{"id":313,"date":"2026-04-13T14:59:52","date_gmt":"2026-04-13T14:59:52","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/aws-audit-manager-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/"},"modified":"2026-04-13T14:59:52","modified_gmt":"2026-04-13T14:59:52","slug":"aws-audit-manager-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/aws-audit-manager-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/","title":{"rendered":"AWS Audit Manager Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Security, identity, and compliance"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Security, identity, and compliance<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>AWS Audit Manager is an AWS Security, identity, and compliance service that helps you continuously collect, organize, and present audit evidence for cloud workloads running on AWS.<\/p>\n\n\n\n<p>In simple terms: <strong>AWS Audit Manager automates the \u201cpaperwork\u201d of cloud audits<\/strong>. Instead of manually pulling screenshots, configuration exports, and logs from many AWS services, you define an assessment (based on a framework such as CIS or PCI-style requirements), and Audit Manager collects and organizes evidence over time.<\/p>\n\n\n\n<p>Technically: <strong>AWS Audit Manager builds an \u201cassessment\u201d from a \u201cframework\u201d (controls and control sets), automatically gathers evidence from supported AWS data sources (for example, AWS Config and AWS CloudTrail), stores evidence in an S3-based evidence store, and produces audit-ready reports<\/strong>. It integrates with AWS Organizations for multi-account environments and uses IAM and service roles to control who can manage assessments and access evidence.<\/p>\n\n\n\n<p>The problem it solves: audits and compliance reviews are expensive and disruptive when evidence is collected manually. Teams often scramble before an audit to prove that controls were in place historically. <strong>AWS Audit Manager reduces manual effort, improves evidence consistency, and supports continuous compliance practices<\/strong>\u2014especially in multi-account AWS environments.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is AWS Audit Manager?<\/h2>\n\n\n\n<p><strong>Official purpose (high-level):<\/strong> AWS Audit Manager helps you <strong>continuously audit your AWS usage<\/strong> by <strong>automating evidence collection<\/strong>, <strong>mapping evidence to controls<\/strong>, and <strong>generating assessment reports<\/strong> that auditors and internal risk teams can review. (Verify wording and the latest feature scope in official docs.)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Framework-based assessments:<\/strong> Create assessments using prebuilt frameworks or custom frameworks that represent your control requirements.<\/li>\n<li><strong>Automated evidence collection:<\/strong> Collect evidence from supported AWS services and resource metadata on a schedule.<\/li>\n<li><strong>Central evidence organization:<\/strong> Store and manage evidence in a dedicated evidence store (backed by Amazon S3 in your account).<\/li>\n<li><strong>Control status tracking:<\/strong> Track which controls have sufficient evidence and which require manual input or remediation.<\/li>\n<li><strong>Reporting:<\/strong> Generate assessment reports that package controls, evidence, and summaries for audit readiness.<\/li>\n<li><strong>Multi-account support:<\/strong> Integrate with <strong>AWS Organizations<\/strong> and use a <strong>delegated administrator<\/strong> model to manage assessments across accounts (common in enterprises).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (how the service is structured)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Framework:<\/strong> A set of requirements organized into control sets and controls. Frameworks can be AWS-managed (prebuilt) or customer-managed (custom).<\/li>\n<li><strong>Control set:<\/strong> A logical grouping of controls (for example, \u201cLogging and Monitoring\u201d).<\/li>\n<li><strong>Control:<\/strong> A specific requirement. Controls can map to evidence sources and\/or require manual evidence.<\/li>\n<li><strong>Assessment:<\/strong> An instantiated evaluation using a framework for a defined scope (accounts, services, resources) and time window.<\/li>\n<li><strong>Evidence:<\/strong> The collected artifacts (configuration snapshots, API activity history references, resource compliance states, etc.) mapped to controls.<\/li>\n<li><strong>Assessment report:<\/strong> An output artifact summarizing results and packaging evidence for review.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Managed AWS service<\/strong> focused on governance\/compliance automation.<\/li>\n<li>Exposes a <strong>console experience<\/strong> and <strong>APIs<\/strong> (and therefore AWS CLI support) for automation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scope: regional vs global<\/h3>\n\n\n\n<p>AWS Audit Manager is generally treated as a <strong>regional service<\/strong> (assessments and evidence live in a specific region). For organizations operating in multiple regions, you typically plan for <strong>region-by-region assessments<\/strong> or a strategy that matches your audit scope.<\/p>\n\n\n\n<p>Because AWS services evolve, verify the current region behavior and multi-region capabilities in the official documentation:\n&#8211; https:\/\/docs.aws.amazon.com\/audit-manager\/latest\/userguide\/what-is.html<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the AWS ecosystem<\/h3>\n\n\n\n<p>AWS Audit Manager sits \u201cabove\u201d foundational telemetry and configuration services:\n&#8211; <strong>AWS Config<\/strong>: often a key evidence source for resource configuration and compliance status.\n&#8211; <strong>AWS CloudTrail<\/strong>: often a key evidence source for API activity and governance trails.\n&#8211; <strong>AWS Organizations<\/strong>: used to scale evidence collection and assessments across multiple accounts with centralized governance.\n&#8211; <strong>AWS Artifact<\/strong>: complementary (not a replacement). Artifact provides AWS compliance reports (AWS\u2019s side). Audit Manager helps you collect <em>your<\/em> evidence (your side).\n&#8211; <strong>AWS Security Hub<\/strong> \/ <strong>AWS Control Tower<\/strong> \/ <strong>AWS Config Rules<\/strong>: complementary for control enforcement and detection; Audit Manager focuses on evidence collection and audit packaging.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use AWS Audit Manager?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce audit preparation time and cost:<\/strong> Automating evidence collection reduces repetitive manual work.