Amazon_S3_Lens.json

{
    "schemaVersion": "2021-11-01",
    "name": "Amazon S3 Well-Architected Lens",
    "description": "Best practices for configuring Amazon S3",
    "_version": "v3.1.0",
    "_note": "Append new info with 2023 re:invent update. 2023-Dec-21",    
    "pillars": [
        {
            "id": "operationalExcellence",
            "name": "Operational Excellence",
            "questions": [
                {
                    "id": "OPS_1",
                    "title": "How do you track ownership of data stored in S3, and how that data is used?",
                    "description": "A clear understanding of the purpose of data informs many other operational processes. The foundation of understanding that purpose is establishing a logical owner, such as a team, who can answer questions and/or make decisions when necessary.",
                    "choices": [
                        {
                            "id": "OPS_1_1",
                            "title": "Buckets and/or AWS accounts are required to be tagged",
                            "helpfulResource": {
                                "displayText": "Tagging can be used to ensure each resource clearly describes what team and workload owns it. This allows for costs to be allocated, for questions about best practices to be followed up on, and for configuration changes to be reviewed.\n\nA tagging strategy should be used for an organization. While the exact details will differ from organization to organization, and some workloads will add additional detail, it is important that consistency around a core set of tags is maintained for the organization.\n\nS3 also supports object tags and object level user metadata, which could store ownership information, but some features such as Cost Allocation Tags only support bucket level tags, and tagging every object adds cost to many use cases, so bucket tags are valuable.",
                                "url": "https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/defining-needs-and-use-cases.html"
                            },
                            "improvementPlan": {
                                "displayText": "Tagging can be an effective scaling mechanism for implementing cloud management and governance strategies",
                                "url": "https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/defining-needs-and-use-cases.html"
                            }
                        },
                        {
                            "id": "OPS_1_2",
                            "title": "Cost Allocation Tags are enabled for relevant tag keys used to tag buckets",
                            "helpfulResource": {
                                "displayText": "Bucket tags can be used in Cost Explorer or Cost and Usage Reports to group costs and visualize usage. But to be used in this way, the tag keys you want to use in this way must be enabled.",
                                "url": "https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html"
                            },
                            "improvementPlan": {
                                "displayText": "Tag buckets to helps manage and allocate costs",
                                "url": "https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html"
                            }
                        },
                        {
                            "id": "OPS_1_3",
                            "title": "Using Amazon Macie to automate the discovery of sensitive data",
                            "helpfulResource": {
                                "displayText": "Amazon Macie is a data security service that discovers sensitive data by using machine learning and pattern matching.\n\nMacie automates discovery and reporting of sensitive data to provide you with a better understanding of the data that your organization stores in Amazon S3.",
                                "url": "https://docs.aws.amazon.com/macie/latest/user/discovery-asdd.html"
                            },
                            "improvementPlan": {
                                "displayText": "Classify and secure sensitive data with Macie",
                                "url": "https://docs.aws.amazon.com/macie/latest/user/discovery-asdd.html"
                            }
                        },
                        {
                            "id": "OPS_1_4",
                            "title": "Within buckets, use prefixes to group common data",
                            "helpfulResource": {
                                "displayText": "The first strategy to categorizing that data within a bucket is a pattern for key names that utilizes common prefixes, and hierarchies. ListObjects, Storage Lens and other features can make use of prefix patterns to locate objects with common patterns.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-prefixes.html"
                            },
                            "improvementPlan": {
                                "displayText": "Organizing objects using prefixes",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-prefixes.html"
                            }
                        },
                        {
                            "id": "OPS_1_5",
                            "title": "Using prefix level metrics in S3 Storage Lens",
                            "helpfulResource": {
                                "displayText": "If you need a deeper level of understanding the breakdown of data in a bucket, S3 Storage Lens' advanced metrics provides prefix level metrics.\n\nNote that enabling advanced metrics for S3 Storage Lens incurs additional per-object recurring costs. If you have a large number of objects, you can estimate the costs before enabling and consider short term enablement as needed.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-lens-cloudwatch-metrics-dimensions.html"
                            },
                            "improvementPlan": {
                                "displayText": "S3 Storage Lens dashboard helps to drill down for more details about the specific regions, buckets, or prefixes to further assist you",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-lens-cloudwatch-metrics-dimensions.html"
                            }
                        },
                        {
                            "id": "OPS_1_6",
                            "title": "Using object level tags",
                            "helpfulResource": {
                                "displayText": "Object level tags can be used for fine-grained access-control via IAM conditions keys, to filter lifecycle rules, as part of custom metrics.\n\nNote, object level tags cannot be used for Cost Allocation Tags, and incur additional per-object recurring costs. When working with large numbers of objects, consider the costs associated with object tags before broad usage.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html"
                            },
                            "improvementPlan": {
                                "displayText": "Categorizing your storage using tags",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html"
                            }
                        },
                        {
                            "id": "OPS_1_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "OPS_1_1 && OPS_1_2 && OPS_1_3 && OPS_1_4 && OPS_1_5 && OPS_1_6",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "OPS_2",
                    "title": "How do you capture data regarding usage for future analysis?",
                    "description": "AWS CloudTrail Data Events for S3 and Amazon S3 Server Access Logs, provide a record of actions that are taken by users, roles, or AWS services on Amazon S3 resources and maintain log records for auditing and compliance purposes.",
                    "choices": [
                        {
                            "id": "OPS_2_1",
                            "title": "Enabled AWS CloudTrail Data Events for S3",
                            "helpfulResource": {
                                "displayText": "We recommend that you use CloudTrail Data Events for S3 as your primary log source for S3, due to the faster delivery, higher delivery assurance, and integration with analysis tools.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging.html"
                            },
                            "improvementPlan": {
                                "displayText": "Enabling CloudTrail event logging for S3 buckets and objects",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html"
                            }
                        },
                        {
                            "id": "OPS_2_2",
                            "title": "Configured monitoring for CloudTrail status",
                            "helpfulResource": {
                                "displayText": "To ensure that CloudTrail remains enabled in your account, AWS Config provides the cloudtrail-enabled managed rule. If CloudTrail is turned off, the cloudtrail-enabled rule automatically re-enables it by using automatic remediation.",
                                "url": "https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-re-enable-aws-cloudtrail-by-using-a-custom-remediation-rule-in-aws-config.html"
                            },
                            "improvementPlan": {
                                "displayText": "Enable AWS Config rule to automatically re-enable AWS CloudTrail using a custom remediation",
                                "url": "https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-re-enable-aws-cloudtrail-by-using-a-custom-remediation-rule-in-aws-config.html"
                            }
                        },
                        {
                            "id": "OPS_2_3",
                            "title": "Configured Trusted Advisor alarm for AWS CloudTrail Logging alerts",
                            "helpfulResource": {
                                "displayText": "To ensure changes to configuration do not disrupt the delivery of events to your CloudTrail, you should create an alarm for the Trusted Advisor Check AWS CloudTrail Logging to notify you in the case delivery is disrupted.",
                                "url": "https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#aws-cloudtrail-logging"
                            },
                            "improvementPlan": {
                                "displayText": "Create Amazon CloudWatch alarm to monitor AWS CloudTrail Logging configuration",
                                "url": "https://docs.aws.amazon.com/awssupport/latest/user/cloudwatch-metrics-ta.html#cloudwatch-metrics-dimensions-for-trusted-advisor"
                            }
                        },
                        {
                            "id": "OPS_2_4",
                            "title": "Enabled Amazon S3 Server Access Logs",
                            "helpfulResource": {
                                "displayText": "Amazon S3 Server Access Logs capture some events and data points not available in CloudTrail Data Events for S3.\n\nThese logs provide visibility into: \na. Individual keys deleted as part of a DeleteObjects request \nb. The size of a processed object \nc. Time to complete a request \nd. Lifecycle transitions or expirations",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html"
                            },
                            "improvementPlan": {
                                "displayText": "Logging requests using server access logging",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html"
                            }
                        },
                        {
                            "id": "OPS_2_5",
                            "title": "Configured Trusted Advisor alarm for Amazon S3 Bucket Logging alerts",
                            "helpfulResource": {
                                "displayText": "When logging is initially enabled, the configuration is automatically validated. However, future modifications can result in logging failures. This check examines explicit Amazon S3 bucket permissions, but it does not examine associated bucket policies that might override the bucket permissions.",
                                "url": "https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-s3-bucket-logging"
                            },
                            "improvementPlan": {
                                "displayText": "Create Amazon CloudWatch alarm to monitor Amazon S3 Server Access Log configuration",
                                "url": "https://docs.aws.amazon.com/awssupport/latest/user/cloudwatch-metrics-ta.html#cloudwatch-metrics-dimensions-for-trusted-advisor"
                            }
                        },
                        {
                            "id": "OPS_2_6",
                            "title": "Planned for/Enabled Client Metrics",
                            "helpfulResource": {
                                "displayText": "AWS SDKs often support SDK client metrics. SDK client metrics can be enabled for monitoring API requests from SDKs, and can capture aspects of a request that are visible only to the client, such as how many concurrent requests are occurring, additional network latency, and a higher degree of granularity.\n\nKeep in mind that since S3 API calls can be high volume, this type of metrics can create additional costs from CloudWatch and create client and network load.",
                                "url": "https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/metrics.html"
                            },
                            "improvementPlan": {
                                "displayText": "Using AWS SDK's to emit client metrics",
                                "url": "https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/metrics.html"
                            }
                        },
                        {
                            "id": "OPS_2_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "OPS_2_1 && OPS_2_2 && OPS_2_3 && OPS_2_4 && OPS_2_5 && OPS_2_6",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(OPS_2_1 && (OPS_2_2 || OPS_2_3)) || (OPS_2_4 && OPS_2_5)",
                            "risk": "MEDIUM_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "HIGH_RISK"
                        }
                    ]
                },
                {
                    "id": "OPS_3",
                    "title": "How do you provide access to usage data for analysis?",
                    "description": "You should think in advance on what tools you will use to analyze usage data, so that when the need arises, you do not waste valuable time finding and configuring tools.",
                    "choices": [
                        {
                            "id": "OPS_3_1",
                            "title": "Configured a query mechanism for S3 CloudTrail Data events",
                            "helpfulResource": {
                                "displayText": "S3 Data Events do not appear in the CloudTrail Event History. If you want users to be able to access them, you will want to provide them with a mechanism to query the data stored in the S3 CloudTrail records.\n\nWhile there are many possible options to do this, one of the most readily available is AWS CloudTrail Lake, which allows you to execute SQL-based queries against your CloudTrail events, including the S3 data events.",
                                "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html"
                            },
                            "improvementPlan": {
                                "displayText": "Using AWS CloudTrail Lake, a managed data lake that lets organizations aggregate, immutably store, and query events recorded by CloudTrail for auditing, security investigation, and operational troubleshooting",
                                "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html"
                            }
                        },
                        {
                            "id": "OPS_3_2",
                            "title": "Configured a query mechanism for Amazon S3 Server Access Logs",
                            "helpfulResource": {
                                "displayText": "S3 Server Access Logs are output to your designated location as a series of individual files. To enable your users to work with this data you will want to provide them with a mechanism to query the data stored in them.\n\nYou can utilize Amazon Athena to create a table that allows access to S3 Server Access Logs. Athena is appropriate for infrequent usage, as there is no upfront costs to configure, and you only pay per query and the associated S3 usage. If you are have complex, regular or recurring analysis needs, Athena might still be an appropriate solution, but you should also take the time to evaluate other solutions, such as OpenSearch.",
                                "url": "https://repost.aws/knowledge-center/analyze-logs-athena"
                            },
                            "improvementPlan": {
                                "displayText": "Use Athena to quickly analyze and query server access logs.",
                                "url": "https://repost.aws/knowledge-center/analyze-logs-athena"
                            }
                        },
                        {
                            "id": "OPS_3_3",
                            "title": "Amazon S3 Storage Lens metrics enabled",
                            "helpfulResource": {
                                "displayText": "Amazon S3 provides and supports a collection of metrics in CloudWatch and/or S3 Storage Lens. Some of these are enabled by default, some are enabled with S3 Storage Lens, and some are enabled as Advanced Metrics for S3 Storage Lens.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage_lens_view_metrics_cloudwatch.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use S3 Storage Lens Advanced Storage Metrics for advanced metric categories, prefix-level aggregation, contextual recommendations, and Amazon CloudWatch publishing",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage_lens_basics_metrics_recommendations.html#storage_lens_basics_metrics_selection"
                            }
                        },
                        {
                            "id": "OPS_3_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "OPS_3_1 && OPS_3_2 && OPS_3_3",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "OPS_4",
                    "title": "How do you monitor your user's experience?",
                    "description": "When S3 is utilized to distribute content over the internet or regional networks, the performance of those networks can have impacts on the user experience or performance of consuming workloads. Monitoring these networks can provide insights that will avoid time consuming investigations, allow you to explain causes of user experience, or to pursue mitigations.",
                    "choices": [
                        {
                            "id": "OPS_4_1",
                            "title": "Monitor Internet traffic patterns to understand impacts on user experience or workload performance",
                            "helpfulResource": {
                                "displayText": "Amazon CloudWatch Internet Monitor provides visibility into how internet issues impact the performance and availability between your applications hosted on AWS and your end users. If your users access your bucket directly, or via Amazon CloudFront, internet issues can impact their experience. Being aware of these issues can help understand the experiences of those users, take actions to improve their experience, and better communicate with those users about their experience.\n\nIf your workload does not have Internet users:\n  - Click 'Mark best practice(s) that do not apply to this workload'\n  - Select 'Monitor Internet traffic patterns to understand impacts on user experience or workload performance'\n  - Enter 'Out of Scope' for 'Reason not applicable'\n  - Enter 'S3 resources are not directly utilized by users who reach S3 or CloudFront via the Internet' for 'Additional details'.",
                                "url": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-InternetMonitor.html"
                            },
                            "improvementPlan": {
                                "displayText": "Using Amazon CloudWatch Internet Monitor for continuous observability of internet measurements, such as availability and performance, tailored to your workload footprint on AWS",
                                "url": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-InternetMonitor.html"
                            },
                            "additionalResources": [
                                {
                                    "type": "IMPROVEMENT_PLAN",
                                    "content": [
                                        {
                                            "displayText": "Or if your workload does not have Internet users:\n  - Click 'Mark best practice(s) that do not apply to this workload'\n  - Select 'Monitor Internet traffic patterns to understand impacts on user experience or workload performance'\n  - Enter 'Out of Scope' for 'Reason not applicable'\n  - Enter 'S3 resources are not directly utilized by users who reach S3 or CloudFront via the Internet' for 'Additional details'.",
