When two passing controls create a critical finding

✓ Human-authored analysis; AI used for formatting and proofreading.

---

"We fixed our encryption settings and our VPC endpoint is configured. But the auditor still flagged us. Each control passes individually -- what are we missing?"

You are missing the interaction between controls. Security is not a checklist where each item is independent. Some combinations of passing and failing controls create risks that are worse than any single failure.

Why checklists fail at combination risks

Consider a bucket with these results:

• Encryption at rest: PASS (SSE-KMS enabled)
• Block Public Access: FAIL (not enabled)

An item-by-item checklist shows one pass and one fail. The fail gets a ticket. The pass gets ignored. But the combination is the problem: encryption is providing zero confidentiality because S3 decrypts transparently on GetObject. Anyone who can read the bucket gets plaintext.

Another example:

• VPC endpoint condition: PASS (bucket policy requires VPC endpoint)
• VPC endpoint policy: FAIL (default full-access policy)

The bucket appears network-restricted. But the default endpoint policy allows any principal on the VPC to access any S3 bucket in any AWS account. The VPC endpoint is not a restriction. It is a wormhole.

How Stave detects compound risks

After evaluating all individual controls, Stave runs three compound risk detection rules that identify known dangerous combinations:

stave evaluate --snapshot observations/snap.json --profile hipaa

COMPOUND.001 -- Public access + wildcard actions (CRITICAL)

Triggers when ACCESS.001 (Block Public Access) fails AND ACCESS.002 (no wildcard actions) fails simultaneously.

── COMPOUND RISKS ──

  [CRITICAL] COMPOUND.001 (triggers: ACCESS.001, ACCESS.002)
  Public access with overly broad IAM permissions — the S3 + IAM
  lateral movement pattern present in the majority of documented
  AWS breaches. Remediate both before addressing lower-severity findings.

This is the Capital One pattern. A public bucket with s3:* permissions becomes the pivot point for lateral movement into the broader AWS environment. The combination is CRITICAL even though ACCESS.002 alone is only HIGH.

COMPOUND.002 -- Encryption on + public access (HIGH)

Triggers when ACCESS.001 fails AND CONTROLS.001 passes simultaneously.

  [HIGH] COMPOUND.002 (triggers: ACCESS.001, CONTROLS.001)
  Encryption at rest is configured but the bucket is publicly
  accessible. Encryption provides no confidentiality benefit while
  public access is enabled.

This catches the false security pattern. The encryption checkbox is green. The compliance dashboard says encryption is handled. But the bucket is publicly readable and SSE decrypts on every GetObject call.

COMPOUND.003 -- VPC endpoint + no endpoint policy (HIGH)

Triggers when ACCESS.003 (VPC endpoint condition) passes AND ACCESS.006 (endpoint policy restriction) fails simultaneously.

  [HIGH] COMPOUND.003 (triggers: ACCESS.003, ACCESS.006)
  VPC endpoint restricts this bucket but the endpoint policy does not
  restrict which bucket ARNs are reachable. This creates a wormhole:
  any principal on the VPC can reach any S3 bucket in any account
  via the endpoint, bypassing firewall controls.

The VPC endpoint gives a false sense of network isolation. The default endpoint policy is Allow * on all resources. Any EC2 instance, Lambda function, or container on the VPC can reach any S3 bucket in any AWS account through the endpoint.

Combination and Compound Findings

Your auditor is right. Passing controls individually is necessary but not sufficient. The dangerous patterns are in the combinations: encryption without access control, network restriction without policy restriction, public access with overly broad permissions. Compound findings are prepended before individual results in the report so they get triaged first. If your compliance tool evaluates controls one at a time, it is missing the interactions that cause real breaches.

How this relates to existing compliance mods

The observation that passing controls individually is necessary but not sufficient applies to the relationship between framework-mod output and compound-chain output. turbot/steampipe-mod-aws-compliance is the canonical open-source implementation of "evaluate controls one at a time" — 540+ per-resource controls across CIS / PCI / HIPAA / NIST. It's the right answer to the necessary-condition half of the auditor's job. Stave's compound catalog covers the sufficient half: the combinations the article names (encryption without access control, network restriction without policy restriction, public access with overly broad permissions) are the cross-resource chains Stave's chain engine fires on. Necessary conditions from framework benchmarks + sufficient conditions from compound chains = both halves of the auditor's question answered. Comparison: aws-compliance-mod.