Auditing and Compliance Evidence

What it is

An audit asks you to prove that controls exist and that they worked. Proof is evidence: records of who did what, how resources were configured at a given time, and that those records were not altered.

Auditing on AWS is mostly a design problem. You decide in advance what to record, where to keep it, who can read it and how to produce reports without a manual scramble.

How it works

Record everything, centrally

The earlier monitoring pages cover how to set up these sources. For audits the key points are completeness (all accounts, all Regions), central storage and integrity.

Protect the evidence

• Store logs in a dedicated log archive account that workload administrators cannot access, as Control Tower does.
• Use S3 versioning, SSE-KMS encryption and restrictive bucket policies that allow only the logging services to write.
• Use S3 Object Lock in compliance mode for write once, read many storage with a retention period that nobody, including the root user, can shorten.
• Turn on CloudTrail log file integrity validation to prove files were not changed.
• Replicate the archive to another Region for durability.

aws cloudtrail validate-logs \
  --trail-arn arn:aws:cloudtrail:us-east-1:111122223333:trail/org-trail \
  --start-time 2025-01-01T00:00:00Z

Continuous compliance with Config

Config conformance packs map rules to a framework, and the compliance view shows which resources fail. An organization aggregator and organization conformance packs give the audit team a single view of every account. The configuration timeline can show a resource as it was at the date in question.

AWS Audit Manager

Audit Manager automates evidence collection. You choose a prebuilt or custom framework and define the scope: accounts and services.

It then gathers evidence continuously from CloudTrail, Config, Security Hub and API calls, maps it to the controls in the framework, and lets you add manual evidence. Assessment reports go to S3 and you can delegate review to auditors.

AWS Artifact

AWS Artifact is the portal for AWS's own compliance reports, such as audit reports and certifications, and for agreements, such as a business associate addendum. Use it to answer "what does the provider certify?" Your own configuration remains your responsibility under the shared responsibility model.

Identity and access reviews

aws iam generate-credential-report
aws iam get-credential-report
aws accessanalyzer create-analyzer --analyzer-name org-analyzer --type ORGANIZATION

The credential report lists users, password and key age, and MFA status. Access Analyzer shows external access and unused permissions across the organization. Last accessed data supports removing unused permissions in access reviews.

Separation of duties for auditors

Give auditors read only access through a dedicated role, such as one based on the SecurityAudit managed policy, and no ability to change resources. Keep the people who run workloads out of the log archive and security accounts. Record and alarm on any administrator access to those accounts.

Other evidence sources

• AWS Trusted Advisor security checks, with the set of checks depending on the support plan.
• Systems Manager compliance for patch and association status.
• Inspector reports for vulnerability posture.
• Tag policies and cost allocation tags for ownership evidence.

Retention and reporting

Set retention periods to match legal requirements, and use S3 lifecycle rules to move older evidence to cheaper storage. Automate the production of recurring reports from Config, Security Hub and Audit Manager, rather than preparing them by hand before each audit.