                                            "url": "https://docs.aws.amazon.com/wellarchitected/latest/userguide/tutorial-step2.html"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "OPS_4_2",
                            "title": "Monitor inter-region networking performance variations to understand impacts on user experience or workload performance",
                            "helpfulResource": {
                                "displayText": "AWS Network Manager Infrastructure Performance monitoring can provides visibility into real-time health and latency between AWS regions. When you have users or workloads that access S3 via cross-region calls, either through public endpoints or via Interface VPC endpoints, that traffic passes between AWS regions by the AWS global network.\n\nIf your workload does not utilize S3 across regions:\n  - Click 'Mark best practice(s) that do not apply to this workload'\n  - Select 'Monitor inter-region networking performance variations to understand impacts on user experience or workload performance'\n  - Enter 'Out of Scope' for 'Reason not applicable'\n  - Enter 'S3 resources are not accessed across regions by users or workload operations' for 'Additional details'.",
                                "url": "https://docs.aws.amazon.com/network-manager/latest/infrastructure-performance/what-is-nmip.html"
                            },
                            "improvementPlan": {
                                "displayText": "Infrastructure Performance allows you to obtain near real-time and historical network latency across AWS Regions and across or within Availability Zones for a specified time period.",
                                "url": "https://docs.aws.amazon.com/network-manager/latest/infrastructure-performance/what-is-nmip.html"
                            },
                            "additionalResources": [
                                {
                                    "type": "IMPROVEMENT_PLAN",
                                    "content": [
                                        {
                                            "displayText": "Or if your workload does not utilize S3 across regions:\n  - Click 'Mark best practice(s) that do not apply to this workload'\n  - Select 'Monitor inter-region networking performance variations to understand impacts on user experience or workload performance'\n  - Enter 'Out of Scope' for 'Reason not applicable'\n  - Enter 'S3 resources are not accessed across regions by users or workload operations' for 'Additional details'.",
                                            "url": "https://docs.aws.amazon.com/wellarchitected/latest/userguide/tutorial-step2.html"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "OPS_4_3",
                            "title": "Monitor CloudFront distribution metrics",
                            "helpfulResource": {
                                "displayText": "It is very common to use S3 as the origin of a CloudFront distribution. In these cases, monitoring CloudFront distribution metrics can provide insight into user experiences, whether misconfigurations have occurred, and other important details.\n\nIf your workload does not utilize CloudFront:\n  - Click 'Mark best practice(s) that do not apply to this workload'\n  - Select 'Monitor CloudFront distribution metrics'\n  - Enter 'Out of Scope' for 'Reason not applicable'\n  - Enter 'S3 resources are not accessed by CloudFront' for 'Additional details'.",
                                "url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/viewing-cloudfront-metrics.html#monitoring-console.distributions"
                            },
                            "improvementPlan": {
                                "displayText": "Using CloudFront distriubution metrics helps you troubleshoot, track, and debug issues",
                                "url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/viewing-cloudfront-metrics.html#monitoring-console.distributions"
                            },
                            "additionalResources": [
                                {
                                    "type": "IMPROVEMENT_PLAN",
                                    "content": [
                                        {
                                            "displayText": "Or if your workload does not utilize CloudFront:\n  - Click 'Mark best practice(s) that do not apply to this workload'\n  - Select 'Monitor CloudFront distribution metrics'\n  - Enter 'Out of Scope' for 'Reason not applicable'\n  - Enter 'S3 resources are not accessed by CloudFront' for 'Additional details'.",
                                            "url": "https://docs.aws.amazon.com/wellarchitected/latest/userguide/tutorial-step2.html"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "OPS_4_no",
                            "title": "No, S3 resources are not directly utilized by any workload or user outside the region of the S3 resource",
                            "helpfulResource": {
                                "displayText": "While some of the practices here might be relevant to your workload, if the only access to S3 is directly via your workload's services, these practices will not be relevant to performance of S3 requests."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "OPS_4_no || (OPS_4_1 && OPS_4_2 && OPS_4_3)",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "OPS_5",
                    "title": "How do you validate that the best practices you have chosen remain in place?",
                    "description": "Once best practices are chosen, audit practices can inform you of any change in that configuration, allowing you to remediate.",
                    "choices": [
                        {
                            "id": "OPS_5_1",
                            "title": "Using a rules engine",
                            "helpfulResource": {
                                "displayText": "Rules engines, such as AWS Config, can validate best practices are configured as intended.\n\nAWS Config provides a set of built-in rules that map to some of the best practices in this guide. Consider enabling AWS Config and these rules across your accounts to validate these best practices. If you have alternate controls or reasons to deviate from these best practices, disable that rule.\n\nRules to consider: Any starting with s3-",
                                "url": "https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-level-public-access-prohibited.html"
                            },
                            "improvementPlan": {
                                "displayText": "Enable appropriate AWS Config rules for S3 (s3-*) to validate S3 best practices",
                                "url": "https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-level-public-access-prohibited.html"
                            }
                        },
                        {
                            "id": "OPS_5_2",
                            "title": "Use Amazon S3 Inventory to audit and report on the replication and encryption status of your objects",
                            "helpfulResource": {
                                "displayText": "You can use Amazon S3 Inventory to help manage your storage. For example, you can use it to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-inventory.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use Amazon S3 Inventory to audit and report on the replication and encryption status of your objects",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-inventory-athena-query.html"
                            }
                        },
                        {
                            "id": "OPS_5_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "OPS_5_1 && OPS_5_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                }
            ]
        },
        {
            "id": "security",
            "name": "Security",
            "questions": [
                {
                    "id": "SEC_01",
                    "title": "How do you manage Amazon S3 data you intend to share publicly?",
                    "description": "Amazon S3 bucket data is private by default. Sharing Amazon S3 data publicly should be done deliberately and with caution.",
                    "choices": [
                        {
                            "id": "SEC_01_1",
                            "title": "Segregate data that needs to be publicly shared into separate AWS accounts.",
                            "helpfulResource": {
                                "displayText": "Using separate accounts for publicly shared data allows you to enable Amazon S3 Block Public Access for other accounts and avoid accidental public sharing of data."
                            },
                            "improvementPlan": {
                                "displayText": "Use separate accounts for publicly shared data, allowing you to enable Amazon S3 Block Public Access for other accounts and avoid accidental public sharing of data.",
                                "url": "https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_securely_operate_multi_accounts.html"
                            }
                        },
                        {
                            "id": "SEC_01_2",
                            "title": "Utilizing a Content Delivery Network, with controls to limit direct bucket access.",
                            "helpfulResource": {
                                "displayText": "When data is shared publicly, you should consider that you could incur additional costs or availability impacts if a DDoS attack was directed at your bucket. Using a Content Delivery Network, can provide protections here. To ensure those protections are realized, you should limit direct bucket access, such that your CDN resources can access the bucket.\n\nAmazon CloudFront provides this type of protections, through integration with AWS WAF. AWS Shield provides access to other resources to responding to this type of event. Origin Access Control (OAC) limits direct access to your bucket to the CloudFront distribution you have created.",
                                "url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#create-oac-overview-s3"
                            },
                            "improvementPlan": {
                                "displayText": "Limit the direct access to Amazon S3 bucket by using Content Delivery Networks",
                                "url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#create-oac-overview-s3"
                            }
                        },
                        {
                            "id": "SEC_01_3",
                            "title": "Scan publicly shared bucket contents for sensitive data",
                            "helpfulResource": {
                                "displayText": "Buckets that is shared publicly should scan content for sensitive data, to mitigate any accidental or malicious addition of sensitive data.\n\nAmazon Macie automates discovery and reporting of sensitive data to provide you with a better understanding of the data that your organization stores in Amazon S3. To detect sensitive data, you can use built-in criteria and techniques that Macie provides, custom criteria that you define, or a combination of the two. If Macie detects sensitive data in an S3 object, Macie generates a finding to notify you of the sensitive data that Macie found.",
                                "url": "https://docs.aws.amazon.com/macie/latest/user/discovery-asdd.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use Amazon Macie to discover and report sensitive data stored in your buckets",
                                "url": "https://docs.aws.amazon.com/macie/latest/user/discovery-asdd.html"
                            }
                        },
                        {
                            "id": "SEC_01_no",
                            "title": "No, this workload does not have data that needs to be shared publicly.",
                            "helpfulResource": {
                                "displayText": "You should enable Amazon S3 Block Public Access for your account to avoid accidental public sharing of data, and follow other best practices under \"How do you ensure data that should not be shared publicly is not shared publicly?\"",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_01_no && SEC_01_1 && SEC_01_2 && SEC_01_3",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!SEC_01_2)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_02",
                    "title": "How do you ensure that data that should not be made public is not made public?",
                    "description": "Unless you explicitly require anyone on the internet to be able to read or write to your Amazon S3 bucket, you should ensure that your Amazon S3 bucket is not public.",
                    "choices": [
                        {
                            "id": "SEC_02_1",
                            "title": "Use Amazon S3 block public access.",
                            "helpfulResource": {
                                "displayText": "With Amazon S3 block public access, account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. For more information, see Blocking public access to your Amazon S3 storage.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use Amazon S3 block public access",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
                            }
                        },
                        {
                            "id": "SEC_02_2",
                            "title": "Identify Amazon S3 bucket policies that use wildcard identities or actions",
                            "helpfulResource": {
                                "displayText": "Wildcard identities such as Principal \"*\" (which effectively means \"anyone\") or allows a wildcard action \"*\" (which effectively allows the user to perform any action in the Amazon S3 bucket)."
                            },
                            "improvementPlan": {
                                "displayText": "Review bucket access using IAM Access Analyzer for S3",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-analyzer.html"
                            }
                        },
                        {
                            "id": "SEC_02_3",
                            "title": "Identify Amazon S3 bucket access control lists (ACLs) that provide public access",
                            "helpfulResource": {
                                "displayText": "Identify Amazon S3 bucket access control lists (ACLs) that provide read, write, or full-access to 'Everyone' or 'Any authenticated AWS user'",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/acls.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use AWS Services to detect S3 buckets that your users have configured for public access across different AWS Regions in your AWS account and AWS Organizations",
                                "url": "https://aws.amazon.com/blogs/storage/find-public-s3-buckets-in-your-aws-account/"
                            },
                            "additionalResources":[
                                {
                                  "type": "HELPFUL_RESOURCE",
                                  "content": [
                                    {
                                      "displayText": "Disable ACLs for buckets without explicit use case.",
                                      "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html#object-ownership-considerations"
                                    }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "SEC_02_4",
                            "title": "Use AWS Trusted Advisor to inspect your Amazon S3 implementation.",
                            "helpfulResource": {
                                "displayText": "AWS Trusted Advisor provides the Amazon S3 Bucket Permissions check. This check validates these recommendations are implemented.",
                                "url": "https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#amazon-s3-bucket-permissions"
                            },
                            "improvementPlan": {
                                "displayText": "Use AWS Trusted Advisor to inspect your Amazon S3 implementation",
                                "url": "https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html#amazon-s3-bucket-permissions"
                            }
                        },
                        {
                            "id": "SEC_02_5",
                            "title": "Use detective controls to discover publicly exposed buckets and validate above controls",
                            "helpfulResource": {
                                "displayText": "Using a compliance validation engine, such as AWS Config, validate that the above settings stay unchanged.\n\nAWS Config provides the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed AWS Config Rules, that validate block public access is set.\n\nAmazon Macie provides you with an inventory of your S3 buckets, and automatically evaluates and monitors the buckets for security and access control. If Macie detects a potential issue with the security or privacy of your data, such as a bucket that becomes publicly accessible, Macie generates a finding for you to review and remediate as necessary.",
                                "url": "https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-public-read-prohibited.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use AWS Config managed rules to validate the settings of your Amazon S3 buckets",
                                "url": "https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html"
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "s3-bucket-public-write-prohibited managed AWS Config Rules",
                                            "url": "https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-public-write-prohibited.html"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "SEC_02_6",
                            "title": "Configured Service Control Policies as guardrails around block public access settings",
                            "helpfulResource": {
                                "displayText": "Very few users should be granted access to change block public access settings. While best practice is to use least privilege IAM policies to limit this access, in order to guard against an error in an IAM policy, a Service Control Policy can be used to explicitly deny this permission to either all users or a very limited set.",
                                "url": "https://aws-samples.github.io/aws-iam-permissions-guardrails/guardrails/scp-guardrails.html#scp-s3-1"
                            },
                            "improvementPlan": {
                                "displayText": "Use SCP to prevent disabling S3 account public access block",
                                "url": "https://aws-samples.github.io/aws-iam-permissions-guardrails/guardrails/scp-guardrails.html#scp-s3-1"
                            }
                        },
                        {
                            "id": "SEC_02_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_02_1 && SEC_02_2 && SEC_02_3 && SEC_02_4 && SEC_02_5 && SEC_02_6",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "HIGH_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_03",
                    "title": "How do you define encryption in-transit requirements and validate these requirements are met?",
                    "description": "All S3 API Endpoints, VPC Endpoints, and Access Points support TLS 1.2, and utilize it by default with all AWS SDKs and tooling. Custom clients and client configurations can opt-out of encryption, or choose older encryption protocols. Controls can restrict connections to specific encryption requirements, rejecting connections that are not compliant.",
                    "choices": [
                        {
                            "id": "SEC_03_1",
                            "title": "Requirements are provided by a compliance standard.",
                            "helpfulResource": {
                                "displayText": "If your organization or workload is subject to a particular compliance program, this will inform your encryption requirements.",
                                "url": "https://aws.amazon.com/compliance/programs/"
                            },
                            "improvementPlan": {
                                "displayText": "Understand and document, any compliance programs that apply to your workload"
                            }
                        },
                        {
                            "id": "SEC_03_2",
                            "title": "Requirements are based on company wide policy.",
                            "helpfulResource": {
                                "displayText": "An encryption policy establishes, at a senior management level, the business and compliance expectations that the organization needs to meet."
