AWS Audit Manager

AWS Audit Manager is a fully managed service that automates the collection of evidence from your AWS accounts and resources, making it easier to prepare for audits and demonstrate compliance. Before Audit Manager, organizations had to manually gather logs, configuration snapshots, and user activity records—a time-consuming and error-prone process. Audit Manager addresses this by continuously monitoring your environment against predefined or custom control frameworks, generating audit-ready reports.

The service supports over 100 prebuilt standard frameworks, including: - CIS AWS Foundations Benchmark - PCI DSS v3.2.1 - HIPAA - SOC 2 - NIST 800-53 - AWS Well-Architected Framework

You can also create custom frameworks to match your organization's internal policies or regulatory requirements.

Audit Manager operates through a three-phase cycle: assessment creation, evidence collection, and report generation.

Phase 1: Assessment Creation You start by creating an *assessment*. An assessment defines: - Framework: The set of controls to evaluate (e.g., PCI DSS). - AWS Accounts: Which accounts to include (from AWS Organizations). - Resources: Specific resource types (e.g., S3 buckets, IAM roles, EC2 instances). - Delegation: Optionally delegate assessment management to another AWS account (e.g., a security team).

Phase 2: Evidence Collection Once the assessment is active, Audit Manager automatically collects evidence from multiple sources: - AWS Config: Configuration history and compliance snapshots. - AWS CloudTrail: API activity logs. - Amazon CloudWatch: Logs and metrics. - AWS Security Hub: Security findings. - AWS Organizations: Account structure. - Direct API calls: For resources not covered by Config.

Each control within the framework has one or more *data sources*. For example, a control that checks whether S3 buckets block public access might pull data from AWS Config rule s3-bucket-public-read-prohibited. Audit Manager runs these checks periodically (default every 24 hours) and collects the results as evidence.

Evidence is stored in an S3 bucket managed by Audit Manager (or a customer-managed KMS key if you enable encryption). The service retains evidence for the duration of the assessment plus a configurable retention period (default 365 days).

Phase 3: Report Generation When you need to present evidence to an auditor, you generate a *report*. The report compiles all evidence into a structured document organized by control. It includes: - Control status: Compliant, Non-compliant, or Not applicable. - Evidence details: Raw data from Config, CloudTrail, etc. - Remediation suggestions: Links to AWS documentation or automated remediation playbooks.

Reports can be exported as PDF or CSV files.

You can interact with Audit Manager using the AWS CLI, SDK, or Console.

Creating an assessment via CLI:

aws auditmanager create-assessment \
    --name "PCI-DSS-2024" \
    --framework-id "arn:aws:auditmanager:us-east-1::framework/PCI-DSS-v3.2.1" \
    --aws-account "123456789012" \
    --scope "{\"awsAccounts\":[{\"id\":\"123456789012\"}],\"awsServices\":[\"S3\",\"IAM\"]}"

Listing assessments:

aws auditmanager list-assessments

Generating a report:

aws auditmanager get-assessment-report-url \
    --assessment-id "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"

Delegating an assessment:

aws auditmanager batch-associate-assessment-report-evidence \
    --assessment-id "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" \
    --evidence-folder-id "folder-id"

A fintech startup processes credit card payments and must comply with PCI DSS. They have 50 AWS accounts managed via AWS Organizations. The compliance team uses Audit Manager with the prebuilt PCI DSS v3.2.1 framework. They create a single assessment covering all accounts and key services (S3, RDS, EC2, IAM). Evidence is collected automatically for controls like 'Encrypt cardholder data at rest' (using S3 bucket encryption settings) and 'Restrict access to cardholder data' (IAM policies). The team generates monthly reports for the acquiring bank. A common misconfiguration is forgetting to enable AWS Config in all accounts, causing controls to show 'No evidence'. The solution is to use AWS Config aggregator to centralize configuration data.

A SaaS company needs SOC 2 Type II report. They use Audit Manager with a custom framework based on SOC 2 trust principles. They define controls for availability (e.g., Auto Scaling group configuration) and security (e.g., VPC flow logs enabled). The security team delegates assessment management to an external auditor's AWS account, allowing the auditor to access evidence directly. Performance consideration: with thousands of resources, evidence collection can take up to 24 hours. The company sets up automated notifications via Amazon SNS when controls become non-compliant. A common pitfall is not defining manual controls correctly—for example, requiring a signed policy document but forgetting to upload it, causing the control to remain non-compliant.

A multinational corporation has internal security policies that go beyond standard frameworks. They create a custom framework in Audit Manager with 150 controls. They use AWS Config custom rules to map to some controls. Evidence is collected from 200 accounts across multiple regions. The enterprise uses Audit Manager's Evidence Finder to quickly respond to auditor requests, e.g., 'Show all IAM role trust policies that allow cross-account access'. A challenge is managing the cost: with millions of resource evaluations per month, the bill can exceed $10,000. They optimize by scoping assessments to only critical resources and using the free tier for smaller assessments.