Likelihood to Recommend
We were wanting to prove the concept of a low touch process for quickly spinning up boilerplate AWS environments. We were able to get started quickly and to ensure that the AWS Well-Architected Framework principles were followed - at least upfront - however, we found that for our use case and expertise level it ultimately wasn't a fit. We have the skills on our team to manage more of this on our own. My recommendation would be contingent on what skills are already available on your team: if you can "do it yourself" you might as well so that you don't pay for resources you don't need and you have finer grain control over what's created.
Read full review
Lacework is well suited for behavioral analysis. One thing to consider thought is in the early stages there will be quite a bit of noise generated by Lacework. There will be a higher volume alerts generated initially - until a good baseline is generated. Overall Lacework is good with alert handling - integration with Slack is good.
Read full review Pros Easily create new AWS accounts. Easily secure and manage AWS accounts. Landing zone with SSO is a huge win for larger teams. Read full review Easy to set-up the agent in cloud workloads. Easy integration with ticketing and messaging tools. Detailed visibility of all our container workloads across multiple accounts. Read full review Cons The AWS SSO GUI is not very intuitive and determining how to apply policies to users without creating redundant logins has been a challenge. The default guardrails do not fully encompass all the security checks that we needed. There does not appear to be any way to control roles at the IAM level from the control tower account through the GUI. Some features on AWS accounts still require logging into the individual account with the root user and cannot be done from AWS Control Tower. Read full review UI can be complicated and hard to know where to click to find information. Ability to create and manage cases or tickets from events that trigger. Read full review Usability
There is no way to easily close an AWS account whether it was created manually or via the AWS Control Tower. It takes too many steps to close it vs to provision a new AWS account
Read full review Alternatives Considered
AWS Systems Manager
and other slightly lower level components has been helpful for us to manage parts of our AWS presence at a more granular level than AWS Control Tower was designed for. It's not at all an apples-to-apples comparison as they solve different use cases, but for us, the use case associated with
AWS Systems Manager
was a better fit for our specific needs and skillsets. We did not need everything that AWS Control Tower was doing for us.
Read full review
Compared to Sysdig Falco (the free open-source IDS), Lacework helps security teams by providing actionable alerts and a user-friendly interface that gives you an overview of all workloads being monitored, and detailed insights into these workloads if needed. Falco requires you to build your own integration and interface around it, including a mechanism to whitelist certain alerts. This made it harder for the security team to focus their time on potential intrusions.
Read full review Return on Investment Less time manually deploying accounts which was error prone. Central logging allowed us to have 1 place to view logs. Read full review Being a FinTech company, financial institutions who partner with us want to know that we are appropriately maintaining a Security, Risk and Compliance program that maintains a level of comfort for their vendor management. Lacework gives us the ability to monitor and maintain a level of security for our infrastructure that puts our partners at ease, reduces the revenue cycle for new partners and opens doors to the future. Read full review ScreenShots