                            },
                            "improvementPlan": {
                                "displayText": "Understand and document, at a senior management level, the business and compliance expectations that the organization needs to meet"
                            }
                        },
                        {
                            "id": "SEC_03_3",
                            "title": "Use the latest SDKs and client software",
                            "helpfulResource": {
                                "displayText": "When client and server first establish a connection, they negotiate the transmission protocol to be used for the connection, optimizing to utilize the most preferred protocol supported by both client and server. S3 supports TLS versions 1.2, 1.1 and 1.0 (the last two will no longer be supported after June, 28, 2023). Using the latest clients that at support an appropriate version of TLS will ensure that clients connect to S3 with the latest version of TLS."
                            },
                            "improvementPlan": {
                                "displayText": "Use the latest SDKs and client software",
                                "url": "https://aws.amazon.com/developer/tools/"
                            }
                        },
                        {
                            "id": "SEC_03_4",
                            "title": "Implementing detective controls to enforce encryption in-transit ",
                            "helpfulResource": {
                                "displayText": "Using Service control policies to enforce SecureTransport",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html"
                            },
                            "improvementPlan": {
                                "displayText": "Implement ongoing detective controls by using AWS Config Managed rules",
                                "url": "https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-ssl-requests-only.html"
                            }
                        },
                        {
                            "id": "SEC_03_5",
                            "title": "Bucket policies include a SecureTransport restriction.",
                            "helpfulResource": {
                                "displayText": "By explicitly blocking access that does not use HTTPS, you can ensure that non-compliant clients receive an error message and are forced to apply updates to utilize a secure transport protocol",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-use-case-HTTP-HTTPS-1"
                            },
                            "improvementPlan": {
                                "displayText": "Enforcing encryption of data in transit in your Amazon S3 bucket policy",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-use-case-HTTP-HTTPS-1"
                            }
                        },
                        {
                            "id": "SEC_03_6",
                            "title": "Are aware of any proxies that could impact encryption in-transit requirements.",
                            "helpfulResource": {
                                "displayText": "Proxies can be used to terminate HTTPS connections, and then relay those connections, with the result that for connections to S3 using these mechanisms involves two connections.\n\nWhile this might be out of the scope of your requirements; for example if such a proxy is part of a customer's corporate network, if such servers are inside your organizations realm of control, they should be evaluated and treated as a distinct client & server in regards to in-transit requirements.\n\nNote: This type of proxy requires a high degree of trust from client software to be allowed."
                            },
                            "improvementPlan": {
                                "displayText": "Document any proxies used by S3 clients that are part of your workload and within your organizations realm of control"
                            }
                        },
                        {
                            "id": "SEC_03_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "(SEC_03_1 || SEC_03_2) && SEC_03_3 && SEC_03_4 && SEC_03_5 && SEC_03_6",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!SEC_03_6) || (!SEC_03_3)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_04",
                    "title": "How do you define encryption at-rest requirements and validate these requirements are met?",
                    "description": "You should consider what your encryption at-rest requirements are and enforce these requirements. S3 offers transparent data encryption, and since January 5th, 2023,S3 applies encryption by default to all new objects. If you have more stringent compliance requirements, use the practices below to identify and enforce them.",
                    "choices": [
                        {
                            "id": "SEC_04_1",
                            "title": "Requirements are provided by a compliance standard.",
                            "helpfulResource": {
                                "displayText": "If your organization or workload is subject to a particular compliance program, this will inform your encryption requirements.",
                                "url": "https://aws.amazon.com/compliance/programs/"
                            },
                            "improvementPlan": {
                                "displayText": "Understand and document, any compliance programs that apply to your workload",
                                "url": "https://docs.aws.amazon.com/prescriptive-guidance/latest/strategy-data-at-rest-encryption/policy.html"
                            }
                        },
                        {
                            "id": "SEC_04_2",
                            "title": "Requirements are based on company wide policy.",
                            "helpfulResource": {
                                "displayText": "An encryption policy establishes, at a senior management level, the business and compliance expectations that the organization needs to meet.",
                                "url": "https://docs.aws.amazon.com/prescriptive-guidance/latest/strategy-data-at-rest-encryption/policy.html"
                            },
                            "improvementPlan": {
                                "displayText": "Understand and document, at a senior management level, the business and compliance expectations that the organization needs to meet",
                                "url": "https://docs.aws.amazon.com/prescriptive-guidance/latest/strategy-data-at-rest-encryption/policy.html"
                            }
                        },
                        {
                            "id": "SEC_04_3",
                            "title": "Including a KMS key restriction in bucket policies",
                            "helpfulResource": {
                                "displayText": "If your requirements state that you should use a specific KMS key or type of KMS key, you can utilize a statement in bucket policies to require a specific KMS key be used when writing new objects to your bucket. You can also declare statements that require some variation of this, such as a KMS from a specific account, or a subset of KMS keys, or simply any KMS key.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-encryption"
                            },
                            "improvementPlan": {
                                "displayText": "Require every object that is written to the bucket to be encrypted using KMS Keys",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-encryption"
                            }
                        },
                        {
                            "id": "SEC_04_4",
                            "title": "Including a customer provided key restriction in bucket policies",
                            "helpfulResource": {
                                "displayText": "If your requirements state that you should use a customer provided key, you can utilize a statement in bucket policies to require a customer provided key be used when writing new objects to your bucket",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html#ssec-require-condition-key"
                            },
                            "improvementPlan": {
                                "displayText": "Require every object that is written to the bucket to be encrypted using customer provided Keys",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html#ssec-require-condition-key"
                            }
                        },
                        {
                            "id": "SEC_04_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "(SEC_04_1 || SEC_04_2) && (SEC_04_3 || SEC_04_4)",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_05",
                    "title": "How do you implement least privilege access to your data?",
                    "description": "When granting permissions, you decide who is getting what permissions to which Amazon S3 resources. You enable specific actions that you want to allow on those resources. Therefore you should grant only the permissions that are required to perform a task. Implementing least privilege access is fundamental in reducing security risk and the impact that could result from errors or malicious intent.",
                    "choices": [
                        {
                            "id": "SEC_05_1",
                            "title": "Using IAM users or roles from federated or other single-sign for users who require Amazon S3 access",
                            "helpfulResource": {
                                "displayText": "Providing access to externally authenticated users (identity federation)",
                                "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use IAM users or roles from federated or other single-sign for users who require Amazon S3 access",
                                "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html"
                            }
                        },
                        {
                            "id": "SEC_05_2",
                            "title": "Using IAM roles for applications and AWS services that require Amazon S3 access",
                            "helpfulResource": {
                                "displayText": "Using an IAM role to grant permissions to applications running on Amazon EC2 instances",
                                "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use an IAM role to grant permissions to applications running on Amazon EC2 instances",
                                "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html"
                            }
                        },
                        {
                            "id": "SEC_05_3",
                            "title": "Including guardrails in Service Control Policies",
                            "helpfulResource": {
                                "displayText": "Deny statements in Service Control Policies can be used to prohibit access patterns that are generally unnecessary. While it would be inadvisable to try and document all access in this way (generally policies attached to IAM users/roles should limit users to least privilege access), Service Control Policies can provide a second line of defense that is easier to reason about for the most important guardrails.",
                                "url": "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html"
                            },
                            "improvementPlan": {
                                "displayText": "Evaluate where Deny statements in S3 bucket policies can implement control objectives",
                                "url": "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html"
                            }
                        },
                        {
                            "id": "SEC_05_4",
                            "title": "Including guardrails in S3 bucket policies",
                            "helpfulResource": {
                                "displayText": "Bucket policies are most commonly used for two purposes, for granting access cross-account(s), and for providing additional guardrails that fill areas too specific for Service Control Policies, or not supported by Service Control Policies.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html"
                            },
                            "improvementPlan": {
                                "displayText": "Evaluate where Deny statements in S3 bucket policies can implement control objectives",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html"
                            }
                        },
                        {
                            "id": "SEC_05_5",
                            "title": "Disable access control lists (ACLs)",
                            "helpfulResource": {
                                "displayText": "A majority of modern use cases in Amazon S3 no longer require the use of access control lists (ACLs), and we recommend that you disable ACLs except in unusual circumstances where you must control access for each object individually.\n\nDisabling ACLs simplifies permissions management and auditing. You can disable ACLs on both newly created and already existing buckets. In the case of an existing bucket that already has objects in it, after you disable ACLs, the object and bucket ACLs are no longer part of an access evaluation, and access is granted or denied on the basis of policies.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html#disable-acls"
                            },
                            "additionalResources":[
                                {
                                  "type": "HELPFUL_RESOURCE",
                                  "content": [
                                    {
                                      "displayText": "-",
                                      "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.htmll"
                            }
                                    ]
                                }
                            ],
                            "improvementPlan": {
                                "displayText": "Disable access control lists (ACLs)",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html#disable-acls"
                            }
                        },
                        {
                            "id": "SEC_05_6",
                            "title": "Using S3 Access Points to create custom scopes for groups of users or applications",
                            "helpfulResource": {
                                "displayText": "When you have different sets of users with different functional purposes to data, managing their access needs via a single bucket policy can require complex bucket policies. S3 Access Points are intended as a way to provide each use case a different endpoint to access the same bucket, simplifying the access policy by focusing it on a particular use case. This is both a solution to policy size limits, and a solution to making those policies easier to validate and manage.",
                                "url": "https://aws.amazon.com/s3/features/access-points/"
                            },
                            "improvementPlan": {
                                "displayText": "Use S3 Access Points to create custom scopes for groups of users or applications",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-access-points.html"
                            }
                        },
                        {
                            "id": "SEC_05_7",
                            "title": "Regularly review access granted for least privilege",
                            "helpfulResource": {
                                "displayText": "As users and use cases change, privileges users or applications had in the past might no longer be used. Performing regular reviews using data from IAM Access Advisor, application changelogs, Access Analyzer for S3, and new IAM and S3 features can highlight cases where unused privileges can be removed, or permission scopes can be made more specific, limiting the potential that these unneeded permissions will be misused in the future.",
                                "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use IAM Access Analyzer to regularly review access granted for least privilege",
                                "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data.html"
                            }
                        },
                        {
                            "id": "SEC_05_8",
                            "title": "Permission Boundaries for IAM Entities",
                            "helpfulResource": {
                                "displayText": "Permission Boundaries are an additional guardrail that can be used to ensure that when new roles are created to grant access to users or application components, those permissions are restricted according to the permission boundaries. This allows developers to define roles, granting permissions for application components, and for IAM administrators to define a limit on the scope for those roles.",
                                "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use IAM permission boundaries to define the maximum permissions that can be given to roles created by developers or teams you grant role creation permissions",
                                "url": "https://aws.amazon.com/blogs/security/when-and-where-to-use-iam-permissions-boundaries/"
                            }
                        },
                        {
                            "id": "SEC_05_9",
                            "title": "Using Amazon S3 Access Grants to grant granualr data access permissions at scale based on a user's identity",
                            "helpfulResource": {
                                "displayText": "Amazon S3 Access Grants provides a scalable access control solution for S3 data. With S3 Access Grants, you can map identities like users, groups, or roles directly to data in S3 buckets and objects.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-get-started.html"
                            },
                            "improvementPlan": {
                            "displayText": "Use Amazon S3 Access Grants if Large numbers of datasets in Amazon S3 and/or grantees that IAM or S3 bucket policy character limits become a concern, a need to simplify access by assigning grants directly to directory groups, eliminating the need for intermediate IAM roles for users, and access to Amazon S3 is crucial for users belonging to multiple groups, as they require access to a union of datasets.",
                            "url": "https://aws.amazon.com/blogs/storage/scaling-data-access-with-amazon-s3-access-grants/"
                            }
                        },
                        {
                            "id": "SEC_05_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_05_1 && SEC_05_2 && SEC_05_3 && SEC_05_4 && SEC_05_5 && SEC_05_6 && SEC_05_7 && SEC_05_8 && SEC_05_9",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!SEC_05_1) || (!SEC_05_2) || (!SEC_05_3) || (!SEC_05_4) || (!SEC_05_5) || (!SEC_05_7)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_06",
                    "title": "How do you define your needs for a data perimeter?",
                    "description": "A data perimeter is a set of preventive guardrails that help ensure that only your trusted identities are accessing trusted resources from expected networks. Data perimeters on AWS span many different features and capabilities. Based on your security requirements, you should decide which capabilities are appropriate for your organization.",
                    "choices": [
                        {
                            "id": "SEC_06_1",
                            "title": "Identify resources and environments where a data perimeter should not apply.",
                            "helpfulResource": {
                                "displayText": "Data perimeters are appropriate for most users, resources and environments, but they do add some level of friction and require some level of maintenance. It is best to be explicit about exceptions, and plan these in advance. Exceptions are expected as organizations do experiment, share data with other organizations, and have needs to access public data sources. Managing these exceptions in a scalable fashion will allow your data perimeter to achieve its purpose of increasing security, without imposing unnecessary costs on the organization."
                            },
                            "improvementPlan": {
                                "displayText": "Document exceptions to data perimeter usage, and include exceptions in service control policies, bucket policies and VPC endpoint policies",
                                "url": "https://docs.aws.amazon.com/whitepapers/latest/building-a-data-perimeter-on-aws/perimeter-implementation.html#additional-considerations"
                            }
                        },
                        {
                            "id": "SEC_06_2",
                            "title": "Apply identity controls to your resources",
                            "helpfulResource": {
                                "displayText": "Bucket policies can be used to apply a coarse-grained identity controls to resources that should be subject to your data perimeter. As demonstrated in the Data Perimeter Workshop, aws:PrincipalAccount or aws:PrincipalOrgId conditions can be utilized to restrict identities."
                            },
                            "improvementPlan": {
                                "displayText": "Use bucket policies to apply identity controls to your resources",
                                "url": "https://catalog.us-east-1.prod.workshops.aws/workshops/a11f0f32-cc23-4c95-b243-43c53bdc7177/en-US/core-labs/identity-perimeter-resources"
                            }
                        },
                        {
                            "id": "SEC_06_3",
                            "title": "Apply network controls to your resources",
                            "helpfulResource": {
                                "displayText": "Bucket policies can be used to apply a coarse-grained network controls to resources that should be subject to your data perimeter. VPCs can be targeted by VPC Endpoints, and on-premise networks via Source Ip restrictions."
