We're evaluating Panther for our AWS environment, and I've been tasked with assessing its fit for a healthcare workload that must be HIPAA compliant. I've gone through their docs and spun up a test deployment, but I'm looking for real-world experiences from teams who've been through an audit with it.
From my initial review, the security posture looks solid on paper:
- They claim HIPAA eligibility and offer a BAA.
- Data at rest encryption is there, and they support KMS CMKs for S3 buckets used for alerts and data-lake.
- IAM roles and VPC endpoints are well documented for a locked-down deployment.
However, I'm digging into the practical, day-to-day ops implications. My main questions are around the managed service components and log handling:
* **Processing PHI in logs:** If application logs contain protected health information (PHI), does Panther's parsing and enrichment process maintain compliance throughout the pipeline? We'd likely need to ensure detection rules avoid storing raw PHI in alerts.
* **Infrastructure as Code gaps:** Their CloudFormation templates are available, but I had to write extra Terraform to enforce bucket policies, enforce encryption on all resources, and configure stricter CloudTrail settings. Here's a snippet of the additional S3 policy I layered in:
```hcl
resource "aws_s3_bucket_policy" "panther_log_bucket" {
bucket = aws_s3_bucket.panther_storage.id
policy = jsonencode({
Version = "2012-10-17"
Id = "EnforceHIPAA"
Statement = [
{
Sid = "ForceSSLAndEncryption"
Effect = "Deny"
Principal = "*"
Action = "s3:*"
Resource = [
aws_s3_bucket.panther_storage.arn,
"${aws_s3_bucket.panther_storage.arn}/*"
]
Condition = {
Bool = { "aws:SecureTransport" = "false" }
Null = { "s3:x-amz-server-side-encryption" = "true" }
}
}
]
})
}
```
* **Managed AWS Service Dependencies:** Their use of managed services like DynamoDB, Lambda, and ECS/Fargate is great for ops overhead, but have any of you had to provide additional evidence or configuration to auditors for these shared responsibility model components?
I'm also curious about cost predictability when ingesting high volumes of VPC flow logs and CloudTrail. Did you run into any surprises with the data processing or storage costs in the data-lake?
Would appreciate any insights on audit readiness, especially around change management and how you handle detection rule updates in a compliant environment.
terraform and chill
Oh, that's a really practical angle I hadn't fully considered yet. When you mention writing extra Terraform for bucket policies and encryption, was that mostly around the S3 buckets Panther creates, or did you have to lock down other resources too?
The PHI in logs question is my biggest hang-up too. Their docs say you can write rules to redact, but I'm trying to picture what that looks like in practice. If a rule triggers on a log line with PHI, does the alert metadata still capture that original context? That seems like a compliance gray area.
The BAA is table stakes. The real issue is their managed service's access to your data plane. Even with VPC endpoints, their control plane components that manage rule execution need to process your log streams. That processing happens in their AWS account.
For PHI in logs, you can't just rely on redaction rules. You have to assume the raw log *will* be briefly materialized in their environment before your rule logic runs. Get them to confirm in writing that no PHI is persisted in their managed infrastructure, even ephemerally. Most BAAs are vague on this point.
On IaC gaps, you're right. I had to write custom Terraform modules for everything beyond the core deployment: KMS key policies, S3 lifecycle rules for the data-lake, and explicit denies on the Panther-managed IAM roles for regions we don't use. Their templates are a starting point, not a complete security baseline.
alert only when it matters
Yeah, that point about Terraform gaps is real. I'm looking at Panther too, and the official modules feel like a starting point, not a complete deployment. Had to add my own config for S3 bucket versioning and tighten up the IAM boundaries they create.
Did your team get a straight answer on the PHI processing question? I'm stuck on that same issue. Their docs mention redaction, but if the raw log hits their managed service first, that feels like a problem.