<\/li>\n<li><strong>Improve audit consistency:<\/strong> Standardized frameworks and controls reduce \u201cwho gathered what, how\u201d variation.<\/li>\n<li><strong>Enable continuous compliance:<\/strong> Evidence accumulates over time, not just at audit deadlines.<\/li>\n<li><strong>Scale governance across accounts:<\/strong> Organizations-based environments can centralize audit operations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Structured mapping from controls to evidence:<\/strong> Controls and evidence are linked and trackable.<\/li>\n<li><strong>API-driven automation:<\/strong> Integrate assessment lifecycle into CI\/CD, ticketing, or GRC workflows (where appropriate).<\/li>\n<li><strong>Repeatable assessment patterns:<\/strong> Reuse frameworks and assessment configurations for consistent coverage.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Single place to review evidence:<\/strong> Instead of hunting across CloudTrail, Config, and console pages.<\/li>\n<li><strong>Separation of duties:<\/strong> Fine-grained IAM and delegated admin patterns support audit teams without giving broad admin access.<\/li>\n<li><strong>Report generation:<\/strong> Helps package results in an audit-friendly format.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Demonstrate control operation over time:<\/strong> Evidence is collected continuously (depending on source and configuration).<\/li>\n<li><strong>Supports common frameworks:<\/strong> AWS provides prebuilt frameworks (the exact list changes\u2014verify current availability in your region and account).<\/li>\n<li><strong>Improves traceability:<\/strong> Easier to show how evidence supports a given control requirement.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Designed for multi-account AWS environments:<\/strong> Especially relevant for enterprises and regulated workloads using AWS Organizations.<\/li>\n<li><strong>Managed service approach:<\/strong> You don\u2019t need to build and maintain a custom evidence collection system.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose AWS Audit Manager when:\n&#8211; You need <strong>repeatable, audit-ready evidence collection<\/strong> for AWS-hosted workloads.\n&#8211; You run <strong>multi-account environments<\/strong> and want centralized audit operations.\n&#8211; You want to reduce reliance on manual screenshots\/spreadsheets for audits.\n&#8211; You need a bridge between engineering telemetry (Config\/CloudTrail) and audit reporting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<p>Consider alternatives or complementary approaches when:\n&#8211; Your audit scope is mostly <strong>non-AWS<\/strong> (SaaS apps, on-prem, multiple clouds) and you need a unified cross-platform GRC tool. Audit Manager is AWS-focused.\n&#8211; You require <strong>full control enforcement<\/strong> and policy-as-code remediation as the primary goal. Audit Manager is primarily evidence and assessment reporting; enforcement typically uses AWS Config rules, SCPs, Control Tower guardrails, etc.\n&#8211; Your organization already has a mature GRC platform with automated connectors and audit workflows; Audit Manager may still help, but integration planning matters.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is AWS Audit Manager used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services (banking, payments, fintech)<\/li>\n<li>Healthcare and life sciences<\/li>\n<li>Government and public sector (where permitted)<\/li>\n<li>SaaS and technology companies pursuing SOC-style audits<\/li>\n<li>E-commerce and retail handling payment data<\/li>\n<li>Education and regulated research environments<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security engineering and security operations<\/li>\n<li>Compliance, risk, and internal audit teams<\/li>\n<li>Platform engineering \/ cloud center of excellence (CCoE)<\/li>\n<li>DevOps\/SRE teams supporting compliant infrastructure<\/li>\n<li>FinOps\/cost governance teams (as part of governance evidence)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Multi-account landing zones (e.g., Control Tower-style setups)<\/li>\n<li>Container platforms (EKS), serverless (Lambda), and traditional VM workloads (EC2)<\/li>\n<li>Data platforms (S3, RDS, Redshift, analytics stacks) where controls require logging, encryption, access reviews, and change management evidence<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Centralized logging and security accounts + workload accounts<\/li>\n<li>Organizations with SCPs and standard guardrails<\/li>\n<li>Event-driven governance patterns where evidence and compliance checks are automated<\/li>\n<li>Regulated environments with strict audit trails and least privilege<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>External audits:<\/strong> SOC 2-type audits, PCI-style reviews, ISO-style audits (framework availability varies\u2014verify).<\/li>\n<li><strong>Internal controls testing:<\/strong> quarterly control checks or continuous monitoring.<\/li>\n<li><strong>Mergers\/acquisitions:<\/strong> standardizing evidence across newly acquired AWS accounts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production:<\/strong> Most valuable in production because evidence must represent real operational controls.<\/li>\n<li><strong>Dev\/test:<\/strong> Useful to validate that your landing zone and baseline controls produce expected evidence before rolling into production.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic, AWS-aligned scenarios where AWS Audit Manager is typically a good fit.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) SOC-style readiness for a SaaS product<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams need recurring evidence that logging, access controls, and change management are in place.<\/li>\n<li><strong>Why AWS Audit Manager fits:<\/strong> Framework-based continuous evidence collection reduces manual work during each audit cycle.<\/li>\n<li><strong>Example:<\/strong> A SaaS company runs workloads in multiple AWS accounts and needs quarterly evidence snapshots for an external auditor.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) PCI-oriented evidence collection for payment workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Payment-related systems require strict logging, encryption, and access monitoring evidence.<\/li>\n<li><strong>Why it fits:<\/strong> Audit Manager can map AWS telemetry (Config\/CloudTrail and other sources) to PCI-like control expectations (framework availability varies).