                            },
                            "improvementPlan": {
                                "displayText": "Use bucket policies to apply network controls to your resources",
                                "url": "https://catalog.us-east-1.prod.workshops.aws/workshops/a11f0f32-cc23-4c95-b243-43c53bdc7177/en-US/core-labs/network-perimeter-resources"
                            }
                        },
                        {
                            "id": "SEC_06_4",
                            "title": "Apply identity controls to your networks",
                            "helpfulResource": {
                                "displayText": "VPC endpoint policies can be used to apply a coarse-grained identity controls to networks that should be subject to your data perimeter. By restricting a VPC Endpoint to only support identities you control or trust, it prevents identies you have not provisioned from being used through the VPC endpoint."
                            },
                            "improvementPlan": {
                                "displayText": "Use VPC endpoint policies to apply identity controls to your network",
                                "url": "https://catalog.us-east-1.prod.workshops.aws/workshops/a11f0f32-cc23-4c95-b243-43c53bdc7177/en-US/core-labs/identity-perimeter-network"
                            }
                        },
                        {
                            "id": "SEC_06_5",
                            "title": "Apply resource controls to your networks",
                            "helpfulResource": {
                                "displayText": "VPC endpoint policies can be used to apply a coarse-grained resource controls to your identities that should be subject to your data perimeter.",
                                "url": "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use VPC endpoint policies to apply resource controls to your networks",
                                "url": "https://catalog.us-east-1.prod.workshops.aws/workshops/a11f0f32-cc23-4c95-b243-43c53bdc7177/en-US/core-labs/resource-perimeter-network"
                            }
                        },
                        {
                            "id": "SEC_06_6",
                            "title": "Apply resource controls to your identities",
                            "helpfulResource": {
                                "displayText": "Service control policies (SCP) can be used to apply a coarse-grained resource controls to your identities that should be subject to your data perimeter.",
                                "url": "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use service control policies to apply resource controls to your identities",
                                "url": "https://catalog.us-east-1.prod.workshops.aws/workshops/a11f0f32-cc23-4c95-b243-43c53bdc7177/en-US/core-labs/resource-perimeter-principals"
                            }
                        },
                        {
                            "id": "SEC_06_7",
                            "title": "Apply network controls to your identities",
                            "helpfulResource": {
                                "displayText": "Service control policies (SCP) can be used to apply a coarse-grained network controls to your identities that should be subject to your data perimeter.",
                                "url": "https://docs.aws.amazon.com/whitepapers/latest/building-a-data-perimeter-on-aws/perimeter-implementation.html#only-expected-networks"
                            },
                            "improvementPlan": {
                                "displayText": "Use service control policies to apply network controls to your identities",
                                "url": "https://github.com/aws-samples/data-perimeter-policy-examples/blob/main/service_control_policies/network_perimeter_policy.json"
                            }
                        },
                        {
                            "id": "SEC_06_8",
                            "title": "Use S3 access points to move fine-grained access controls out of bucket policies",
                            "helpfulResource": {
                                "displayText": "S3 Access Points allow you to provide access point policies that work in conjunction with the bucket policy that is attached to the underlying bucket. Using S3 Access Points can help avoid reaching bucket policy limits that you might encounter when trying to maintain complex data perimeters. This also has the advantage of allowing the bucket policy to manage the highest level guardrails, and the access points to scope this access down to individual use cases.",
                                "url": "https://aws.amazon.com/blogs/aws/easily-manage-shared-data-sets-with-amazon-s3-access-points/"
                            },
                            "improvementPlan": {
                                "displayText": "Managing data sharing access with Amazon S3 Access Points",
                                "url": "https://aws.amazon.com/blogs/aws/easily-manage-shared-data-sets-with-amazon-s3-access-points/"
                            }
                        },
                        {
                            "id": "SEC_06_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_06_1 && SEC_06_2 && SEC_06_3 && SEC_06_4 && SEC_06_5 && SEC_06_6 && SEC_06_7 && SEC_06_8",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!SEC_06_1) || (!SEC_06_2) || (!SEC_06_4)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_07",
                    "title": "How do you audit access to your data?",
                    "description": "Since all S3 bucket data by default is private, sharing S3 data publicly should be done with caution.",
                    "choices": [
                        {
                            "id": "SEC_07_1",
                            "title": "Enabled Amazon S3 protection in Amazon GuardDuty to identify potential security risks for data within your S3 buckets.",
                            "helpfulResource": {
                                "displayText": "GuardDuty monitors threats against your S3 resources by analyzing CloudTrail management events and CloudTrail S3 data events. These data sources monitor different kinds of activity, for example, data events for S3 include object-level API operations, such as GetObject, ListObjects, and PutObject.",
                                "url": "https://docs.aws.amazon.com/guardduty/latest/ug/s3-protection.html"
                            },
                            "improvementPlan": {
                                "displayText": "Enable Amazon S3 protection in Amazon GuardDuty to identify potential security risks for data within your S3 buckets",
                                "url": "https://docs.aws.amazon.com/guardduty/latest/ug/s3-protection.html"
                            }
                        },
                        {
                            "id": "SEC_07_2",
                            "title": "Regularly review Access Analyzer for S3, for where access to your S3 resources extends outside your AWS account.",
                            "helpfulResource": {
                                "displayText": "Access Analyzer for Amazon S3 provides findings for cases where buckets are configured to allow access to anyone on the internet, or to other AWS accounts, including accounts outside of your organization. For each public or shared bucket, you'll receive findings showing the source, and level of access.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-analyzer.html"
                            },
                            "improvementPlan": {
                                "displayText": "Review bucket access using IAM Access Analyzer for S3",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-analyzer.html"
                            }
                        },
                        {
                            "id": "SEC_07_3",
                            "title": "Review AWS CloudTrail S3 data events",
                            "helpfulResource": {
                                "displayText": "If configured AWS CloudTrail S3 data events provide detailed records for request that are made to a bucket. Third party solutions, and custom solutions can analyze these logs looking for expected and unexpected patterns of access.\n\nIn addition, when findings are identified by any tools, you can utilize CloudTrail S3 data events to identify individual or groups of requests and gather more context in order to respond to the finding.\n\nAWS CloudTrail is the preferred way of identifying valid Amazon S3 requests, as these contain more details around the context of an event.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use CloudTrail data events to identify S3 requests",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-request-identification.html"
                            }
                        },
                        {
                            "id": "SEC_07_4",
                            "title": "Review S3 Server Access Logs",
                            "helpfulResource": {
                                "displayText": "S3 Server Access Logs provide detailed records for the requests that are made to a bucket. Third party solutions, and custom solutions can analyze these logs looking for expected and unexpected patterns of access.\n\nIn addition, when findings are identified by any tools, you can utilize S3 Server Access Logs to identify individual or groups of requests and gather more context in order to respond to the finding.\n\nS3 Server Access Logs are useful if you need information about authentication failures, lifecycle events, individual objects affected by batch delete events, object size, HTTP Referrer, or total request timing.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-s3-access-logs-to-identify-requests.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use Amazon S3 access logs to identify S3 requests",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-s3-access-logs-to-identify-requests.html"
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "Using S3 Server Access Logs to identify authentication failures, lifecycle events, individual objects affected by batch delete events, object size, HTTP Referrer, or total request timing",
                                            "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "SEC_07_no",
                            "title": "None of these"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_07_1 && SEC_07_2 && (SEC_07_3 || SEC_07_4)",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!SEC_07_2)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_08",
                    "title": "How do you manage notifications for actionable security findings?",
                    "description": "Use managed AWS services to receive actionable findings in your AWS accounts. They can be enabled and integrated across multiple accounts. After you receive your findings, take action according to your incident response policy. For each finding, determine what your required response actions will be.",
                    "choices": [
                        {
                            "id": "SEC_08_1",
                            "title": "Use AWS Security Hub to aggregate visibility into your security and compliance status across multiple AWS accounts",
                            "helpfulResource": {
                                "displayText": "With Security Hub, you can perform security best practice checks, aggregate alerts, and automate remediation. You can create custom actions, which allow a customer to manually invoke a specific response or remediation action on a specific finding. You can then send custom actions to Amazon CloudWatch Events as a specific event pattern, allowing you to create a CloudWatch Events rule that listens for these actions and sends them to a target service, such as a Lambda function or Amazon SQS queue. You can then export findings to an Amazon S3 bucket, and share them in a standardized format for multiple use cases across AWS services.",
                                "url": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use AWS Security Hub to aggregate visibility into your security and compliance status across multiple AWS accounts",
                                "url": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html"
                            }
                        },
                        {
                            "id": "SEC_08_no",
                            "title": "No specific implementation"
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_08_1",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!SEC_08_1)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_09",
                    "title": "How do you manage the use of cross-account access to your data on S3?",
                    "description": "When you need to share data between your accounts, with SaaS partners hosted on AWS, or with your own customers who are also AWS customers, how do you manage that access? Because this type of access is extending outside of the initial trust boundary of your AWS account, special care should be taken to fully review this type of access.",
                    "helpfulResource": {
                        "displayText": "Access to a bucket, or part of a bucket, can be granted to principals in other AWS accounts via resource policies, cross-account roles, or access control lists. Choosing the best option will improve your ability to manage access permissions toward least privilege.\n\nKeep in mind, when granting access in this way, that even if you name a principal in another account, rather than the account itself, if you do not have control that account, you do not have control how that principal is used. If you are delegating within a set of accounts you directly manage, you can treat this similar to access from within your account, but if you are delegating to accounts you do not directly manage, it is best to assume you are giving trust to the owner of that account overall, for whatever permissions you do grant.\n\nResource based policies, such as bucket policies, are best suited single purpose usage, where you want a partner to have access to a set of data, or is responsible for submitting a set of data. Allowing multiple external accounts to read the same data is not uncommon, but allowing multiple external accounts to write to the same locations should be avoided.\n\nIf the workload does not need cross-account access you can skip this section. Select \"Question does not apply to this workload\", and \"Out of Scope\"."
                    },
                    "choices": [                      
                        {
                            "id": "SEC_09_1",
                            "title": "Using S3 Access Points access point policies",
                            "helpfulResource": {
                                "displayText": "Access Points allow you to target a particular use case with each access point, with the result that bucket policies are much simplified, and the single purpose of access point policies makes them more easily validated. In most cases where you need cross-account sharing, you should consider using an S3 Access Point with an access point policy.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use S3 Access Points access point policies",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html"
                            }
                        },
                        {
                            "id": "SEC_09_2",
                            "title": "Direct grants from S3 bucket policies are used only where necessary",
                            "helpfulResource": {
                                "displayText": "If you need to grant access for multiple use case, directly granting access from a bucket policy can lead to complicated bucket policies that are hard to maintain. For that reason, it's suggested you consider using access-points when possible.\n\nWhen using access points, you will use bucket policies as well, either to delegate control to the access point, constrain the access point, or both. In addition, in scenarios where access points are not supported, directly granting from a bucket policy would be the first fallback.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use direct grant cross-account access from S3 bucket policies only where necessary",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html"
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "Delegating access control to access points from a bucket policy",
                                            "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points-policies.html#access-points-cross-account"
                                        },
                                        {
                                            "displayText": "Access points restrictions and limitations",
                                            "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points-restrictions-limitations.html"
                                        }                                        
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "SEC_09_3",
                            "title": "Cross-account roles are used only where necessary or providing extra value",
                            "helpfulResource": {
                                "displayText": "Managing cross-account-roles are more complex than managing resource based policies for cross-account sharing. If either would meet a use case's requirements, resource based sharing should be the default choice. Use cross-account roles where required by integrations, or where they allow for deeper integration that provides value."
                            },
                            "improvementPlan":{
                                "displayText": "Use Cross-account roles only where necessary or providing extra value",
                                "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html"
                            }
                        },
                        {
                            "id": "SEC_09_4",
                            "title": "Direct grants from Access Control Lists are used only where necessary",
                            "helpfulResource": {
                                "displayText": "Access Control Lists are a fine-grained type of permission, and as such are difficult and complex to manage across a large number of objects. In most use cases, other mechanisms such as access-points, bucket policies, attribute based access control"
                            },
                            "improvementPlan":{
                                "displayText": "Use Access Control Lists (ACLs) only where necessary",
                                "url": "https://repost.aws/knowledge-center/s3-object-acl-use-cases"
                                
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "How to scale your authorization needs by using attribute-based access control with S3",
                                            "url": "https://aws.amazon.com/blogs/security/how-to-scale-authorization-needs-using-attribute-based-access-control-with-s3/"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "SEC_09_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }                   
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_09_1 && SEC_09_2 && SEC_09_3 && SEC_09_4",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_10",
                    "title": "How do you manage the use of cross-account roles to grant cross-account access to your data on S3?",
                    "description": "Cross-account roles allow you to grant another account the ability to assume a specific role within your account, and perform operations using that role. This type of access is most common in the context integrating with SaaS partners. This requires you to manage the fine-grained permissions for this role, and may be incompatible with various integrations. This type of access control is best suited to complex integrations with trusted partners.",
                    "helpfulResource": {
                        "displayText": "If the workload does not use cross-account roles you can skip this section. Select \"Question does not apply to this workload\", and \"Out of Scope\"."
