AWS Audit Manager and Artifact

AWS Audit Manager

AWS Audit Manager is a service that allows us to audit our AWS resources and simplifies how we manage and assess risk in compliance with industry standards. It automates the process of collecting evidence, allowing us to ensure the policies, activities, and procedures we have created are working as expected.

It provides us with some prebuilt frameworks that include a set of testing procedures according to industry standards. We can then run assessments based on these frameworks, which collect data from our AWS resources and create audit-friendly reports.

Following are some of the main resources used in AWS Audit Manager.

Controls

In AWS Audit Manager, control refers to a set of measures and procedures defined to assess the environment of our AWS organization. It is created to protect our data and ensure a set of defined security requirements are met. By using a control, we have the surety that our resources are working as expected in accordance with the rules and regulations we have set up. There are two types of controls in Audit Manager:

• Standard controls: These are prebuilt controls associated with specific standard frameworks.

• Custom controls: These are customized controls built for our specific requirements.

Frameworks

In AWS Audit Manager, a framework is a file that determines which AWS resources will be tested in an environment to create audit reports. There are two types of frameworks supported in Audit Manager:

• Standard framework: These are prebuilt frameworks provided by AWS based on AWS best practices and can not be deleted or modified.

• Custom frameworks: We can create custom frameworks from scratch or build on an existing framework according to our requirements.

Assessments

In AWS Audit Manager, a framework is used to build an assessment, which is used to collect evidence and evaluate the effectiveness of the controls we use. Using an assessment, we can review the security and compliance posture of the resources inside our AWS account, identify the risk areas, and take appropriate actions against such resources.

An active assessment in AWS Audit Manager collects evidence from multiple sources over the scope defined in the assessment. The evidence includes the data captured from a resource and its metadata. AWS Audit Manager then collects and organizes this data into audit-ready reports.

AWS Artifact

AWS Artifact is a service that provides us with AWS security and compliance documents. These documents can be provided to auditors to monitor the security and compliance in our AWS infrastructure. We can access industry standards and regulations from a single point through this service.