<\/li>\n<li><strong>Example:<\/strong> A retail platform uses separate accounts for cardholder-data environments and needs repeatable evidence for reviews.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) CIS AWS Foundations Benchmark tracking<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Security teams need proof that baseline account-level security controls are configured and monitored.<\/li>\n<li><strong>Why it fits:<\/strong> Prebuilt CIS-style frameworks are commonly provided by AWS Audit Manager (verify current version availability).<\/li>\n<li><strong>Example:<\/strong> An enterprise security team runs monthly assessments across OU-scoped accounts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Multi-account governance for a landing zone<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Central governance needs consistent evidence across many accounts.<\/li>\n<li><strong>Why it fits:<\/strong> Integration with AWS Organizations supports scaled assessment management.<\/li>\n<li><strong>Example:<\/strong> A platform team uses a delegated admin account to manage assessments across 200+ workload accounts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Continuous evidence collection for incident response preparedness<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> After incidents, teams must prove what controls existed at the time.<\/li>\n<li><strong>Why it fits:<\/strong> Evidence is collected over time, improving historical traceability.<\/li>\n<li><strong>Example:<\/strong> Post-incident review requires demonstrating CloudTrail and logging configurations were continuously enabled.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Internal audit automation for quarterly control testing<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Internal audit requests periodic evidence that specific controls operated effectively.<\/li>\n<li><strong>Why it fits:<\/strong> Scheduled evidence collection and structured reporting streamline quarterly testing.<\/li>\n<li><strong>Example:<\/strong> Internal audit runs an assessment every quarter and generates a report package.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Governance evidence for encryption and key management posture<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Need to prove encryption at rest and proper key policies for sensitive data services.<\/li>\n<li><strong>Why it fits:<\/strong> Evidence collection can capture resource configurations and relevant metadata (depending on supported sources).<\/li>\n<li><strong>Example:<\/strong> A healthcare analytics workload uses S3 and RDS; auditors require proof of encryption and access controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Control validation during cloud migration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Migrating to AWS requires demonstrating that controls are implemented in the target environment.<\/li>\n<li><strong>Why it fits:<\/strong> Create a \u201cmigration readiness\u201d assessment and track evidence as workloads move.<\/li>\n<li><strong>Example:<\/strong> A manufacturing company migrates ERP components to AWS and needs evidence for governance approvals.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Standardized evidence packaging for external auditors<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Auditors request evidence in a consistent, reviewable structure.<\/li>\n<li><strong>Why it fits:<\/strong> Assessment reports provide organized control\/evidence mapping.<\/li>\n<li><strong>Example:<\/strong> A security lead generates a report covering a 3-month period for an audit window.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Compliance support for regulated data lakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Data lakes spread across many buckets and accounts need consistent logging, access control, and lifecycle governance evidence.<\/li>\n<li><strong>Why it fits:<\/strong> Audit Manager helps map evidence sources to data governance controls (enforcement still requires Config\/SCPs\/etc.).<\/li>\n<li><strong>Example:<\/strong> A data platform team runs an assessment for the analytics OU and exports a report for governance review.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) M&amp;A: normalizing evidence across inherited accounts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Acquired AWS accounts have inconsistent logging and governance; evidence is hard to standardize quickly.<\/li>\n<li><strong>Why it fits:<\/strong> Apply a single framework to new accounts to quickly identify evidence gaps.<\/li>\n<li><strong>Example:<\/strong> A company acquires a smaller business and runs baseline assessments across the new OU.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Preparing for a customer security review<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Large customers demand security evidence as part of vendor due diligence.<\/li>\n<li><strong>Why it fits:<\/strong> Audit Manager helps assemble consistent evidence packages faster.<\/li>\n<li><strong>Example:<\/strong> A B2B SaaS vendor needs to respond to a security questionnaire and produce supporting evidence.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Feature availability can vary by region and account. Verify in official docs for your environment.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Prebuilt frameworks (AWS-managed)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides ready-to-use frameworks aligned with common compliance programs and best-practice benchmarks.<\/li>\n<li><strong>Why it matters:<\/strong> You can start quickly without designing controls from scratch.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster setup for common audit needs.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Framework list and versions can vary; confirm what\u2019s available in your region in the Audit Manager console\/docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Custom frameworks and custom controls<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you create your own frameworks and controls to match internal policies or specific auditor requirements.<\/li>\n<li><strong>Why it matters:<\/strong> Real audits often require organization-specific controls beyond generic benchmarks.<\/li>\n<li><strong>Practical benefit:<\/strong> Adapt to custom policy language while still leveraging automated evidence collection where possible.