                    },
                    "choices": [
                        {
                            "id": "SEC_10_1",
                            "title": "Cross-account roles have standard permission boundaries applied",
                            "helpfulResource": {
                                "displayText": "When using cross-account roles, you should consider writing a permission boundary that defines the maximium permission you would grant to a cross-account role. This is useful in case you have many roles to manage, and want to reduce the risk of any errors when managing those individual roles. Each role should still be managed toward least privilege-access, but a standard permission boundary for cross-account roles, and/or groups of cross-account roles serves a defense in depth goal.\n\nIf the administrator of a particular integration is not part of the core security administration team, you may also delegate the ability to create roles, with the attached condition of using a one or more permission boundaries.\n\nIn addition, it is possible that a particular cross-account integration will have a need to manage its own roles. While outside the scope of this lens, that is another use case for permission boundaries, allowing an integration to apply least privilege to individual roles used for different tasks, while applying the permision boundary to the overall integration.",
                                "url": "https://aws.amazon.com/blogs/security/when-and-where-to-use-iam-permissions-boundaries/"
                            },
                            "improvementPlan":{
                                "displayText": "Create permission boundaries that are applied to all cross-account roles and/or groups of cross-account roles",
                                "url": "https://aws.amazon.com/blogs/security/when-and-where-to-use-iam-permissions-boundaries/"
                            }
                        },
                        {
                            "id": "SEC_10_2",
                            "title": "Cross-account role usage has additional monitoring compared to within-account role usage",
                            "helpfulResource": {
                                "displayText": "Cross-account role usage extends security into domains within your AWS Organization, or outside of your AWS Organization. The visibility of those domains is less than within the domain of a single AWS account. To compensate for that lower visibility, monitoring for anomolous behaviors of how cross-account roles are assumed, and what actions they are used for is more important, than other roles.",
                                "url": "https://aws.amazon.com/blogs/security/how-to-audit-cross-account-roles-using-aws-cloudtrail-and-amazon-cloudwatch-events/"
                            },
                            "improvementPlan": {
                                "displayText": "Audit usage of cross-account roles",
                                "url": "https://aws.amazon.com/blogs/security/how-to-audit-cross-account-roles-using-aws-cloudtrail-and-amazon-cloudwatch-events/"
                            }
                        },
                        {
                            "id": "SEC_10_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_10_1 && SEC_10_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_11",
                    "title": "How do you prevent malicious content injection and repair injected content in buckets.",
                    "description": "Oftentimes, the ingested data is coming from third party sources, which opens the door to potentially malicious files objects that may be infected with malware, viruses, ransomware, trojan horses, and more.",
                    "choices": [
                        {
                            "id": "SEC_11_1",
                            "title": "Using AWS partner with the Security Software Competency",
                            "helpfulResource": {
                                "displayText": "Organizations should directly scan all objects in their buckets",
                                "url": "https://aws.amazon.com/blogs/apn/integrating-amazon-s3-malware-scanning-into-your-application-workflow-with-cloud-storage-security/"
                            },
                            "improvementPlan": {
                                "displayText": "Using available AWS partner to scan data stored in your buckets",
                                "url": "https://aws.amazon.com/blogs/apn/integrating-amazon-s3-malware-scanning-into-your-application-workflow-with-cloud-storage-security/"
                            }
                        },
                        {
                            "id": "SEC_11_no",
                            "title": "No specific implementation",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_11_1",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SEC_12",
                    "title": "How do you provide access to external (non-AWS) users?",
                    "description": "If you have a need to share data, or receive data from users who do not have an AWS account, or where your relationship with those users is not described by an AWS account, what strategy do you use to control that access?\n\nIn these cases, you will usually have another method of identifying your users, either by authenticating them with a service like AWS Cognito, or any of many third party authentication mechanisms, or by delivering asynchronous messages via a secure delivery channel (where secure is defined based on your requirements)",
                    "helpfulResource": {
                        "displayText": "If the workload does not need to grant external access you can skip this section. Select \"Question does not apply to this workload\", and \"Out of Scope\"."
                    },
                    "choices": [                        
                        {
                            "id": "SEC_12_1",
                            "title": "The content is delivered through a front-end API, requiring authentication",
                            "helpfulResource": {
                                "displayText": "If your application needs to deliver data from an Amazon S3 bucket, or add data to an Amazon S3 bucket, and you need to authenticate users first, you can make those calls on behalf of your users. The advantage of this methodology is that it looks like any normal API to users, and there is no need for callbacks or timeouts. The disadvantage is that it requires retransmitting the actual content twice, once from S3 to your front-end, and again from your front-end to your end-user. With small files, this is probably a small concern. With larger files however, this adds a lot of unnecessary overhead."
                            },
                            "improvementPlan": {
                                "displayText": "You can reference to our serverless web application example to see how Cognito can help to authenticate the access.",
                                "url": "https://aws.amazon.com/getting-started/hands-on/build-serverless-web-app-lambda-apigateway-s3-dynamodb-cognito/module-2/"
                            }
                        },
                        {
                            "id": "SEC_12_2",
                            "title": "We use pre-signed URLs for temporary read-only access",
                            "helpfulResource": {
                                "displayText": "To avoid transmitting content twice, pre-signed URLs can be utilized to provide end-users a URL that can access an object directly. Users still call your front-end API, and authenticate with that front-end API, but instead of returning the content directly, the front-end generates a pre-signed URL. This pre-signed URL will expire after a set period, which depending on the method you generate it, can be a maximum of 7 days. This pre-signed URL allows the user to download the object.\n\nWhile the URL is short-term and access to only a single object, you should treat this similar to granting access credentials to that user. The URL should be exchanged only to the appropriate user, not posted in any public sources, and users should understand that they should not forward those URLs to other users or applications unless they intend to provide access."
                            },
                            "improvementPlan": {
                                "displayText": "A presigned URL can be entered in a browser or used by a program to download an object. The credentials used by the presigned URL are those of the AWS user who generated the URL.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html"
                            }
                        },
                        {
                            "id": "SEC_12_3",
                            "title": "The process involves authenticating users using an API or application generating pre-signed URLs for temporary upload access",
                            "helpfulResource": {
                                "displayText": "To avoid transmitting content twice, pre-signed URLs can be utilized to provide end-users a URL that can access upload an object directly. Users still call your front-end API, and authenticate with that front-end API, but instead of accepting the content directly, the front-end generates a pre-signed URL. This pre-signed URL will expire after a set period, which depending on the method you generate it, can be a maximum of 7 days. This pre-signed URL allows the user to upload an object."
                            },
                            "improvementPlan": {
                                "displayText": "While the URL is short-term and access to only a single object, you should treat this similar to granting access credentials to that user. The URL should be exchanged only to the appropriate user, not posted in any public sources, and users should understand that they should not forward those URLs to other users or applications unless they intend to provide access.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/PresignedUrlUploadObject.html"
                            }
                        },
                        {
                            "id": "SEC_12_4",
                            "title": "By generating pre-signed URLs, for temporary read-only access, and sending these via a pre-defined secure asynchronous delivery",
                            "helpfulResource": {
                                "displayText": "You can use presigned URLs to generate a URL that can be used to access your Amazon S3 buckets. When you create a presigned URL, you associate it with a specific action. You can share the URL, and anyone with access to it can perform the action embedded in the URL as if they were the original signing user. The URL will expire and no longer work when it reaches its expiration time.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html"
                            },
                            "improvementPlan": {
                                "displayText": "The capabilities of a presigned URL are limited by the permissions of the user who created it. In essence, presigned URLs are bearer tokens that grant access to those who possess them. As such, we recommend that you protect them appropriately.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html#PresignedUrlUploadObject-LimitCapabilities"
                            }
                        },
                        {
                            "id": "SEC_12_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SEC_12_1 && SEC_12_2 && SEC_12_3 && SEC_12_4",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                }
            ]
        },
        {
            "id": "reliability",
            "name": "Reliability",
            "questions": [
                {
                    "id": "REL_1",
                    "title": "How do you protect your data against accidental or workload induced corruption or loss?",
                    "description": "Amazon S3 is designed to provide 11 9's durability. Durability ensures that the data you store to S3 is retained. To protect against a case in which the wrong data is stored, versioning and backups provide recovery mechanisms. These practices help protect against cases where the data is accidentally overwritten or deleted",
                    "choices": [
                        {
                            "id": "REL_1_1",
                            "title": "Maintain non-current versions to allow for recovery",
                            "helpfulResource": {
                                "displayText": "Enabling versioning on a S3 bucket stores prior versions of objects. When existing objects are overwritten or deleted, the existing version becomes a non-current version. Until that an explicit version deletion, or deletion by a lifecycle rule, these non-current versions remain, allowing recovery of accidental actions.\n\nThe duration that non-current versions are retained for can be managed via lifecycle rules. Ensure lifecycle rules allow sufficient time to discover and remediate accidental events. For more detail about non-current expiration, see How do you manage expirations for versioned data?",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html"
                            },
                            "improvementPlan": {
                                "displayText": "Enable versioning on S3 buckets to keep multiple versions of your objects",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html"
                            }
                        },
                        {
                            "id": "REL_1_2",
                            "title": "Replicate data to another bucket to allow for recovery",
                            "helpfulResource": {
                                "displayText": "S3 Replication or AWS Backup for Amazon S3 can be used to create additional copies of data. Those additional copies can be used for multiple purposes, but one is for recovery. In the case of AWS Backup for Amazon S3, it can be used to recover a full bucket.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use S3 Replication to replicate data to another bucket for recovery",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html"
                            }
                        },
                        {
                            "id": "REL_1_3",
                            "title": "Create backups in AWS Backup for Amazon S3, and use point-in-time backup and vault lock",
                            "helpfulResource": {
                                "displayText": "AWS Backup can create continuous or periodic backups of an S3 bucket. Backups allow restoration to a specific point in time of all objects in a bucket, which might be challenging using S3 versioning alone.\n\nAWS Backup also supports Vaults, which can provide increased security isolation.",
                                "url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use AWS Backup for Amazon S3 to create backups supporting point-in-time restore and isolation via vaults",
                                "url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html"
                            }
                        },
                        {
                            "id": "REL_1_4",
                            "title": "Use Amazon S3 Object Lock",
                            "helpfulResource": {
                                "displayText": "Amazon S3 Object Lock can be used as additional layer of protection against accidental deletions. In governance mode additional steps and special permissions are needed to delete object versions. In compliance mode, a protected object version can not be overwritten or deleted by any user, including the root user in your AWS account until it's retention period has expired.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use S3 Object Lock to enforce write-once-read-many (WORM) on objects",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html"
                            }
                        },
                        {
                            "id": "REL_1_5",
                            "title": "Use least privilege best practices to reduce possible scope of unintended actions",
                            "helpfulResource": {
                                "displayText": "Least privilege best practices (covered in detail in the security pillar), provide many benefits. One benefit is in reducing the scope for accidental or unintended actions. While this cannot prevent all possible actions, as necessary privileges can still be misused, it is a powerful defense in depth tool. It also has the benefit that accidental or unintended actions blocked in this way do not require recovery actions, as the action was blocked."
                            },
                            "improvementPlan": {
                                "displayText": "Implementing least privilege access to grant only the permissions that are required to perform a task",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html"
                            }
                        },
                        {
                            "id": "REL_1_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "REL_1_1 && REL_1_2 && REL_1_3 && REL_1_4 && REL_1_5",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!REL_1_5)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "REL_2",
                    "title": "How do you design your workload to withstand component failures?",
                    "description": "As a distributed system, Amazon S3 is expected to return a low-level of errors that can be successfully retried.",
                    "choices": [
                        {
                            "id": "REL_2_1",
                            "title": "Retry 5XX errors",
                            "helpfulResource": {
                                "displayText": "As a distributed system, Amazon S3 is expected to return a low-level of errors that can be successfully retried. Designing your workload to retry these errors will improve the reliability of your workload.\n\nAll AWS SDKs have a built-in retry mechanism with an algorithm that uses exponential backoff. This algorithm implements increasingly longer wait times between retries for consecutive error responses. Most exponential backoff algorithms use jitter (randomized delay) to prevent successive collisions.",
                                "url": "https://docs.aws.amazon.com/sdkref/latest/guide/feature-retry-behavior.html"
                            },
                            "improvementPlan": {
                                "displayText": "Configure SDKs to utilize retries and validate.",
                                "url": "https://docs.aws.amazon.com/sdkref/latest/guide/feature-retry-behavior.html"
                            },
                            "additionalResources": [
                                {
                                    "type": "IMPROVEMENT_PLAN",
                                    "content": [
                                        {
                                            "displayText": "Implement (or enable) exponential back-off and retry in all non-SDK code and third party tools.",
                                            "url": "https://aws.amazon.com/builders-library/timeouts-retries-and-backoff-with-jitter/"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "REL_2_no",
                            "title": "No specific implementation",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "REL_2_1",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "HIGH_RISK"
                        }
                    ]
                },
                {
                    "id": "REL_3",
                    "title": "How do you use fault isolation to protect your workload?",
                    "description": "Amazon S3 is designed to be highly availabile (see 'How reliable is Amazon S3' from https://aws.amazon.com/s3/faqs/ for more detail). Some workloads may require the ability to operate out of more than one region, to support failovers of the workload between regions.",
                    "choices": [
                        {
                            "id": "REL_3_1",
                            "title": "Replicate data to a bucket in a secondary region",
                            "helpfulResource": {
                                "displayText": "Replicating data to a second region allows a workload to failover to the secondary region. Amazon S3 Cross Region Replication can be used to support this type of requirement.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html"
                            },
                            "improvementPlan": {
                                "displayText": "Using S3 Replication to replicate data to another bucket for recovery",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html"
                            }
                        },
                        {
                            "id": "REL_3_2",
                            "title": "Use Multi-Region Access Points",
                            "helpfulResource": {
                                "displayText": "Amazon S3 Multi-Region Access Points provide a global endpoint that applications can use to fulfill requests from S3 buckets located in multiple AWS Regions. Multi-Region Access Points manage replication for buckets in the multiple regions and provides failover controls for multiple regions.",
                                "url": "https://aws.amazon.com/s3/features/multi-region-access-points/"
                            },
                            "improvementPlan": {
                                "displayText": "Using Multi-Region Access Points",
                                "url": "https://aws.amazon.com/s3/features/multi-region-access-points/"
                            }
                        },
                        {
                            "id": "REL_3_3",
                            "title": "Regional availability expectations meet workload availability expectations",
                            "helpfulResource": {
                                "displayText": "AWS regional availability rates are a good match for many workloads. Supporting failover to another region can create additional cost and complexity. If availability expectations can be met through the use of a single region, replication may still be appropriate, but for other reasons."
