3.3.1.4. Compliance Frameworks and AWS Services (Artifact, Audit Manager)

3.3.1.4. Compliance Frameworks and AWS Services (Artifact, Audit Manager)

💡 First Principle: Leveraging managed AWS services to automate evidence collection and provide access to compliance reports is critical for efficiently meeting regulatory and industry standards.

Scenario: A healthcare organization needs to demonstrate continuous compliance with "HIPAA" for its applications running on AWS. They need to automate evidence collection for external auditors and ensure that their AWS environment's configurations consistently meet "HIPAA" standards.

Compliance is a critical concern for many organizations. AWS provides a suite of services to help meet various compliance frameworks.

• "AWS Artifact": A service that provides on-demand access to AWS security and compliance reports and select online agreements.
  • Practical Relevance: Gives customers access to AWS's internal security and compliance documents (e.g., "SOC reports", "PCI DSS reports", "ISO certifications") that can be shared with auditors.
• "AWS Audit Manager": A service that automates the collection of evidence to help you prepare for audits (e.g., "PCI DSS", "HIPAA", "GDPR"). (In maintenance: since April 30, 2026 it cannot be set up in new accounts; AWS points new compliance work to "AWS Config" conformance packs. It is still on the SAP-C02 in-scope list.)
  • Practical Relevance: Simplifies continuous auditing by continuously collecting data from various AWS services ("CloudTrail", "Config", "Security Hub") and organizing it according to predefined frameworks. Helps to maintain a consistent audit-ready posture.
• "AWS Config": (As covered) Continuously monitors resource configurations against desired rules, often mapped to compliance standards.
• "AWS Organizations (SCPs)": (As covered) Enforce preventative compliance guardrails across accounts.
• "Amazon Macie": (As covered) Helps identify sensitive data for data privacy compliance.

Visual: AWS Services for Compliance Management

Which Service Answers Which Audit Question: "Artifact" supplies AWS's own reports and agreements. "Audit Manager" continuously collects evidence from your own resources (from "CloudTrail", "Config", "Security Hub") mapped to framework controls (PCI DSS, HIPAA, SOC 2, GDPR) and builds the assessment report, which is what proves a control held over a period such as 12 months. "Config" detects drift from required settings and can remediate. "Security Hub" runs continuous posture checks against standards (CIS, PCI DSS and others) and aggregates findings with a score, but is not an evidence-collection tool. Pair Audit Manager (evidence) with Security Hub or Config (ongoing checks) when a question needs both.

⚠️ Common Pitfall: Misunderstanding the "Shared Responsibility Model" for compliance. AWS is responsible for the compliance of the cloud, but the customer is responsible for compliance in the cloud. Services like "Audit Manager" help you prove your side of the responsibility.

Key Trade-Offs:

• Automation vs. Manual Effort: Setting up services like "Audit Manager" requires an initial investment of time, but it drastically reduces the manual, time-consuming effort required to gather evidence for an audit.

Reflection Question: How would you use "AWS Audit Manager" and "AWS Config" to establish a continuous compliance posture for a healthcare organization, automating evidence collection and ensuring adherence to "HIPAA" requirements for its AWS environment's configurations?