AWS Audit Manager

AWS Audit Manager helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards.

Key Features

• Pre-built Frameworks: PCI DSS, HIPAA, SOC 2, GDPR, NIST 800-53, NIST CSF, CIS Benchmarks, ISO 27001, FedRAMP
• Custom Frameworks: build your own compliance frameworks with custom controls
• Automated Evidence Collection: automatically collects evidence from Config, CloudTrail, Security Hub, and manual sources
• Assessment Reports: generate auditor-ready reports with evidence mapped to controls
• Delegation: assign control owners to collect manual evidence

How It Works

1. Select a framework (e.g., PCI DSS v4.0)
2. Audit Manager maps framework controls to AWS data sources
3. Evidence is automatically collected and organized by control
4. Review evidence, add manual evidence, generate assessment report
5. Share report with external auditors

How It Goes Wrong in Practice

The most common Audit Manager failure has nothing to do with Audit Manager itself: it is starving the service of evidence. Automated controls pull from AWS Config, CloudTrail, Security Hub, and direct service API calls. If the Config recorder is switched off in some regions, if Security Hub and its standards are not enabled in every in-scope account, or if a member account was never enrolled, the affected controls simply collect little or nothing. The assessment still runs, the dashboard still renders, and a team skimming it can walk into an audit believing they have months of evidence when entire control sets are backed by empty folders. Auditors notice gaps like that immediately. The second failure is scoping drift: an assessment gets created against a handful of accounts early in a project, the organization grows to twenty accounts, and nobody updates the assessment scope, so the newest (and usually least hardened) accounts are invisible to evidence collection. The third is treating evidence as compliance. Audit Manager documents what your environment does; it does not make the environment compliant. Collecting a year of evidence showing unencrypted databases is thorough documentation of a problem, not a passed audit. Pair Audit Manager with Config rules and Security Hub controls that actually enforce or flag the misconfigurations, and review non-compliant evidence as an operational signal, not just an audit artifact.

Practical Check: Confirm Active Assessments

Verify what is actually being assessed, straight from the CLI:

aws auditmanager list-assessments --status ACTIVE

The output lists each assessment's name, id, compliance framework type, and delegation status. Cross-check two things: that every framework you claim to be tracking has an ACTIVE assessment, and that assessment scope matches your current account list. Then spot-check upstream dependencies in each in-scope account: Config recording on, CloudTrail logging, Security Hub enabled with the standards your controls rely on. An assessment is only as good as the pipelines feeding it.

Frequently Asked Questions

Does Audit Manager make my workloads compliant?
No. It automates evidence collection and organizes that evidence against framework controls, which removes an enormous amount of screenshot-and-spreadsheet drudgery from audit preparation. Whether the evidence shows compliant configurations is entirely up to how you have built and operated the environment. Enforcement belongs to other layers: SCPs, Config rules with remediation, and Security Hub.

How is Audit Manager different from AWS Config?
Config evaluates individual resources against specific rules and answers "is this resource configured correctly right now". Audit Manager sits a level higher: it maps many data sources, including Config evaluations, CloudTrail activity, and Security Hub findings, onto the control structure of a compliance framework, and packages the result into assessment reports an external auditor can consume. Config is a detection tool; Audit Manager is an audit preparation tool that consumes it.

Can I audit requirements that AWS cannot see?
Yes. Frameworks always contain controls that no API can verify, such as HR policies or physical procedures. Audit Manager handles these through manual evidence: you can upload documents and delegate control sets to the people who own them, so automated and manual evidence end up in the same assessment and the same report.

Do I need it in every account?
You designate an administrator account and include in-scope accounts in each assessment. The practical rule: any account that holds in-scope workloads must be in the assessment scope, and its evidence sources (Config, CloudTrail, Security Hub) must be enabled, or its controls will be silently under-evidenced.