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Custom control design requires careful mapping to objective evidence sources; otherwise, you may end up with manual evidence tasks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Automated evidence collection from AWS data sources<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Collects evidence automatically from supported AWS services (commonly including AWS Config and AWS CloudTrail; other supported sources exist\u2014verify current list).<\/li>\n<li><strong>Why it matters:<\/strong> Reduces human effort and improves consistency.<\/li>\n<li><strong>Practical benefit:<\/strong> Continuous evidence capture for recurring audits.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Evidence quality depends on correct configuration of source services (e.g., Config recorders, CloudTrail trails). Some controls may still require manual evidence.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Manual evidence collection workflows<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you attach manual evidence to controls when automation can\u2019t cover it (e.g., HR policies, access review sign-offs, exception approvals).<\/li>\n<li><strong>Why it matters:<\/strong> Most compliance programs include non-technical controls.<\/li>\n<li><strong>Practical benefit:<\/strong> Centralizes both technical and process evidence.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Manual evidence is only as reliable as your process; define ownership and review cadence.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Assessment scope definition (accounts, services, resources)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Configure what the assessment covers, including account scope (often via AWS Organizations), and which AWS services\/resources should be included.<\/li>\n<li><strong>Why it matters:<\/strong> Audits have explicit boundaries; scope creep increases cost and complexity.<\/li>\n<li><strong>Practical benefit:<\/strong> Aligns evidence collection to the audit boundary.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> If you underscope, you may miss required evidence; if you overscope, you\u2019ll collect noise and increase costs (including costs from underlying services).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Evidence store (S3-backed) and evidence lifecycle<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Stores collected evidence artifacts in an evidence store typically backed by Amazon S3 in your account.<\/li>\n<li><strong>Why it matters:<\/strong> Provides durable storage and a single source of truth for audit evidence.<\/li>\n<li><strong>Practical benefit:<\/strong> Evidence persistence across audit windows and teams.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> S3 storage and any KMS usage can incur costs; evidence retention policies should be planned to match compliance and data minimization.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Delegated administrator model (AWS Organizations)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows a designated account to administer Audit Manager across the organization (instead of only the management account).<\/li>\n<li><strong>Why it matters:<\/strong> Supports separation of duties and operational scalability.<\/li>\n<li><strong>Practical benefit:<\/strong> Central compliance team can manage assessments without broad admin access in every account.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Requires Organizations setup and appropriate permissions\/SCP allowances.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Assessment reports<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Generates downloadable reports summarizing controls, evidence status, and details suitable for audit review.<\/li>\n<li><strong>Why it matters:<\/strong> Auditors want structured evidence packages.<\/li>\n<li><strong>Practical benefit:<\/strong> Reduces ad-hoc export and screenshot activity.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Reports reflect what\u2019s in the assessment; if controls aren\u2019t mapped properly or evidence sources are misconfigured, reports will show gaps.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Search and evidence finder (evidence exploration)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Helps locate and filter evidence items by control, date range, resource, and other metadata.<\/li>\n<li><strong>Why it matters:<\/strong> Audits often require answering targeted follow-up questions quickly.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster auditor responses.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Search effectiveness depends on evidence metadata richness and consistent assessment configuration.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) API\/CLI support for automation<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Programmatically manage frameworks, assessments, and reporting.<\/li>\n<li><strong>Why it matters:<\/strong> Enables Infrastructure as Code (IaC) adjacent workflows and repeatable governance.<\/li>\n<li><strong>Practical benefit:<\/strong> Standardized assessment setup across environments.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Not every console action is always available in APIs exactly the same way; confirm in API reference.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level service architecture<\/h3>\n\n\n\n<p>At a high level, AWS Audit Manager sits in the governance layer:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>You select or build a <strong>framework<\/strong> (controls\/control sets).<\/li>\n<li>You create an <strong>assessment<\/strong> and define scope (accounts\/regions\/services).<\/li>\n<li>Audit Manager uses permissions (including a service role) to pull evidence from supported AWS sources.<\/li>\n<li>Evidence is stored in an <strong>S3-backed evidence store<\/strong> in your account.<\/li>\n<li>You review control status, add manual evidence where needed, and generate reports.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Data flow vs control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control flow (management plane):<\/strong> Users\/admins interact with Audit Manager via AWS Console, API, or CLI to create frameworks\/assessments and generate reports.<\/li>\n<li><strong>Data flow (evidence plane):<\/strong> Audit Manager pulls evidence metadata\/artifacts from AWS services and stores them in your evidence store.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services (common patterns)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Config:<\/strong> Configuration history and compliance states (depends on your Config setup and rules).<\/li>\n<li><strong>AWS CloudTrail:<\/strong> API activity evidence for governance and change tracking.