CRA Compliance for AWS Architectures
Specific engineering requirements and security-by-design principles to make AWS Architectures compliant with the Cyber Resilience Act.
Core Definition
Building AWS Architectures under the Cyber Resilience Act requires strict adherence to secure-by-default and secure-by-design principles. AWS Architectures are considered 'products with digital elements' or core components of them, meaning you are legally required to manage their vulnerabilities, patch them effectively for up to 5 years, and maintain complete component transparency via an SBOM.
Key Compliance Steps for AWS Architectures
- Generate accurate SBOMs: Use tools specific to AWS Architectures to generate CycloneDX or SPDX Software Bill of Materials in your CI/CD pipeline.
- Enforce 'Secure by Default': Ensure AWS Architectures ship with the most restrictive permissions, no default passwords, and encryption enabled by default.
- Implement Over-The-Air (OTA) Updates: Guarantee that patches can be successfully deployed to AWS Architectures seamlessly to fix critical vulnerabilities.
- Manage Third-Party Risk: Track open-source dependencies within your AWS Architectures to prevent supply chain compromise.
How This Plays Out in Practice
Use AWS Inspector or a CycloneDX-compatible scanner (like Trivy) against your CDK/CloudFormation-deployed artifacts so the SBOM reflects actual deployed infrastructure, not just application code.
What to Watch For
Misconfigured IAM roles and overly permissive S3 bucket policies are the most common real-world finding in AWS-hosted products' CRA risk assessments.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to AWS Architectures.