API access and IAM permissions
- Rules are opaque — you can't read the evaluation logic
- Results are in the AWS Config dashboard — vendor lock-in
- No HIPAA section citations on findings
- No duration tracking
- No compound risk detection
- No offline capability
- No proof of pass
What Stave does differently
1. Every finding cites the regulation
[FAIL] ACCESS.001 — critical
Compliance: §164.312(a)(1) — Access control
Finding: Bucket phi-patient-records: Block Public Access is not fully enabled
The AWS Config finding says "S3_BUCKET_PUBLIC_READ_PROHIBITED — NON_COMPLIANT." It doesn't tell the auditor which HIPAA section applies. Stave maps every control to its specific Security Rule citation.
2. Compound risk detection
AWS Config rules evaluate independently. Two rules can both pass while their combination is dangerous.
Stave detects three compound patterns:
[critical] COMPOUND.001 (triggers: ACCESS.001, ACCESS.002)
Public access with overly broad IAM permissions — the S3 + IAM lateral
movement pattern present in the majority of documented AWS breaches.
[high] COMPOUND.002 (triggers: ACCESS.001, CONTROLS.001)
Encryption at rest is configured but the bucket is publicly accessible.
Encryption provides no confidentiality benefit while public access is enabled.
[high] COMPOUND.003 (triggers: ACCESS.003, ACCESS.006)
VPC endpoint restricts this bucket but the endpoint policy does not
restrict which bucket ARNs are reachable — a wormhole.
AWS Config has no cross-rule reasoning. Each rule runs in isolation.
3. Duration tracking
AWS Config tells you a resource is non-compliant right now. It doesn't tell you how long it's been non-compliant.
Finding: Bucket phi-patient-records
First unsafe: 2026-01-01T00:00:00Z
Last seen: 2026-01-11T00:00:00Z
Duration: 240 hours (threshold: 168 hours)
For HIPAA, duration matters. A bucket that was public for 5 minutes during a deploy is different from one that's been public for 6 months. The Conformance Pack can't distinguish them.
4. Acknowledged exceptions with compensating controls
# stave.yaml
exceptions:
- control_id: ACCESS.001
bucket: my-cloudfront-origin
rationale: "CloudFront + OAI pattern — bucket is private to CloudFront"
acknowledged_by: security-team@example.com
requires_passing:
- CONTROLS.001
- CONTROLS.004
- AUDIT.001
The Conformance Pack supports suppression via Config rule suppressions. But without mandatory compensating controls. You can suppress a finding without documenting what alternative protection exists.
Stave requires compensating controls. If the compensating control fails, the original finding stands.
5. Offline and deterministic
The Conformance Pack requires AWS Config running in your account. Stave evaluates a JSON snapshot locally:
stave evaluate --snapshot snap.json --profile hipaa --format json
Same input always produces the same output. No AWS credentials needed. Air-gapped environments supported. The logic trace provides a verifiable reasoning chain for every verdict.
6. CMK vs AWS-managed key distinction
The Conformance Pack has S3_DEFAULT_ENCRYPTION_KMS. It checks if KMS is the default encryption. But it doesn't distinguish between the AWS-managed key (alias/aws/s3) and a customer-managed key.
Stave's CONTROLS.001.STRICT fails specifically on the AWS-managed key because it can't be revoked during a breach:
[FAIL] CONTROLS.001.STRICT — critical
Compliance: §164.312(a)(2)(iv) — CMK required for key revocation
Finding: SSE-KMS uses the AWS-managed key (alias/aws/s3).
CMK required for key revocation during breach response.
Head-to-head: S3 HIPAA controls
| Check | AWS Config Rule | Stave Control | Stave Extra |
|---|---|---|---|
| Public read | S3_BUCKET_PUBLIC_READ_PROHIBITED |
ACCESS.001 |
+ HIPAA citation, + duration |
| Public write | S3_BUCKET_PUBLIC_WRITE_PROHIBITED |
Built-in (CTL.S3.PUBLIC.003) | + severity tiering |
| Encryption at rest | S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED |
CONTROLS.001 |
— |
| KMS encryption | S3_DEFAULT_ENCRYPTION_KMS |
CONTROLS.001.STRICT |
+ CMK vs AWS-managed distinction |
| SSL/TLS only | S3_BUCKET_SSL_REQUESTS_ONLY |
CONTROLS.004 |
+ HIPAA citation |
| Logging | S3_BUCKET_LOGGING_ENABLED |
AUDIT.001 |
+ "logs cannot be obtained retroactively" |
| Versioning | S3_BUCKET_VERSIONING_ENABLED |
CONTROLS.002 |
+ MFA delete recommendation |
| ACLs disabled | S3_BUCKET_ACL_PROHIBITED |
GOVERNANCE.001 |
+ AWS Backup exception note |
| Object Lock | S3_BUCKET_DEFAULT_LOCK_ENABLED |
RETENTION.002 |
+ severity tiering (none/governance/compliance) |
| CloudTrail data events | CLOUDTRAIL_S3_DATAEVENTS_ENABLED |
AUDIT.002 |
+ object-level audit trail context |
| Account-level PAB | S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC |
Built-in | + severity downgrade when account-level present |
| Lifecycle rules | S3_VERSION_LIFECYCLE_POLICY_CHECK |
LIFECYCLE.001 |
+ PHI minimum retention check |
| Compound: public + wildcard | Not detected | COMPOUND.001 | Cross-rule reasoning |
| Compound: encrypted + public | Not detected | COMPOUND.002 | False security detection |
| Compound: VPC + no policy | Not detected | COMPOUND.003 | Wormhole detection |
Where the Conformance Pack wins
| Capability | AWS Config | Stave |
|---|---|---|
| Services covered | 20+ (EC2, RDS, ELB, Lambda, VPC, etc.) | S3 + IAM |
| Total rules | ~100 | 14 + 3 compound |
| Continuous | Yes (Config evaluates on change) | No (snapshot-based) |
| Native AWS | Yes | No (offline tool) |
| Setup effort | Deploy one CloudFormation template | Build extractor + run CLI |
If you need broad coverage across many AWS services with minimal setup, the Conformance Pack wins on breadth.
Where Stave wins
| Capability | AWS Config | Stave |
|---|---|---|
| HIPAA citations | No | Every finding cites §164.312 |
| Compound risk | No | 3 cross-rule detectors |
| Duration tracking | No | SLA-based with temporal evidence |
| Exceptions | Suppression only | Compensating controls required |
| Offline | No | Yes — air-gapped capable |
| Deterministic | No | Same input = same output |
| Proof of pass | No | Logic trace reasoning chain |
| CMK distinction | No | Fails on AWS-managed key |
| Multi-cloud | No (AWS only) | Yes (S3, IAM, GCS, DNS) |
| Readable rules | No (opaque) | Yes (YAML + CEL) |
If you need deep S3/IAM analysis with auditor-ready evidence, Stave wins on depth.
Use both
Deploy the Conformance Pack for broad continuous monitoring across all AWS services. Run Stave for deep S3/IAM analysis with compound risk detection, duration tracking, and HIPAA-cited evidence that auditors can verify offline.
The Conformance Pack is your dashboard. Stave is your proof.
Top comments (0)