<\/li>\n<li><strong>AWS Organizations:<\/strong> Account and OU scoping; delegated administrator.<\/li>\n<li><strong>AWS IAM:<\/strong> Access control to the Audit Manager APIs and evidence.<\/li>\n<li><strong>Amazon S3:<\/strong> Storage for evidence and reports.<\/li>\n<li><strong>AWS KMS:<\/strong> Encryption key management for S3-based evidence\/report encryption (if configured).<\/li>\n<li><strong>AWS CloudWatch \/ CloudTrail (for Audit Manager API calls):<\/strong> Monitor and audit who changed assessments and frameworks.<\/li>\n<\/ul>\n\n\n\n<p>Because supported evidence sources can evolve, verify the latest supported services in:\n&#8211; https:\/\/docs.aws.amazon.com\/audit-manager\/latest\/userguide\/what-is.html<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services (what typically must exist)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CloudTrail<\/strong> is commonly required for auditability in general, and often provides essential evidence.<\/li>\n<li><strong>AWS Config<\/strong> is commonly used as an evidence source for control checks and resource configuration history.<\/li>\n<li><strong>S3<\/strong> is used for evidence storage; ensure your S3 controls align with your compliance obligations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>IAM permissions<\/strong> control who can administer Audit Manager, create\/modify assessments, view evidence, and generate reports.<\/li>\n<li>Audit Manager typically uses a <strong>service-linked role<\/strong> (or AWS-managed service role) to access evidence sources and store evidence. Confirm the exact role name and permissions in your account\/region (AWS documents the service-linked role behavior).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Audit Manager is accessed through AWS service endpoints over HTTPS.<\/li>\n<li>Evidence is stored in S3; access is governed by IAM and S3 bucket policies.<\/li>\n<li>If you require private connectivity, check whether Audit Manager supports <strong>VPC interface endpoints (AWS PrivateLink)<\/strong> in your region. If not documented, assume <strong>public service endpoints<\/strong> with strong IAM controls and egress controls. <strong>Verify in official docs<\/strong> for endpoint support.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>AWS CloudTrail<\/strong> to log Audit Manager API activity (who created assessments, generated reports, changed frameworks).<\/li>\n<li>Use <strong>S3 access logs or CloudTrail data events<\/strong> (as appropriate) to monitor evidence bucket access (evaluate cost implications).<\/li>\n<li>Apply <strong>SCPs<\/strong> (Organizations) and least-privilege IAM to prevent disabling evidence sources (e.g., Config\/CloudTrail) in audited accounts.<\/li>\n<li>Consider <strong>tagging<\/strong> assessments\/frameworks and using naming conventions to map them to audit periods and business units.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  User[Audit\/Compliance User] --&gt;|Console\/API| AM[AWS Audit Manager]\n  AM --&gt;|Collect evidence| CT[AWS CloudTrail]\n  AM --&gt;|Collect evidence| CFG[AWS Config]\n  AM --&gt;|Store evidence| S3[(S3 Evidence Store)]\n  AM --&gt;|Generate| RPT[Assessment Report]\n  RPT --&gt; S3\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Org[AWS Organizations]\n    MA[Management Account]\n    DA[Delegated Admin Account\\n(Audit Manager Admin)]\n    subgraph OUs[Organizational Units]\n      A1[Workload Account A]\n      A2[Workload Account B]\n      A3[Shared Services Account]\n    end\n  end\n\n  subgraph Region1[Region: Primary]\n    AM[AWS Audit Manager]\n    S3[(Central Evidence Store\\nS3 Bucket)]\n    KMS[AWS KMS Key]\n    CT[Organization CloudTrail\\n(or per-account trails)]\n    CFG[AWS Config Recorders\\n+ Rules]\n  end\n\n  DA --&gt;|Administer assessments| AM\n  AM --&gt;|Assesses scope| A1\n  AM --&gt;|Assesses scope| A2\n  AM --&gt;|Assesses scope| A3\n\n  AM --&gt;|Evidence sources| CT\n  AM --&gt;|Evidence sources| CFG\n\n  AM --&gt;|Write evidence| S3\n  S3 --&gt;|Encrypt| KMS\n\n  subgraph Governance[Governance &amp; Monitoring]\n    IAM[IAM + SCP Guardrails]\n    Trail[CloudTrail Logs for Audit Manager API Calls]\n    SIEM[Security Analytics \/ SIEM\\n(optional)]\n  end\n\n  AM --&gt; Trail\n  IAM -. controls .-&gt; AM\n  IAM -. controls .-&gt; S3\n  Trail --&gt; SIEM\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">AWS account and org requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An <strong>AWS account<\/strong> with billing enabled.<\/li>\n<li>Optional but strongly recommended for multi-account: <strong>AWS Organizations<\/strong>.<\/li>\n<li>If using delegated administration: ability to register a <strong>delegated administrator<\/strong> for AWS Audit Manager in Organizations (verify the exact procedure in current docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>You need IAM permissions to:\n&#8211; Enable and administer AWS Audit Manager (service permissions such as <code>auditmanager:*<\/code> or scoped equivalents).\n&#8211; Create\/read assessments and generate reports.\n&#8211; Access underlying evidence sources as needed (Audit Manager may use service-linked roles, but your users still need access to view results).\n&#8211; Read\/write to the S3 evidence store (usually handled by the service role; users need read access if they download reports).<\/p>\n\n\n\n<p>Practical minimum for the lab:\n&#8211; Use an admin-like role in a sandbox account, or a role with the documented permissions for Audit Manager + Config + CloudTrail setup.<\/p>\n\n\n\n<p>Always validate least-privilege in production.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Audit Manager has direct service pricing.<\/li>\n<li>Evidence sources (notably <strong>AWS Config<\/strong> and <strong>CloudTrail<\/strong>) can also generate charges.<\/li>\n<li>S3 storage and KMS requests (if using SSE-KMS) can also add cost.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">CLI\/SDK\/tools needed<\/h3>\n\n\n\n<p>For the hands-on lab, you can use the console only. Optional tools:\n&#8211; <strong>AWS CLI v2<\/strong> (recommended) for verification:\n  &#8211; https:\/\/docs.aws.amazon.com\/cli\/latest\/userguide\/getting-started-install.html\n&#8211; A terminal with credentials configured:\n  &#8211; <code>aws configure<\/code> or SSO-based credentials (recommended for enterprises)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Audit Manager is not available in every region. Confirm region support in your target region:<\/li>\n<li>https:\/\/aws.amazon.com\/audit-manager\/ (region info may be present)<\/li>\n<li>Or verify in the AWS Console region selector.