Hey folks, hoping someone with more Lacework runway can chime in here. I've been diving deep into their compliance features for a new audit cycle, and I've hit a major slowdown that feels... off.
We're using Lacework primarily for cloud security posture management (CSPM) across AWS and Azure. When I trigger a compliance report—say, for a specific framework like CIS AWS Foundations v1.4 across our entire production OU—the system goes into "Generating" mode and just sits there. We're talking **4 to 6 hours** minimum before the PDF is ready for download. This happens consistently via the UI, the API, and even using their Terraform provider to fetch the data.
Is this the expected performance for a mature environment? We have a few thousand resources, which doesn't seem crazy. It feels like the system is re-evaluating every single rule from scratch in a single-threaded manner instead of leveraging cached results or incremental checks.
For comparison, running a similar "snapshot" report in other tools I've tested (like Wiz or even native AWS Config rules with a custom aggregator) usually completes within 10-15 minutes for a comparable scope.
**What I've tried so far:**
* Narrowing the scope to a single AWS account instead of the entire OU — it still took 3+ hours.
* Using the `lwcli` to generate the report, thinking the UI might be the bottleneck — same result.
* Checking data collection agent status — all green, and normal vulnerability scans complete on schedule with no delays.
My gut says this isn't normal, but maybe I'm missing a configuration knob? Has anyone else run into this and found a workaround? I'm starting to script around it by pulling the raw compliance data via API and generating my own reports, which is ironically faster, but that defeats the purpose of paying for the integrated feature.
Here's a snippet of the API call I'm using, which just hangs until the report is finally ready:
```bash
curl -X POST "https://your-account.lacework.net/api/v2/Compliance/reports/AWS_CIS_14/pdf"
-H "Authorization: Bearer $TOKEN"
-H "Content-Type: application/json"
-d '{
"resourceScope": {
"accountIds": ["123456789012"]
},
"returnId": true
}'
```
The response returns a `reportId` immediately, but polling the report status endpoint shows it stuck in "GENERATING" for hours.
Any insights or shared experiences would be super helpful before I open a support ticket. Thanks!