Security Foundations and Governance · Topic 6 of 6
Compliance Reporting and Audit Evidence
Report on compliance with Security Hub standards, Audit Manager, AWS Artifact, Trusted Advisor and Access Analyzer, and pick the right tool per question.
- 5 min
- Security Hub standards run automated controls for CIS, AWS Foundational Security Best Practices, NIST and PCI DSS, and show a security score.
- Security Hub controls need AWS Config recording enabled.
- Audit Manager collects evidence automatically against frameworks and produces assessment reports.
What it is
Compliance work has two sides. First you check that your resources meet a standard, and then you gather evidence that an auditor can accept.
AWS has a tool for each part, and the exam asks you to pick the right one: Security Hub and Config for continuous checks, Audit Manager for evidence collection, AWS Artifact for AWS's own reports, and Trusted Advisor and Access Analyzer for focused findings.
How it works
Security Hub standards
Security Hub CSPM (cloud security posture management) runs automated controls against standards, such as AWS Foundational Security Best Practices, CIS AWS Foundations Benchmark, NIST SP 800-53 and PCI DSS (Payment Card Industry Data Security Standard). Each control is checked by AWS Config rules or other sources, and results show as passed or failed, with severity and remediation guidance.
- A security score summarises the percentage of controls passed for a standard.
- Central configuration policies let the delegated administrator choose which standards and controls apply to which accounts and Regions.
- Controls can be disabled when they do not apply, with a recorded reason.
- Findings go to EventBridge for alerts and automation, and can be aggregated across Regions.
Security Hub depends on Config, so enable Config recording in every account and Region before turning on standards.
AWS Audit Manager
Audit Manager automates collection of evidence for audits. You pick a prebuilt or custom framework that maps controls to data sources, and it gathers evidence continuously from CloudTrail, Config, Security Hub and API calls into an assessment.
- Evidence includes configuration snapshots, user activity logs and compliance check results.
- Assessment reports package the evidence for an auditor, with an organized folder structure and a cryptographic hash for integrity.
- Delegated reviewers can comment, and manual evidence such as policy documents can be uploaded.
- It works across accounts in an organization through a delegated administrator.
Choose Audit Manager when the question is about producing audit evidence and reports, not about detecting misconfigurations.
AWS Artifact
Artifact is a portal for AWS compliance documents and agreements. It provides AWS's own audit reports, such as SOC reports and ISO certifications, so that you can show an auditor how AWS meets its part of the shared responsibility model. You can also accept agreements there, such as a business associate addendum for health data.
Artifact reports cover AWS's controls, not your configuration. Your own proof still comes from your resources, using the tools above.
AWS Trusted Advisor
Trusted Advisor checks accounts against best practices in categories that include security, cost, performance and fault tolerance. Security checks include open security groups, public snapshots, root account MFA and exposed access keys.
More checks are available on higher AWS Support plans. Trusted Advisor integrates with Organizations for a multi account view.
IAM Access Analyzer and others
- Access Analyzer reports external and unused access, and checks policies against custom rules.
- Amazon Inspector reports vulnerabilities for compliance with patching requirements.
- Amazon Macie shows where sensitive data is stored.
- AWS Well Architected Tool lets you review a workload against the security pillar and track improvements.
Choosing the tool
| Question | Tool |
|---|---|
| Does every account meet the CIS benchmark continuously? | Security Hub standards |
| Is a specific configuration rule satisfied, and what changed? | AWS Config |
| Produce evidence and a report for an audit | Audit Manager |
| Show the auditor that AWS data centres are certified | AWS Artifact |
| Quick check for open ports and exposed keys | Trusted Advisor |
| Which resources are shared outside the organization? | Access Analyzer |
| Is the application missing patches? | Inspector |
| Where is personal data stored? | Macie |
An audit workflow
- Define the framework you must meet, for example PCI DSS or an internal standard.
- Deploy conformance packs or Security Hub standards to every account, using central policy.
- Aggregate results into a central account and fix failing controls, with automatic remediation where safe.
- Run an Audit Manager assessment for the audit period, and review the evidence.
- Share AWS's own reports from Artifact for the shared responsibility part.
- Keep logs immutable for the retention period, so evidence is trustworthy.
Governing tags and cost of compliance
Tag policies and Config required tag rules support evidence by linking resources to owners and data classification. Limit cost by enabling only the standards you need, and by recording only needed resource types.
What to remember for the exam
- Security Hub standards run automated controls for CIS, AWS Foundational Security Best Practices, NIST and PCI DSS, and show a security score.
- Security Hub controls need AWS Config recording enabled.
- Audit Manager collects evidence automatically against frameworks and produces assessment reports.
- AWS Artifact gives access to AWS's own compliance reports and agreements. It does not assess your resources.
- Trusted Advisor gives best practice checks, including security checks such as open ports and public snapshots.
- Config conformance packs and rules report compliance for a set of controls across an organization.
- Access Analyzer finds external and unused access.
- Use central configuration policies in Security Hub to apply standards across accounts and Regions.
"Provide an auditor with continuously collected evidence mapped to a framework" is Audit Manager, while "provide AWS's SOC report" is AWS Artifact.
Common mistakes
Using Artifact to prove your own compliance. It shows AWS's controls, not your configuration.
Turning on Security Hub standards without Config. The controls cannot evaluate resources.
Treating Trusted Advisor as a full compliance engine. It gives selected best practice checks, not full framework coverage.
Confusing detective tools with evidence tools. Config and Security Hub find problems, and Audit Manager organises proof.
A passing security score does not mean you comply with a regulation, since a standard covers only part of its requirements.
Check yourself
Which service collects audit evidence against a framework automatically?
AWS Audit Manager, which produces assessment reports.
Where do you download AWS's SOC reports?
AWS Artifact.
What must be enabled for Security Hub controls to work?
AWS Config recording, in each account and Region.
Topic 6 of 6 in Security Foundations and Governance
Test yourself on Security Foundations and Governance
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.