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Audit Manager has service quotas (for example: number of assessments, frameworks, evidence retention constraints, or API rate limits).<\/li>\n<li>Check <strong>Service Quotas<\/strong> for AWS Audit Manager:<\/li>\n<li>https:\/\/docs.aws.amazon.com\/servicequotas\/latest\/userguide\/intro.html  <\/li>\n<li>Then locate Audit Manager quotas in your account\/region.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services (recommended for realistic evidence)<\/h3>\n\n\n\n<p>To see meaningful automated evidence, you typically want:\n&#8211; <strong>AWS CloudTrail<\/strong> enabled (ideally organization-wide where applicable).\n&#8211; <strong>AWS Config<\/strong> enabled in the accounts\/regions you assess.<\/p>\n\n\n\n<p>If you do not enable these, your assessment may have limited automated evidence and require more manual evidence.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>AWS Audit Manager pricing can change and can be region-specific. Always confirm:\n&#8211; Official pricing page: https:\/\/aws.amazon.com\/audit-manager\/pricing\/\n&#8211; AWS Pricing Calculator: https:\/\/calculator.aws\/#\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (how you\u2019re charged)<\/h3>\n\n\n\n<p>Audit Manager pricing is typically based on <strong>usage dimensions such as the number of active assessments<\/strong> and possibly <strong>the number of accounts in scope<\/strong> (especially in Organizations contexts). The exact billable dimensions and units must be confirmed on the pricing page for your region.<\/p>\n\n\n\n<p>Key point: <strong>Audit Manager cost is usually predictable if you control how many assessments are active and how broad their scope is.<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier<\/h3>\n\n\n\n<p>Audit Manager is not generally known for a large always-free tier like some services. AWS sometimes offers trials or promotional periods. <strong>Verify current free tier\/trial status on the pricing page<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Direct cost drivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Number of active assessments<\/strong> (and how long they remain active)<\/li>\n<li><strong>Number of in-scope accounts<\/strong> (for org-wide assessments)<\/li>\n<li><strong>Frequency and volume of evidence collection<\/strong> (depends on framework\/control design)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Indirect\/hidden costs (often larger than Audit Manager itself)<\/h3>\n\n\n\n<p>These are commonly the real cost drivers:\n&#8211; <strong>AWS Config<\/strong>: configuration item recording, compliance evaluations, and rules can incur costs.\n&#8211; <strong>AWS CloudTrail<\/strong>:\n  &#8211; Management events are often logged to S3 with S3 storage costs.\n  &#8211; Data events (S3 object-level, Lambda invoke events) can significantly increase costs if enabled broadly.\n&#8211; <strong>Amazon S3<\/strong>: evidence store storage, report storage, and request costs.\n&#8211; <strong>AWS KMS<\/strong>: if using SSE-KMS for evidence bucket encryption, KMS request costs may apply.\n&#8211; <strong>Log aggregation\/analytics<\/strong>: if you export or analyze evidence\/logs in SIEM tools (CloudWatch Logs, OpenSearch, third-party), costs can grow.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Most evidence collection occurs within AWS control plane interactions. S3 storage is in-region; data transfer is usually not a major line item unless you:<\/li>\n<li>Download large reports frequently across regions<\/li>\n<li>Export evidence to external systems or cross-region destinations<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Minimize active assessments<\/strong>: keep only required assessments active; archive\/close when the audit window ends.<\/li>\n<li><strong>Scope intentionally<\/strong>: select only the accounts\/regions\/services relevant to the audit boundary.<\/li>\n<li><strong>Tune AWS Config<\/strong>:<\/li>\n<li>Record only necessary resource types if allowed by your compliance requirements.<\/li>\n<li>Be deliberate with Config rules and evaluation frequency.<\/li>\n<li><strong>Be careful with CloudTrail data events<\/strong>: enable only where required.<\/li>\n<li><strong>S3 lifecycle policies<\/strong>: transition evidence\/report objects to cheaper storage classes if compliance allows (review retention requirements first).<\/li>\n<li><strong>Use KMS thoughtfully<\/strong>: SSE-S3 vs SSE-KMS is a compliance decision; SSE-KMS can add request costs but provides tighter key control.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (conceptual)<\/h3>\n\n\n\n<p>A starter lab environment cost usually comes from:\n&#8211; Keeping <strong>one assessment<\/strong> active briefly\n&#8211; Minimal AWS Config footprint\n&#8211; A basic CloudTrail trail writing to S3 for a short period\n&#8211; Small S3 evidence storage<\/p>\n\n\n\n<p>Because exact rates vary by region and change over time, <strong>use the AWS Pricing Calculator<\/strong> and measure with <strong>Cost Explorer<\/strong>. If you keep the lab under a day and delete resources, costs are typically low\u2014but still not zero.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, expect costs to be driven by:\n&#8211; Multiple assessments (per audit program, per business unit, per region)\n&#8211; Large AWS Organizations scope (many accounts)\n&#8211; AWS Config at scale (many resource types, many regions)\n&#8211; CloudTrail data event logging (if required for compliance)\n&#8211; Long retention periods for evidence and logs<\/p>\n\n\n\n<p>A practical approach is to start with:\n1) one baseline framework (e.g., CIS-style) across core accounts,<br\/>\n2) add targeted assessments for specific regulated workloads,<br\/>\n3) then expand evidence depth only where auditors require it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab is designed to be executable in a sandbox AWS account with minimal but realistic setup. It focuses on creating an assessment, ensuring evidence sources are available, reviewing evidence, generating a report, and cleaning up.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Create an <strong>AWS Audit Manager assessment<\/strong> using a <strong>prebuilt framework<\/strong>, collect <strong>automated evidence<\/strong> (via AWS Config and CloudTrail), and generate an <strong>assessment report<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Choose a region and verify AWS Audit Manager availability.\n2. Enable or confirm <strong>AWS CloudTrail<\/strong> and <strong>AWS Config<\/strong> (basic configuration).