                            },
                            "improvementPlan": {
                                "displayText": "N/A"
                            }
                        },
                        {
                            "id": "REL_3_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "REL_3_1 || REL_3_2 || REL_3_3",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "HIGH_RISK"
                        }
                    ]
                },
                {
                    "id": "REL_4",
                    "title": "When replicating data to other buckets for recovery, how do you monitor performance to ensure recovery plans are actionable?",
                    "description": "Configuring replication is a first step to ensuring copies of data is available for the purpose of restoration when needed. It is also useful to monitor this replication process to ensure configuration errors or account limits do not cause replication delays or issues.",
                    "choices": [
                        {
                            "id": "REL_4_1",
                            "title": "Enable S3 Replication Time Control",
                            "helpfulResource": {
                                "displayText": "S3 Replication Time Control (S3 RTC) helps you meet compliance or business requirements for data replication and provides visibility into Amazon S3 replication times. S3 RTC replicates most objects that you upload to Amazon S3 in seconds, and 99.99 percent of those objects within 15 minutes, and enables additional metrics you can monitor.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-time-control.html"
                            },
                            "improvementPlan": {
                                "displayText": "Enable S3 Replication Time Control",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-time-control.html"
                            }
                        },
                        {
                            "id": "REL_4_2",
                            "title": "Monitor OperationFailedReplication metric",
                            "helpfulResource": {
                                "displayText": "You can use Amazon CloudWatch alarms with this metric to notify you when failures occur, so that you can quickly take corrective action. For example, S3 Replication relies on permissions that are granted by customers via AWS Identity and Access Management (IAM) roles. If an IAM role is set up incorrectly, customers may see objects that do not replicate as expected, due to insufficient permissions. S3 Replication will mark these objects as failed, and will now generate a metric and alarm so that you can quickly correct your IAM role and reinitiate replication for the objects to keep your source and destination buckets in sync.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-metrics.html"
                            },
                            "improvementPlan": {
                                "displayText": "Use Amazon CloudWatch metrics to monitor failed Replication",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-metrics.html"
                            }
                        },
                        {
                            "id": "REL_4_3",
                            "title": "Monitor OperationsPendingReplication metric",
                            "helpfulResource": {
                                "displayText": "You can use Amazon CloudWatch alarms with this metric to notify you when the number of pending operations is not meeting your requirements or is approaching that limit.\n\nThis metric tracks the number of operations that are pending replication for a given replication rule. This metric tracks operations related to objects, delete markers, tags, access control lists (ACLs), and S3 Object Lock."
                            },
                            "improvementPlan": {
                                "displayText": "Use Amazon CloudWatch metrics to monitor failure events",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-metrics.html"
                            }
                        },
                        {
                            "id": "REL_4_4",
                            "title": "Monitor ReplicationLatency metric",
                            "helpfulResource": {
                                "displayText": "Monitoring the maximum ReplicationLatency metric can inform you if your replication is not meeting your requirements or is approaching that limit.\n\nIf you see sustained increases in this metric, you should check if your application load has recently increased. If so, it may be necessary to request a service limit increase for the maximum Replication Time Control transfer rate that you can replicate from the source region. Other possible causes are increases in maximum object size."
                            },
                            "improvementPlan": {
                                "displayText": "Use Amazon CloudWatch metrics to monitor replication latency",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-metrics.html"
                            }
                        },
                        {
                            "id": "REL_4_5",
                            "title": "Monitor replication failure events with Amazon S3 Event Notifications",
                            "helpfulResource": {
                                "displayText": "S3 Event Notifications can notify you in instances when objects do not replicate to their destination AWS Region. Amazon S3 events are available through Amazon Simple Queue Service (Amazon SQS), Amazon Simple Notification Service (Amazon SNS), or AWS Lambda",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-metrics.html#replication-metrics-events"
                            },
                            "improvementPlan": {
                                "displayText": "Configure and process replication failure events with Amazon S3 Event Notifications",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-metrics.html#replication-metrics-events"
                            }
                        },
                        {
                            "id": "REL_4_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "REL_4_1 && REL_4_2 && REL_4_3 && REL_4_4 && REL_4_5",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!REL_4_2) || ((!REL_4_3) && (!REL_4_4))",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                }
            ]
        },
        {
            "id": "performance",
            "name": "Performance Efficiency",
            "questions": [
                {
                    "id": "PERF_1",
                    "title": "How do you evaluate alternative data formats?",
                    "description": "When designing workloads, the structure of the data contributes to its performance characteristics. Depending on which objectives are most valuable, different structures will serve those goals. Understanding those goals is a first step to making those decisions.",
                    "choices": [
                        {
                            "id": "PERF_1_1",
                            "title": "Data formats are chosen to minimize latency in writes",
                            "helpfulResource": {
                                "displayText": "Writing small objects frequently, whether small or large optimizes for uses cases where you want to minimize potential data loss, or have predictable latencies before data is consumed. A common example of this are log and trace files."
                            },
                            "improvementPlan": {
                                "displayText": "-"
                            }
                        },
                        {
                            "id": "PERF_1_2",
                            "title": "Data formats are chosen for efficient retrieval",
                            "helpfulResource": {
                                "displayText": "Writing objects with consistent sizes, of several megabytes or more, optimizes for efficient retrieval. You could also consider how data is grouped if objects represent rows or collections of items. Grouping commonly used data together in predictable patterns allows for efficient retrieval."
                            },
                            "improvementPlan": {
                                "displayText": "-"
                            }
                        },
                        {
                            "id": "PERF_1_3",
                            "title": "Data formats are chosen for long term cost efficiencies",
                            "helpfulResource": {
                                "displayText": "Smaller objects add additional costs from minimum storage sizes, monitoring fees and other overhead per object charges. Objects of several megabytes or more reduce the impacts of these overheads. Designing data structures to avoid many small objects optimizes for cost. That does not mean that larger is always better though. If in the future you read an object, and only need part of the data it contains, a larger object could lead to the entire object's storage costs increasing. That consideration does not apply however when the workload always needs the full content of a large object during each retrieval, so it is not necessary to break up large files if they fit the workload."
                            },
                            "improvementPlan": {
                                "displayText": "-"
                            }
                        },
                        {
                            "id": "PERF_1_no",
                            "title": "No, the structure of data is predetermined by the workload",
                            "helpfulResource": {
                                "displayText": "If a client consumes this data directly, it may already have assumptions about the structure of the data. While you can always consider an additional layer that transforms data, for many workloads the best choice is to store the data in the same form it is consumed, and this simplifies trade-offs regarding structure."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "PERF_1_1 || PERF_1_2 || PERF_1_3",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "PERF_2",
                    "title": "How do you handle the small percentage of 5xx errors expected during normal use of the service?",
                    "description": "A distributed storage service like S3 expects a very small percentage of retriable errors during the normal course of operations. A retry utilizes different resources on the new request, bypassing temporary inefficiencies.",
                    "choices": [
                        {
                            "id": "PERF_2_1",
                            "title": "Use a retry mechanism in the application making requests",
                            "helpfulResource": {
                                "displayText": "Requests that return 500 or 503 errors can be retried. It's a best practice to build retry logic into applications that make requests to Amazon S3.\n\nAll AWS SDKs have a built-in retry mechanism with an algorithm that uses exponential backoff. This algorithm implements increasingly longer wait times between retries for consecutive error responses. Most exponential backoff algorithms use jitter (randomized delay) to prevent successive collisions",
                                "url": "https://docs.aws.amazon.com/general/latest/gr/api-retries.html"
                            },
                            "improvementPlan": {
                                "displayText": "Configure SDKs to utilize retries and validate.",
                                "url": "https://docs.aws.amazon.com/sdkref/latest/guide/feature-retry-behavior.html"
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "Timeouts, retries, and backoff with jitter.",
                                            "url": "https://aws.amazon.com/builders-library/timeouts-retries-and-backoff-with-jitter/"
                                        }
                                    ]
                                },
                                {
                                    "type": "IMPROVEMENT_PLAN",
                                    "content": [
                                        {
                                            "displayText": "Implement (or enable) exponential back-off and retry in all non-SDK code and third party tools.",
                                            "url": "https://aws.amazon.com/builders-library/timeouts-retries-and-backoff-with-jitter/"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "PERF_2_2",
                            "title": "Perform aggressive timeouts with retries in latency sensitive environments",
                            "helpfulResource": {
                                "displayText": "Aggressive timeouts and retries help drive consistent latency. Given the large scale of Amazon S3, if the first request is slow, a retried request is likely to take a different path and quickly succeed. The AWS SDKs have configurable timeout and retry values that you can tune to the tolerances of your specific application.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/optimizing-performance-design-patterns.html#optimizing-performance-timeouts-retries"
                            },
                            "improvementPlan": {
                                "displayText": "Use Timeouts and Retries for Latency-Sensitive Applications",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/optimizing-performance-guidelines.html#optimizing-performance-guidelines-retry"
                            }
                        },
                        {
                            "id": "PERF_2_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "PERF_2_1 && PERF_2_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!PERF_2_1)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "PERF_3",
                    "title": "How do you handle content you need to distribute globally to larger numbers of users?",
                    "description": "Each S3 bucket is hosted from one of the 30+ AWS regions worldwide. When requests to retrieve data come from locations outside a single region, you can utilize one of the strategies below to improve performance for users across wider geographic areas.",
                    "choices": [
                        {
                            "id": "PERF_3_1",
                            "title": "Utilize a Content Delivery Network, such as Amazon CloudFront",
                            "helpfulResource": {
                                "displayText": "A Content Delivery Network provides two important performance benefits:\n- First, it can terminate HTTP requests at an edge location, ensuring that requests that have to travel a long distance, do not layer bandwidth and latency limitations from different parts of the request path on top of each other. When two such limitations interact, the impact on performance is greater than the sum if those limitations are split.\n- In addition, Content Delivery Networks can cache commonly used data, avoiding the high latency request entirely.\n\nBoth of these benefits are important, though in varying different degrees to different workloads.",
                                "url": "https://aws.amazon.com/cloudfront/"
                            },
                            "improvementPlan": {
                                "displayText": "Utilize a Content Delivery Network, such as Amazon CloudFront",
                                "url": "https://aws.amazon.com/blogs/networking-and-content-delivery/amazon-s3-amazon-cloudfront-a-match-made-in-the-cloud/"
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "Amazon S3 + Amazon CloudFront: A Match Made in the Cloud",
                                            "url": "https://aws.amazon.com/blogs/networking-and-content-delivery/amazon-s3-amazon-cloudfront-a-match-made-in-the-cloud/"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "PERF_3_2",
                            "title": "Use Multi-Region Access Points",
                            "helpfulResource": {
                                "displayText": "Multi-Region Access Points creates replicated copies of data in multiple regions, and exposes those individual buckets as a singular access point that automatically routes traffic to the most performant destination.",
                                "url": "https://aws.amazon.com/s3/features/multi-region-access-points/"
                            },
                            "improvementPlan": {
                                "displayText": "Configure Multi-Region Access Points",
                                "url": "https://aws.amazon.com/s3/features/multi-region-access-points/"
                            }
                        },
                        {
                            "id": "PERF_3_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "PERF_3_1 && PERF_3_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "PERF_4",
                    "title": "How do you manage large uploads from geographically dispersed locations with networks of variable quality?",
                    "description": "Each S3 bucket is hosted from one of the 30+ AWS regions worldwide. When requests to upload data come from locations outside a single region, you can utilize one of the strategies below to improve performance for users across wider geographic areas. If all uploads comes from within the region a bucket is hosted, these strategies are not necessary. ",
                    "choices": [
                        {
                            "id": "PERF_4_1",
                            "title": "Utilize Amazon CloudFront or another CDN that supports PUT request termination",
                            "helpfulResource": {
                                "displayText": "Terminating PUT requests at an Edge location usually improves performance by isolating the high bandwidth/high latency connection between an Edge location and a region from the unknown bandwidth/low latency connection between a user and Edge location. Mixing both high latency and low bandwidth on a single TCP connection has a much larger impact on performance than when the two are isolated.\n\nIf you have predictable user networks, you should test to ensure CloudFront improves performance. In cases where you do not control the networks your users originate from, and it is thus unpredictable, you should assume, that for the majority of these users, CloudFront will provide notable performance benefits. For the minority that do not see benefits, performance will be close to or the same as without CloudFront.\n\nCloudFront costs will usually be the same of less compared to using S3 directly."
                            },
                            "improvementPlan": {
                                "displayText": "Utilize Amazon CloudFront or another CDN that supports PUT request termination.",
                                "url": "https://aws.amazon.com/cloudfront/"
                            }
                        },
                        {
                            "id": "PERF_4_2",
                            "title": "S3 Transfer Acceleration Endpoints",
                            "helpfulResource": {
                                "displayText": "Transfer Acceleration optimizes the TCP protocol and adds additional intelligence between the client and the S3 bucket, which allows for higher performance in many scenarios. If objects are larger than 1GB, and the best performance is desired, evaluate S3 Transfer Acceleration. Note that S3 Transfer Acceleration adds additional cost, though this cost is only assessed when S3 Transfer Acceleration results in better performance."
                            },
                            "improvementPlan": {
                                "displayText": "Configure fast, secure file transfers using Amazon S3 Transfer Acceleration",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html"
                            }
                        },
                        {
                            "id": "PERF_4_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "PERF_4_1 && PERF_4_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "PERF_5",
                    "title": "How do you understand your workload's S3 request patterns?",
                    "description": "Data Lake workloads typically depend on many low latency parallel requests. To maximize the performance of these workloads, consistent low latency responses are important. By understanding your request patterns you can avoid throttles and intermittent delays and thereby maximize the performance of your workload. Archival workloads are typically not impacted by this guidance.",
                    "choices": [
                        {
                            "id": "PERF_5_1",
                            "title": "Use S3 Server Access Logging, and analyze results",
                            "helpfulResource": {
                                "displayText": "Turn on Amazon S3 server access logging. Because server access logging captures all requests, this data can be utilized to understand if access patterns create a risk of increased latency or throughput.\n\nTo look for these patterns, look for cases where:\na. Thousands of objects, either sequentially ordered, or densely packed within the sequential ordering (ordered by the prefix + key) of all objects are requested around the same time (within 1 second).\nb. The same event occurs many times, but not with the same set of objects. If the same pattern occurred with the same set of objects, S3 could optimize for this pattern. But if the same type of pattern recurs, but always or usually with a different small subset of objects, S3 will not automatically optimize for this pattern.\nc. An extreme, but easily recognizable version of this is where this reoccurs continuously with a sequential walk of objects, with each second involving thousands of sequentially ordered requests.\n\nIf you do identify such patterns, you can then look at options to ensure your workload's requests are fulfilled with the latency and throughput your workload requires."
