Collecting audit evidence
Lesson 2 of 3 in Compliance and Audit Evidence.
The target candidate description for this exam lists "experience responding to an audit", and that experience teaches one lesson fast: an auditor does not want your opinion, and does not want a screenshot. They want evidence — an artifact with a date, a source, and a chain of custody, showing that a named control operated over the audit period, not just that it is switched on today.
There are two kinds of evidence, and conflating them is the mistake this lesson exists to prevent.
Evidence about AWS — that the data centres have physical access controls, that AWS's own processes are audited — is not yours to produce. You could not test it if you wanted to. These are inherited controls, and AWS Artifact is where you collect AWS's audit reports to satisfy them.
Evidence about your workloads — that your buckets were encrypted, that MFA was enforced, that nobody used root, that only authorized people could reach the database — is entirely yours. AWS Audit Manager is the service that collects it continuously instead of making you assemble it in a panic the week the auditor arrives.
| AWS Artifact | AWS Audit Manager | |
|---|---|---|
Whose evidence | AWS’s, about AWS infrastructure and processes | Yours, about your accounts, resources and activity |
What you get | Downloadable reports — SOC 1/2/3, ISO 27001 and friends, PCI DSS AOC, FedRAMP, C5, IRAP — plus third-party reports for some Marketplace products | Assessments built from frameworks, with evidence collected continuously into dated, per-control folders, and an assessment report you hand over |
Also provides | Agreements: accept a BAA or NDA for one account, or organization-wide from the management account | Delegation of a control set to a subject-matter expert, who reviews, comments and returns it |
Effort | Download it. Most reports are under NDA, which you accept as part of downloading | Scope an assessment once; evidence accrues by itself from then on |
The stem that names it | “The auditor wants evidence of physical and environmental controls”, “provide AWS’s SOC 2 report”, “we need a signed BAA” | “Continuously collect evidence that our controls operated”, “produce an audit-ready report for PCI DSS across 40 accounts” |
Audit Manager's vocabulary is worth learning because the exam uses it literally. A framework is a set of control sets, each holding controls; AWS ships prebuilt frameworks for the common standards (CIS, PCI DSS, SOC 2, HIPAA, GDPR, NIST 800-53, ISO 27001, and a generative-AI best-practices framework), and you can build a custom framework that mirrors your own control catalogue — which is what most regulated organizations actually do, because their obligations never map one-to-one onto a published standard.
You then create an assessment from a framework, scoped to the accounts and AWS services in question. From that moment Audit Manager collects evidence on its own, and the four kinds are the detail to remember:
- Compliance check — results from AWS Config rules and Security Hub controls. This is why the previous lesson matters: your Config estate is your evidence pipeline.
- User activity — CloudTrail events relevant to the control.
- Configuration data — resource configuration snapshots gathered through describe and list API calls.
- Manual evidence — the things no API can produce: the signed policy, the training completion record, a screenshot of a third-party console, a penetration test report.
Evidence lands in dated folders organised by control, so "show me that this control operated in March" is a navigation rather than an investigation. A control set can be delegated to a subject-matter expert — the DBA who must attest to backup testing, the HR lead who owns the training record — and they review, comment, attach evidence and return it without becoming an Audit Manager administrator. Finally you generate an assessment report into an S3 bucket you own: the report plus its evidence files, with validation so the recipient can verify nothing was altered. In an organization, designate a delegated administrator and one assessment spans member accounts instead of one assessment per account.
Responding to an audit request, end to end
- Auditor requests evidence for a control
“Demonstrate that data at rest was encrypted across the in-scope environment for the twelve months to September.” Note the period — today’s dashboard does not answer it.
- Whose control is it?
The shared responsibility model decides where the evidence comes from before anything else does.
- AWS Artifact: download AWS’s report
Inherited controls — physical security, environmental controls, AWS’s own process audits. The SOC 2 or ISO 27001 report is the evidence, and it usually arrives under NDA.
- Audit Manager assessment, scoped from a framework
A prebuilt framework for a published standard, or a custom framework mirroring your own control catalogue. Scope it to the in-scope accounts and services.
- Automated evidence accrues
Compliance checks from Config and Security Hub, user activity from CloudTrail, configuration data from API snapshots — collected continuously into dated, per-control folders.
- Add manual evidence
Policies, training records, vendor attestations, a penetration test report. No API produces these, and an assessment without them is incomplete.
- Delegate control sets to subject-matter experts
The people who own the control review and attest to it, without being given administrative access to the whole assessment.
- Generate the assessment report
Report plus evidence files into an S3 bucket you own, with validation so the recipient can confirm the package is intact.
- Evidence with provenance, not screenshots
Date, source, control, chain of custody. That is the difference between passing an audit and arguing with one.
Artifact is simpler but has two halves that get confused. Reports are the audit artifacts AWS publishes about itself, available on demand from the console or API — and increasingly third-party reports for independent software sold through AWS Marketplace, so you can collect a vendor's attestation in the same place. Agreements are contracts you accept: a Business Associate Addendum for HIPAA workloads, an NDA governing the reports themselves. The organization detail worth carrying: an organization agreement is accepted once in the management account and covers every member account, which is the right answer when a stem says "we must accept the BAA for all 60 accounts".
And the sentence to keep: Artifact is not an assessment tool. It will never tell you whether your bucket is encrypted. It tells you that the facility holding the disk is audited — which is exactly the part of the control you cannot test yourself, and exactly the part an auditor will otherwise ask you to prove.
Interactive sorting exercise: An auditor asks for each of these. Where does it come from?
Key terms: AWS Audit Manager, Audit Manager framework, Audit Manager assessment, Evidence (Audit Manager), AWS Artifact, Inherited controls
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.