Posture, spend & inventory
What the system is tracking as possible work, its status, and what's been attributed to a ticket. When a fixed item stays gone for 2 consecutive daily checks (~48h), Athena files it as completed work — risk items to Jira, asset items to JSM.
Ledger not persisted (REMEDIATION_TABLE unset) — showing the live open set only. The confirming / remediated history is retained once the ledger is configured and the daily sync runs.
Confirmed fixes awaiting/failing a ticket first, then items confirming a fix, then open work, then remediated.
| Item | Category | Target | Status | Ticket |
|---|---|---|---|---|
Admin standing access to Audit & Log Archive accounts AWS AWS::SSO::PermissionSet Achieve-Admins (us-east-1) — medium — Security | Cloud | Jira · risk | Tracking | — |
CI deploy role uses AdministratorAccess AWS AWS::IAM::Role achieve-dashboard-deploy (us-east-1) — medium — Security | Cloud | Jira · risk | Tracking | — |
No customer-managed KMS key on CloudTrail/Config logs AWS AWS::KMS::Key aws-controltower-logs (us-east-1) — low — Operational | Cloud | Jira · risk | Tracking | — |
Legacy Terraform CI: stale enterprise app Inactive 190d; 0 assignments | Enterprise apps | Jira · risk | Tracking | — |
Old Demo: Disabled demo@achieve.llc (Entra) | Identity | JSM · asset | Tracking | — |
Old Demo: No MFA demo@achieve.llc (Entra) | Identity | JSM · asset | Tracking | — |