                            },
                            "improvementPlan": {
                                "displayText": "Enable S3 Server Access Logging analysis",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html"
                            }
                        },
                        {
                            "id": "PERF_5_2",
                            "title": "Monitor 503 Errors metric in CloudWatch for signs of SlowDown responses",
                            "helpfulResource": {
                                "displayText": "Turn on Amazon CloudWatch metrics. Amazon S3 CloudWatch request metrics include a metric for 5xx status responses. While a very small percentage of 5xx errors is expected during normal use of the service, higher numbers of these, or significant bursts can indicate an addressable issue that will impact your workload's performance.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudwatch-monitoring.html"
                            },
                            "improvementPlan": {
                                "displayText": "Create a CloudWatch metrics configuration for all the objects in your bucket",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/configure-request-metrics-bucket.html"
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "Amazon CloudWatch request metrics",
                                            "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudwatch-monitoring.html#s3-request-cloudwatch-metrics"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "PERF_5_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "PERF_5_1 && PERF_5_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!PERF_5_2)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "PERF_6",
                    "title": "How do you optimize request patterns or object namespace to avoid hotspots?",
                    "description": "S3 automatically scales to high request rates. At yet higher request rates, S3 continues to scale, but some considerations regarding request patterns can help ensure that S3 is able to allocate resources where necessary.",
                    "choices": [
                        {
                            "id": "PERF_6_1",
                            "title": "My workload's request patterns do not exceed 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second",
                            "helpfulResource": {
                                "displayText": "Some data lake applications on Amazon S3 scan millions or billions of objects for queries that run over petabytes of data. But many workloads do not require that scale, and can avoid the extra analysis necessary to understand how a workload would perform at high request rates."
                            },
                            "improvementPlan": {
                                "displayText": "-"
                            }
                        },
                        {
                            "id": "PERF_6_2",
                            "title": "The workloads request patterns are random",
                            "helpfulResource": {
                                "displayText": "Some workloads have inherently random request patterns. For example, you might have many different users, who perform different operations different operations on smaller quantities of data per user. Because there is no inherent pattern between the users, and each users requests are too small to cause request rates to be exceeded, the workload is random to a low level.\n\nRandom is good in this case, as random request patterns are automatically optimized by S3, and you can expect S3 to consistently very high request rates.\n\nYou should not confuse unknown and random request patterns. If you do not understand your workloads request patterns, and have good reasons to describe them as random. If you are planning for request rates about those listed above, you should take time to understand your workloads request patterns."
                            },
                            "improvementPlan": {
                                "displayText": "-"
                            }
                        },
                        {
                            "id": "PERF_6_3",
                            "title": "The workloads request patterns have been intentionally designed to distribute across the object namespace",
                            "helpfulResource": {
                                "displayText": "For some workloads, it is possible to intentionally design how requests will be issued, in order to avoid hotspots.\n\nThe categorical example is, if you had to make a copy of your entire bucket, and had a list of every object in the bucket, instead of using the approach of starting with the first object alphabetically, and then in parallel starting requests for the 2nd, 3rd, etc. objects, instead start 10 parallel processes where the 1st starts at file 1, but the second starts at the 10%, the 3rd at 20%, etc.\n\nAnother pattern that would be even more effective for the above, is randomizing your object listing to be non-alphabetical. Usually either pattern will work, but the fully randomized pattern scales even more than the first.\n\nNot all workloads find it easy to plan how requests are made so deliberately though."
                            },
                            "improvementPlan": {
                                "displayText": "If request patterns are modifiable, avoid request patterns that do not distribute across the object namespace"
                            }
                        },
                        {
                            "id": "PERF_6_4",
                            "title": "The object namespace has been organized to distribute request patterns evenly",
                            "helpfulResource": {
                                "displayText": "If it is not possible to change request patterns, you may be able to change the way that requests are distributed by changing the names of your objects. Each object has a key. If you knew that your workload was going to make requests for a batch of 10,000 objects named like this:\n\nbucket-name/user1/0001.dat\nbucket-name/user1/0002.dat\n...\nbucket-name/user1/9999.dat\n\nand you knew this pattern would reoccur for each user (though at different times), for example: \n\nbucket-name/user100/0001.dat\nbucket-name/user100/0002.dat\n...\nbucket-name/user100/9999.dat\n\nThen in this case, you could avoid 503 throttling by adopting this change to the keys of your objects:\n\nbucket-name/10/user1/0001.dat\nbucket-name/20/user1/0002.dat\n...\nbucket-name/99/user100/9999.dat\n\nThe reason this would avoid 503 throttling is that the first character of the key is not contiguously the same for any long set of requests. As an example of how far this could scale, if your users had 500,000 objects, and your workload commonly made requests of this size (500,000 / second), S3 could scale to handle that request rate."
                            },
                            "improvementPlan": {
                                "displayText": "Modify your object namespace to distribute request patterns evenly"
                            }
                        },
                        {
                            "id": "PERF_6_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "PERF_6_1 || PERF_6_2 || PERF_6_3 || PERF_6_4",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "PERF_7",
                    "title": "How do you define your storage retrieval requirements?",
                    "description": "Workloads can store data in archival storage classes and tiers, such as Intelligent Tiering Archive Tier, Glacier Flexible Retrieval, Intelligent Tiering Deep Archive Tier, or Glacier Deep Archive. These tiers or storage classes require a restore request to retrieve data. Retrieval requirements are important to defining both what data can be stored in an archival tier, how to budget for retrievals and what archival tier or storage class will be best fit financially, once business requirements have been met. This commonly applies to archival and data lake workloads, but can apply to any type of workload.",
                    "choices": [
                        {
                            "id": "PERF_7_1",
                            "title": "Requirements are provided by a compliance standard",
                            "helpfulResource": {
                                "displayText": "If your organization or workload is subject to a particular compliance program, this will inform your storage retrieval requirements."
                            },
                            "improvementPlan": {
                                "displayText": "Understand and document, any compliance programs that apply to your workload"
                            }
                        },
                        {
                            "id": "PERF_7_2",
                            "title": "Requirements are based on company wide policy",
                            "helpfulResource": {
                                "displayText": "A storage retention policy establishes, at a senior management level, the business and compliance expectations that the organization needs to meet."
                            },
                            "improvementPlan": {
                                "displayText": "Understand and document, at a senior management level, the business and compliance expectations that the organization needs to meet"
                            }
                        },
                        {
                            "id": "PERF_7_3",
                            "title": "Requirements are informed by regular consultation with data owners",
                            "helpfulResource": {
                                "displayText": "Owners of data stored in S3 should understand the future needs for retrieval of data, and this will inform your storage retrieval requirements."
                            },
                            "improvementPlan": {
                                "displayText": "Regularly consult with data owners to share and validate storage archival rules"
                            }
                        },
                        {
                            "id": "PERF_7_4",
                            "title": "Requirements are based on historical access patterns",
                            "helpfulResource": {
                                "displayText": "If data has been acccess in the past, it is a good sign it will be needed in the future. Use this data to inform your storage retrieval requirements, and do not implement any storage archival rules that would be incompatible with your storage retrieval requirements."
                            },
                            "improvementPlan": {
                                "displayText": "Review historical access patterns before implementing changes to storage archival rules"
                            }
                        },
                        {
                            "id": "PERF_7_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "PERF_7_1 && PERF_7_2 && PERF_7_3 && PERF_7_4",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!PERF_7_1) || (!PERF_7_2) || (!PERF_7_3)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "PERF_8",
                    "title": "How do you manage the consolidation of small objects?",
                    "description": "S3 supports small and large objects. Smaller objects though can have cost and peorfrmance inefficiencies. Additional metadata and per object charges add costs. Many small requests add per call latency overhead and utilize additional system resources.",
                    "helpfulResource":  {
                        "displayText": "It is not uncommon to find workloads that may have adopted small files initially, where this is not required long term. Intentionally managing the size of objects can lead to optimal performance.\n\nThis commonly applies to archival and data lake workloads, but can apply to any type of workload. When we talk about small objects, there is not one particular size in mind, but generally the significance of differences declines as sizes grow, such that above a few MB, most of the gain has been realized, and that concerns are greatest below 250KB."
                    },
                    "choices": [
                        {
                            "id": "PERF_8_1",
                            "title": "My workload does not use small objects",
                            "helpfulResource": {
                                "displayText": "-"
                            },
                            "improvementPlan": {
                                "displayText": "-"
                            }
                        },
                        {
                            "id": "PERF_8_2",
                            "title": "My workload requires small objects but is not compatible with changing the format",
                            "helpfulResource": {
                                "displayText": "-"
                            },
                            "improvementPlan": {
                                "displayText": "-"
                            }
                        },
                        {
                            "id": "PERF_8_3",
                            "title": "Group small record oriented objects (for example log files), into larger objects",
                            "helpfulResource": {
                                "displayText": "Groups of small files can sometimes be directly joined into a larger file without losing information of context.\n\nIt is common to have small files generated where each file represents a period of time, 5 minutes for example. These files can sometimes be joined as simply as concatenating one to the other, or with some minimal change such as removing a title record. If there is no special context to the individual files that is not replicated within the individual records, these can be joined simply.\n\nAnother common pattern is where files are arriving from multiple sources, but do not need to remain separate. This might be more complex if there is a need to maintain an order that spans across these files, but since the original files presumably had this same order, rows can be interleaved from parallel sequential reads of all files being joined.\n\nSometimes the context of the individual files is relevant. This could be remedied, via an extra column that captures the source, assuming that the tools that need that data can accommodate that addition.\n\nThe advantage of these patterns over creating archives is these files could still be used without unarchiving. If a workload understands ranged GETs, this can allow for optimal storage costs while retrieving similar sized packets of data.\n\nThe primary disadvantage of combining files compared to leaving them as small files is that when used with Intelligent Tiering, the entire large file will move back the Frequent Access tier when accessed. For many workloads however, the advantage of fewer files is a better tradeoff."
                            },
                            "improvementPlan": {
                                "displayText": "Group small record oriented objects (for example log files), into larger objects"
                            }
                        },
                        {
                            "id": "PERF_8_4",
                            "title": "Apache Iceberg used to optimize object size",
                            "helpfulResource": {
                                "displayText": "With Apache Iceberg, it is possible to configure the file size for a table with write.target-file-size-bytes parameter, which is 512MB by default. This results in merging data until the target limit and writing out big files to Amazon S3. Iceberg also has maintenance tools to compact data files to decrease the number of files. Having a few big files instead of a lot of small files helps in two ways.",
                                "url": "https://iceberg.apache.org/docs/latest/maintenance/#compact-data-files"
                            },
                            "improvementPlan": {
                                "displayText": "Compact data files using Apache Iceberg",
                                "url": "https://iceberg.apache.org/docs/latest/maintenance/#compact-data-files"
                            }
                        },
                        {
                            "id": "PERF_8_5",
                            "title": "Create archives from groups of related objects",
                            "helpfulResource": {
                                "displayText": "Many archive formats can consolidate small files into larger archives. While this has the downside that accessing the data now requires retrieving the full file, and unarchiving it to local storage. Streaming archive formats is sometimes possible, but always higher complexity.\n\nBut in many cases, the only relevant format for a storing file is as it was originally created, and archives can maintain that internally while but reducing per object charges, and serving as an organizing element in the storage layout."