\n3. Enable AWS Audit Manager and set up its evidence store settings (if prompted).\n4. Create an assessment using a prebuilt framework (for example, CIS-style; exact names vary).\n5. Review controls and evidence collection status.\n6. Generate an assessment report.\n7. Validate via the console and optional AWS CLI.\n8. Clean up resources to avoid ongoing charges.<\/p>\n\n\n\n<blockquote>\n<p>Notes:\n&#8211; Console screens change over time. Use the described intent if wording differs.\n&#8211; If a prebuilt framework name differs in your region, pick the closest baseline security framework available and proceed.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Pick a region and verify service availability<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in to the <strong>AWS Management Console<\/strong>.<\/li>\n<li>Select a region where <strong>AWS Audit Manager<\/strong> is available (for example, a common commercial region).<\/li>\n<li>Navigate to <strong>AWS Audit Manager<\/strong>:\n   &#8211; Search for \u201cAudit Manager\u201d in the console search bar.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You can open the AWS Audit Manager console without region\/availability errors. If the service isn\u2019t available, switch regions.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You should see the Audit Manager landing page with options such as <strong>Assessments<\/strong>, <strong>Frameworks<\/strong>, and <strong>Controls<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Ensure AWS CloudTrail is enabled (basic trail)<\/h3>\n\n\n\n<p>Audit evidence is stronger if CloudTrail is enabled.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>CloudTrail<\/strong> in the console.<\/li>\n<li>If you already have a trail that logs management events, you can keep it.<\/li>\n<li>If you do not have a trail:\n   &#8211; Create a new trail.\n   &#8211; Choose an S3 bucket (CloudTrail can create one).\n   &#8211; Ensure <strong>management events<\/strong> are enabled.\n   &#8211; For a low-cost lab, avoid enabling broad <strong>data events<\/strong> unless you need them.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> CloudTrail is logging management events to S3.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In CloudTrail, check the trail status and confirm logging is <strong>ON<\/strong>.\n&#8211; Optionally, generate an event (e.g., view an S3 bucket list) and confirm CloudTrail \u201cEvent history\u201d shows recent events.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Enable AWS Config (basic recorder)<\/h3>\n\n\n\n<p>AWS Config is commonly used to provide configuration evidence.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Navigate to <strong>AWS Config<\/strong> console in the same region.<\/li>\n<li>If AWS Config is not set up:\n   &#8211; Choose <strong>Set up AWS Config<\/strong>.\n   &#8211; Enable recording.\n   &#8211; Choose an S3 bucket for configuration snapshots (Config can create one).\n   &#8211; Keep defaults suitable for a lab if you\u2019re unsure.<\/li>\n<li>If AWS Config is already set up, confirm the recorder is running.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> AWS Config recorder is <strong>ON<\/strong> and delivering to S3.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In AWS Config, confirm <strong>Recording<\/strong> is enabled.\n&#8211; View <strong>Resources<\/strong> in Config and confirm it is discovering resources.<\/p>\n\n\n\n<blockquote>\n<p>Cost note: AWS Config charges can accrue while recording is enabled. If this is a sandbox lab, plan to disable it during cleanup.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Enable AWS Audit Manager and configure settings (if prompted)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Return to <strong>AWS Audit Manager<\/strong> console.<\/li>\n<li>If this is your first time, you may be asked to configure:\n   &#8211; <strong>Evidence storage<\/strong> location (S3)\n   &#8211; <strong>Encryption<\/strong> settings (possibly AWS KMS key selection)\n   &#8211; Optional notifications\/settings depending on current product behavior<\/li>\n<\/ol>\n\n\n\n<p>Choose defaults suitable for a lab, but record what you select.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> AWS Audit Manager is initialized and ready to create assessments.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You can browse <strong>Frameworks<\/strong> and <strong>Controls<\/strong> pages.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Create an assessment using a prebuilt framework<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In AWS Audit Manager, go to <strong>Assessments<\/strong> \u2192 <strong>Create assessment<\/strong>.<\/li>\n<li>Choose <strong>Use a framework<\/strong> and select a <strong>prebuilt<\/strong> framework.\n   &#8211; Commonly available examples include CIS-style or PCI-style frameworks, but names vary.<br\/>\n   &#8211; If you see \u201cCIS AWS Foundations Benchmark\u201d (or similar), it\u2019s a good baseline choice for this lab. Otherwise pick a baseline security framework available in your region.<\/li>\n<li>Configure assessment details:\n   &#8211; <strong>Name:<\/strong> <code>lab-auditmanager-baseline<\/code>\n   &#8211; <strong>Description:<\/strong> <code>Baseline evidence collection lab<\/code>\n   &#8211; <strong>Assessment report destination:<\/strong> keep default or choose your preferred S3 destination if prompted\n   &#8211; <strong>Scope:<\/strong> for this lab, keep it to the current account and region<\/li>\n<li>Review and create the assessment.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> The assessment is created and begins collecting evidence.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Open the assessment and check:\n  &#8211; Status indicates it is active\/in progress.\n  &#8211; Controls show evidence collection states (some may populate quickly; some may take time).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Review controls and evidence status<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the assessment.<\/li>\n<li>Navigate through <strong>Control sets<\/strong> and pick a control that is likely to have automated evidence (logging\/configuration-related controls are common).<\/li>\n<li>Open the control and review:\n   &#8211; Evidence list (items may appear as they are collected)\n   &#8211; Any notes about evidence source (for example, Config\/CloudTrail references)<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You can see controls with evidence items or at least evidence collection configured. Some controls may show \u201cmanual evidence required\u201d.