Technology Reference

Enhanced Security and Compliance Add-on

Security InfrastructureMedium ComplexityLearning: Medium

OS-level hardening, security monitoring agents, and automatic cluster patching for regulated workloads

// Guidance

Decision Guide

✓

→Processing data under HIPAA, FedRAMP High, PCI-DSS, or similar frameworks
→Security team requires OS-level audit evidence, not just application-layer logs
→Compliance auditors ask for evidence of host hardening and patch management
→You need automated cluster patching to close security vulnerabilities quickly
→Running workloads that must meet inter-node encryption requirements

✗

// Details

Esm Only Vs Full Profile

esm only:: Hardened image + monitoring agents only; no enforced instance types; can be disabled
compliance profile:: Full hardening + enforced Nitro instances + TLS enforcement + auto cluster update; irreversible
verdict:: Start with ESM if you want monitoring without commitment; use full profile when compliance framework requires it

Vs Audit Logging

audit logging:: Application-layer logs: who queried what table, who changed permissions
enhanced security monitoring:: OS-layer logs: process execution, network connections, system calls from monitoring agents
verdict:: Both are needed for regulated workloads — they are complementary, not alternatives

// Related

1 controls use Enhanced Security and Compliance Add-on for implementation.

See how Enhanced Security and Compliance Add-on compares to other access control approaches with our detailed comparison table.

Decision Guide

✓

→Processing data under HIPAA, FedRAMP High, PCI-DSS, or similar frameworks
→Security team requires OS-level audit evidence, not just application-layer logs
→Compliance auditors ask for evidence of host hardening and patch management
→You need automated cluster patching to close security vulnerabilities quickly
→Running workloads that must meet inter-node encryption requirements

✗

Key Characteristics

Esm Only Vs Full Profile

esm only:: Hardened image + monitoring agents only; no enforced instance types; can be disabled
compliance profile:: Full hardening + enforced Nitro instances + TLS enforcement + auto cluster update; irreversible
verdict:: Start with ESM if you want monitoring without commitment; use full profile when compliance framework requires it

Vs Audit Logging

audit logging:: Application-layer logs: who queried what table, who changed permissions
enhanced security monitoring:: OS-layer logs: process execution, network connections, system calls from monitoring agents
verdict:: Both are needed for regulated workloads — they are complementary, not alternatives