                            },
                            "improvementPlan": {
                                "displayText": "Create archives from groups of related objects"
                            }
                        },
                        {
                            "id": "PERF_8_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "PERF_8_1 || PERF_8_2 || (PERF_8_3 && PERF_8_5)",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "PERF_9",
                    "title": "How do you improve query performance to data storing in Amazon S3?",
                    "description": "You can query data without servers or databases using Amazon S3 Select and Amazon S3 Glacier Select.",
                    "choices": [
                        {
                            "id": "PERF_9_1",
                            "title": "Data is partitioned",
                            "helpfulResource": {
                                "displayText": "Partitioning divides your table into parts and keeps the related data together based on column values such as date, country, and region. Partitions act as virtual columns. You define them at table creation, and they can help reduce the amount of data scanned per query, thereby improving performance.",
                                "url": "http://docs.aws.amazon.com/athena/latest/ug/partitions.html"
                            },
                            "improvementPlan": {
                                "displayText": "Partition your data by HIVE-friendly path structure",
                                "url": "https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/"
                            }
                        },
                        {
                            "id": "PERF_9_2",
                            "title": "Data is bucketed within a single partition",
                            "helpfulResource": {
                                "displayText": "Another way to partition your data is to bucket the data within a single partition. With bucketing, you can specify one or more columns containing rows that you want to group together, and put those rows into multiple buckets. This allows you to query only the bucket that you need to read when the bucketed columns value is specified.",
                                "url": "https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/"
                            },
                            "improvementPlan": {
                                "displayText": "Bucket the data within a single partition",
                                "url": "https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/"
                            }
                        },
                        {
                            "id": "PERF_9_3",
                            "title": "Data is stored in compressed formats",
                            "helpfulResource": {
                                "displayText": "Compressing your data can speed up your queries significantly, as long as the files are either of an optimal size (see the next section), or the files are splittable. The smaller data sizes reduce the data scanned from Amazon S3, resulting in lower costs of running queries. It also reduces the network traffic from Amazon S3 to Athena.\n\nFor Athena, we recommend using either Apache Parquet or Apache ORC, which compress data by default and are splittable.",
                                "url": "https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/"
                            },
                            "improvementPlan": {
                                "displayText": "Compress data in a splittable format",
                                "url": "https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/"
                            }
                        },
                        {
                            "id": "PERF_9_4",
                            "title": "File sizes are optimized for queries",
                            "helpfulResource": {
                                "displayText": "Queries run more efficiently when data scanning can be parallelized and when blocks of data can be read sequentially. Ensuring that your file formats are splittable helps with parallelism regardless of how large your files may be.\n\nHowever, if your files are too small (generally less than 128 MB), the execution engine might be spending additional time with the overhead of opening S3 files, listing directories, getting object metadata, setting up data transfer, reading file headers, reading compression dictionaries, and so on. On the other hand, if your file is not splittable and the files are too large, the query processing waits until a single reader has completed reading the entire file. That can reduce parallelism.",
                                "url": "https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/"
                            },
                            "improvementPlan": {
                                "displayText": "Optimize files sizes for queries",
                                "url": "https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/"
                            }
                        },
                        {
                            "id": "PERF_9_5",
                            "title": "Using Amazon S3 Express One Zone storage class deliver up to 10x better performance than the S3 Standard storage class",
                            "helpfulResource": {
                                "displayText": "Amazon S3 Express handles hundreds of thousands of requests per second with consistent single-digit millisecond latency delivering a significant reduction in runtime for data-intensive applications, especially those that use hundreds or thousands of parallel compute nodes to process large amounts of data for AI/ML training, financial modeling, media processing, real-time ad placement, high performance computing, and so forth",
                                "url": "https://aws.amazon.com/s3/storage-classes/express-one-zone/"
                            },
                            "improvementPlan": {
                                "displayText": "Use Amazon S3 Express One Zone where very low latency is needed.",
                                "url": "https://aws.amazon.com/blogs/aws/new-amazon-s3-express-one-zone-high-performance-storage-class/"
                            }
                        },
                        {
                            "id": "PERF_9_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "PERF_9_1 && PERF_9_2 && PERF_9_3 && PERF_9_4 && PERF_9_5",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                }
            ]
        },
        {
            "id": "costOptimization",
            "name": "Cost Optimization",
            "questions": [
                {
                    "id": "COST_1",
                    "title": "How do you optimize your use of storage classes in Amazon S3?",
                    "description": "Choosing the right storage class will optimize your costs in S3. Having the right plan will balance your available time to perform analysis, and use reasonable defaults where analysis is can't be performed or an inefficient use of time.",
                    "choices": [
                        {
                            "id": "COST_1_1",
                            "title": "Establish one or more baseline bucket configurations to apply to buckets",
                            "helpfulResource": {
                                "displayText": "You will often find yourself creating buckets without understanding their access patterns. When buckets are small the costs associated with this are smaller, but you should still make a deliberate choice even using the limited information available at the time. It can be re-evaluated later, but an early attempt can be useful.\n\nFor new buckets, there are two primary configurations that are good initial options:\na. Use S3 Standard\nb. Use S3 Intelligent Tiering\n\nBoth of these have some similar advantages: low access costs, no minimum storage duration. As a general rule, if you have an expectation that your bucket will retain data for multiple months and not be composed entirely of small objects (<128KB), option (b) has better average cost efficiency. If you can quickly estimate these two characteristics you can choose a default plan for buckets and save your analysis time for buckets that you expect or already do house large amounts of data.\n\nAdditional baseline elements are lifecycle rules to cleanup multipart uploads"
                            },
                            "improvementPlan": {
                                "displayText": "Establish one or more baseline bucket configurations to apply to buckets"
                            }
                        },                        
                        {
                            "id": "COST_1_2",
                            "title": "Identify storage with long term retention that can accommodate retrieval delays and enable archival storage options",
                            "helpfulResource": {
                                "displayText": "Archival storage options, such as the Archive and Deep Archive tiers of S3 Intelligent Tiering, and the Glacier Flexible Retrieval and Glacier Deep Archive storage classes provide significant cost savings.\n\nOnce you have identified data that you:\na. Intend to retain for a long period\nb. Can wait hours for retrieval (see here for times)\nc. Can automate the retrieval workflow when needed.\n\nYou can utilize an archival storage option. For the Archive and Deep Archive tiers of S3 Intelligent Tiering you enable the archive tiers, and objects are automatically managed. There is no risk of additional costs and savings can be substantial. If you want to estimate your future savings, this is possible, but not strictly necessary as the only additional cost would be a situation arose in which you needed the data in minutes rather than hours, and specifically performed an expedited retrieval.\n\nFor the Glacier Flexible Retrieval and Glacier Deep Archive storage classes, the decision to use archival storage requires a more analysis as all retrievals will incur costs, so you will want to be clear that your long term access patterns are very infrequent. This is especially less true for larger files; for example, a 4GB file could be retrieved every 30 days at Glacier Deep Archive and still cost less than S3 Standard, but a 2MB file would need to be an average of 131 days between access.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/restoring-objects-retrieval-options.html"
                            },
                            "improvementPlan": {
                                "displayText": "Identify storage with long term retention that can accommodate retrieval delays and enable archival storage options"
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "Enabling S3 Intelligent-Tiering Archive Access and Deep Archive Access tiers",
                                            "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-intelligent-tiering.html#enable-auto-archiving-int-tiering"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "COST_1_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "COST_1_1 && COST_1_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!COST_1_1)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "COST_2",
                    "title": "How do you monitor your storage usage in Amazon S3?",
                    "description": "Monitoring storage usage will help you understand trends and patterns that leads to evaluating if current policies are still the best fit for the workload and organization.",
                    "choices": [
                        {
                            "id": "COST_2_1",
                            "title": "Review usage trends in S3 Storage Lens",
                            "helpfulResource": {
                                "displayText": "You can utilize S3 daily storage metrics in CloudWatch to gather this data at the bucket level. For deeper analysis, enable S3 Storage Lens for prefix level metrics. Since prefix level metrics are part of advanced metrics and recommendations, be deliberate about either disabling those metrics after analysis, or about what their long term use and cost is, especially when working with buckets with large numbers of small objects (costs are per object not per byte).",
                                "url": "https://aws.amazon.com/blogs/storage/5-ways-to-reduce-costs-using-amazon-s3-storage-lens/"
                            },
                            "improvementPlan": {
                                "displayText": "Look for patterns, such as an increasing percentage of usage coming from more expensive storage classes",
                                "url": "https://aws.amazon.com/blogs/storage/5-ways-to-reduce-costs-using-amazon-s3-storage-lens/"
                            }
                        },
                        {
                            "id": "COST_2_2",
                            "title": "Estimate the current and future size of your S3 buckets to identify where deeper analysis is useful",
                            "helpfulResource": {
                                "displayText": "You can utilize S3 daily storage metrics in CloudWatch to gather this data at the bucket level. For deeper analysis, enable S3 Storage Lens for prefix level metrics. Since prefix level metrics are part of advanced metrics and recommendations, be deliberate about either disabling those metrics after analysis, or about what their long term use and cost is, especially when working with buckets with large numbers of small objects (costs are per object not per byte).",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudwatch-monitoring.html"
                            },
                            "improvementPlan": {
                                "displayText": "Estimate the current and future size of your S3 buckets to identify where deeper analysis is useful"                                
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "S3 Storage Lens for prefix level metrics",
                                            "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage_lens_basics_metrics_recommendations.html#storage_lens_basics_metrics_selectiong"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "COST_2_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "COST_2_1 && COST_2_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "COST_3",
                    "title": "How do you manage KMS usage costs related to using encryption in Amazon S3?",
                    "description": "Review KMS key usage costs and take actions to minimize costs as necessary.",
                    "choices": [
                        {
                            "id": "COST_3_1",
                            "title": "Review KMS Usage Costs",
                            "helpfulResource": {
                                "displayText": "You can review KMS Usage costs in AWS Cost Explorer. All costs will be under the 'Key Management Service', and request costs will be of usage type(s) {region}-KMS-Requests. While all service usage is included, not just that associated with S3 usage, you can dive deeper into the source of requests using tools like CloudWatch, or understanding the relationship between your S3 requests and KMS if you find significant KMS usage costs.",
                                "url": "https://docs.aws.amazon.com/cost-management/latest/userguide/ce-what-is.html"
                            },
                            "improvementPlan": {
                                "displayText": "Review KMS Usage Costs in AWS Cost Explorer",
                                "url": "https://docs.aws.amazon.com/cost-management/latest/userguide/ce-what-is.html"
                            },
                            "additionalResources": [
                                {
                                    "type": "HELPFUL_RESOURCE",
                                    "content": [
                                        {
                                            "displayText": "S3 Storage Lens for prefix level metrics",
                                            "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage_lens_basics_metrics_recommendations.html#storage_lens_basics_metrics_selectiong"
                                        }
                                    ]
                                }
                            ]
                        },
                        {
                            "id": "COST_3_2",
                            "title": "Configure Amazon S3 Bucket Keys",
                            "helpfulResource": {
                                "displayText": "Amazon S3 Bucket Keys reduce the cost of Amazon S3 server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS). Using a bucket-level key for SSE-KMS can reduce AWS KMS request costs by up to 99 percent by decreasing the request traffic from Amazon S3 to AWS KMS.",
                                "url": "https://aws.amazon.com/blogs/storage/reducing-aws-key-management-service-costs-by-up-to-99-with-s3-bucket-keys/"
                            },
                            "improvementPlan": {
                                "displayText": "Configure Amazon S3 Bucket Keys for buckets using KMS encryption",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html"
                            }
                        },
                        {
                            "id": "COST_3_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "COST_3_1 && COST_3_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                }
            ]
        },
        {
            "id": "SUS",
            "name": "Sustainability",
            "questions": [
                {
                    "id": "SUS_1",
                    "title": "How do you remove unneeded or redundant data?", 
                    "description": "Removing data when it is no longer needed will reduce resource usage. It is important to plan for this from the outset, or it may later be difficult to distinguish the difference between data you still need and data you do not need. If you're unable to distinguish between these two, you'll likely retain unneeded data, which introduces increased resource usage, costs and could also pose risks in other dimensions.",
                    "choices": [
                        {
                            "id": "SUS_1_1",
                            "title": "Establish explicit data retention polices",
                            "helpfulResource": {
                                "displayText": "When it is not known how long data should be retained for, the defacto default ends up being that the data is retained indefinitely. Establishing explicit retention policies, even if this means accepting a default policy, will ensure that data has a planned end date.\n\nRetention policies should be reviewed for data sets with two purposes:\na. To establish if an initial policy was too long and is unnecessarily storing data that is unneeded. The review schedule should be part of the retention policy\nb. To establish if an initial policy was too short, and that data is more critical than the initial guess. A good practice here is to schedule this review when the oldest object in a data set reaches 80% of the total retention period, and then based on a schedule that is part of the retention policy.\n\nIf a review indicates data should be managed under a different retention policy, adjust as necessary."
                            },
                            "improvementPlan": {
                                "displayText": "Establish explicit data retention polices"
                            }
                        },
                        {
                            "id": "SUS_1_2",
                            "title": "Group objects with similar retention requirements and use prefix filters with lifecycle policies",
                            "helpfulResource": {
                                "displayText": "Each S3 Lifecycle rule includes a filter that you can use to identify a subset of objects in your bucket to which the S3 Lifecycle rule applies."
                            },
                            "improvementPlan": {
                                "displayText": "Plan object grouping with the use of lifecycle policies in mind",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-configuration-examples.html#lifecycle-config-ex1"
                            }
                        },
                        {
                            "id": "SUS_1_3",
                            "title": "Apply object tags to objects with fine-grained retention requirements and use with lifecycle policies",
                            "helpfulResource": {
                                "displayText": "Object tags enable fine-grained object lifecycle management in which you can specify a tag-based filter, in addition to a key name prefix, in a lifecycle rule. Also, when using Amazon S3 analytics, you can configure filters to group objects together for analysis by object tags, by key name prefix, or by both prefix and tags.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html"
                            },
                            "improvementPlan": {
                                "displayText": "Categorize your storage using tags",
                                "url": "https://aws.amazon.com/blogs/storage/simplify-your-data-lifecycle-by-using-object-tags-with-amazon-s3-lifecycle/"
                            }
                        },
                        {
                            "id": "SUS_1_4",
                            "title": "Remove incomplete multipart uploads",
                            "helpfulResource": {
                                "displayText": "Incomplete Multipart Uploads continue to occupy space unless removed. A lifecycle rule using the AbortIncompleteMultipartUpload action can minimize your storage costs. This rule that directs Amazon S3 to abort and remove multipart uploads that are not completed within a specified number of days after being initiated.",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpu-abort-incomplete-mpu-lifecycle-config.html"
                            },
                            "improvementPlan": {
                                "displayText": "Configure a bucket lifecycle configuration to remove incomplete multipart uploads",
                                "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-configuration-examples.html#lc-expire-mpu"
                            }
                        },
                        {
                            "id": "SUS_1_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SUS_1_1 && SUS_1_2 && SUS_1_3 && SUS_1_4",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "(!SUS_1_1)",
                            "risk": "HIGH_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                },
                {
                    "id": "SUS_2",
                    "title": "How do you manage the number of versioned objects you retain?",
                    "description": "Versioning buckets is a best practice for many workloads, because it allows for recovery to a prior version. That benefit should be weighed against the additional cost of additional copies, and the value they provide.",
                    "choices": [
                        {
                            "id": "SUS_2_1",
                            "title": "Understand what type of events would require a prior version to be restored/accessed",
                            "helpfulResource": {
                                "displayText": "Different data will have different storage requirements. The reasons for using versioning on a bucket will depend on the use case. In some cases, this is built into the workload's operation, and in some cases it is used as a fallback in the case of accidental deletion"
                            },
                            "improvementPlan": {
                                "displayText": "Understand what type of events would require a prior version to be restored/accessed"
                            }
                        },
                        {
                            "id": "SUS_2_2",
                            "title": "Define a lifecycle policy, with permanently delete non-current versions of objects",
                            "helpfulResource": {
                                "displayText": "A lifecycle policy with \"Days after objects become noncurrent\" specified will remove versions that have not been the current version for that many days. If the purpose of versioning is to prevent accidental deletion or correct other errors, you can set this to a period during which you are confident you would have already found and corrected any issue.\n\nThe second setting \"Number of newer versions to retain\" sets a maximum number of old versions. This can be useful to limit the maximum amount of space. Do remember though that there is no limit to how quickly new versions could push an older version out, so if the motivation is as a protection against malicious actions, it would be easy to overcome this. It is less likely that an accidental action would generate many versions quickly, but this too is possible."
                            },
                            "improvementPlan": {
                                "displayText": "Using lifecycle policy to permanently delete non-current versions of objects",
                                "url": "https://repost.aws/knowledge-center/s3-lifecycle-rule-non-current-versiong"
                            }
                        },
                        {
                            "id": "SUS_2_no",
                            "title": "None of these",
                            "helpfulResource": {
                                "displayText": "Choose this if your workload does not follow any of these best practices."
                            }
                        }
                    ],
                    "riskRules": [
                        {
                            "condition": "SUS_2_1 && SUS_2_2",
                            "risk": "NO_RISK"
                        },
                        {
                            "condition": "default",
                            "risk": "MEDIUM_RISK"
                        }
                    ]
                }
            ]
        }
    ]
}