<\/p>\n\n\n\n<p><strong>Verification tips:<\/strong>\n&#8211; If evidence is empty initially, wait 15\u201360 minutes depending on your environment and evidence source timing.\n&#8211; Generate a few AWS API actions (e.g., list IAM users, view S3 buckets) to ensure CloudTrail has events.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7 (Optional): Verify via AWS CLI<\/h3>\n\n\n\n<p>If you have AWS CLI configured:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Confirm you can call Audit Manager:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">aws --version\naws auditmanager list-assessments --max-results 10\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li>Find your assessment ID from the output, then retrieve details:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">aws auditmanager get-assessment --assessment-id &lt;ASSESSMENT_ID&gt;\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> CLI returns your assessment metadata.<\/p>\n\n\n\n<p><strong>Common issue:<\/strong> AccessDenied means your IAM principal lacks Audit Manager permissions. Use a role with appropriate permissions for the lab.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Generate an assessment report<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the assessment view, select <strong>Generate report<\/strong> (wording may vary).<\/li>\n<li>Choose a report name like <code>lab-auditmanager-report<\/code>.<\/li>\n<li>Start report generation.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> A report generation job completes and the report is available for download or stored in the configured S3 location.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In the assessment, find the <strong>Reports<\/strong> tab\/section and confirm the report status is <strong>Completed<\/strong>.\n&#8211; Download the report and confirm it contains control summaries and evidence references.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>You have successfully completed the lab if:\n&#8211; AWS CloudTrail is enabled and logging.\n&#8211; AWS Config is recording resources.\n&#8211; AWS Audit Manager assessment <code>lab-auditmanager-baseline<\/code> exists and shows control sets\/controls.\n&#8211; At least some controls display evidence items or clearly indicate collection status.\n&#8211; You generated and accessed an assessment report.<\/p>\n\n\n\n<p>A practical validation checklist:\n&#8211; CloudTrail \u2192 Event history shows recent events.\n&#8211; Config \u2192 Recording is on; resources are visible.\n&#8211; Audit Manager \u2192 Assessment exists; report exists.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p><strong>Issue: Audit Manager not available in my region<\/strong>\n&#8211; Switch to a supported region and retry.\n&#8211; Confirm region availability in official docs and the console.<\/p>\n\n\n\n<p><strong>Issue: No evidence is being collected<\/strong>\n&#8211; Confirm AWS Config recorder is <strong>ON<\/strong> in the same region as the assessment.\n&#8211; Confirm CloudTrail logging is <strong>ON<\/strong>.\n&#8211; Wait for collection intervals; some evidence does not appear instantly.\n&#8211; Verify the assessment scope includes the current account\/region.<\/p>\n\n\n\n<p><strong>Issue: AccessDenied in console or CLI<\/strong>\n&#8211; Confirm your IAM permissions include Audit Manager actions.\n&#8211; In org environments, confirm SCPs aren\u2019t blocking Audit Manager or underlying evidence sources.<\/p>\n\n\n\n<p><strong>Issue: Report generation fails<\/strong>\n&#8211; Check if an S3 destination is configured and accessible.\n&#8211; Check KMS key permissions if SSE-KMS is used.\n&#8211; Review CloudTrail for errors related to S3\/KMS access.<\/p>\n\n\n\n<p><strong>Issue: Unexpected costs<\/strong>\n&#8211; AWS Config and CloudTrail (especially data events) can add cost quickly.\n&#8211; Use Cost Explorer to identify which service increased spend.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing charges, clean up in this order:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Delete the assessment<\/strong> in AWS Audit Manager:\n   &#8211; Audit Manager \u2192 Assessments \u2192 select <code>lab-auditmanager-baseline<\/code> \u2192 Delete<\/p>\n<\/li>\n<li>\n<p><strong>Delete generated reports<\/strong> (if they remain stored in S3):\n   &#8211; Locate the report destination bucket\/prefix and delete the report objects (only if allowed by your retention policies).<\/p>\n<\/li>\n<li>\n<p><strong>Disable AWS Config<\/strong> (if you enabled it only for this lab):\n   &#8211; AWS Config \u2192 Settings \u2192 Stop recording<br\/>\n   &#8211; Consider deleting the Config S3 bucket if it was created for the lab and you don\u2019t need it.<\/p>\n<\/li>\n<li>\n<p><strong>Disable or delete the CloudTrail trail<\/strong> (if created only for the lab):\n   &#8211; CloudTrail \u2192 Trails \u2192 delete the trail (and optionally delete its S3 bucket if dedicated to the lab)<\/p>\n<\/li>\n<li>\n<p><strong>Review S3 buckets<\/strong> created:\n   &#8211; Evidence store bucket and any logging\/config buckets\n   &#8211; Apply lifecycle or delete if appropriate for a sandbox<\/p>\n<\/li>\n<li>\n<p><strong>Review KMS keys<\/strong> (if you created a dedicated CMK for the lab):\n   &#8211; Schedule deletion if no longer needed (KMS keys cannot be immediately deleted).<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Design assessments around audit boundaries:<\/strong> Map assessments to a specific scope (OU\/account set, region set, workload boundary, and audit period).<\/li>\n<li><strong>Use multiple assessments rather than one giant assessment:<\/strong> Smaller assessments are easier to review, delegate, and report on.<\/li>\n<li><strong>Treat frameworks as versioned artifacts:<\/strong> When auditor requirements change, create a new framework version rather than editing in place (supports audit traceability).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Use least privilege:<\/strong> Separate roles for:<\/li>\n<li>Audit Manager administrators (framework\/assessment creation)<\/li>\n<li>Evidence reviewers (read-only)<\/li>\n<li>Report generators (if different)<\/li>\n<li><strong>Use AWS Organizations SCPs<\/strong> to prevent disabling key evidence sources (Config\/CloudTrail) in in-scope accounts.<\/li>\n<li><strong>Use delegated admin<\/strong> for central governance instead of using the Organizations management account for day-to-day operations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Keep only necessary assessments active.<\/strong><\/li>\n<li><strong>Right-size AWS Config usage<\/strong>: record what you need; avoid unnecessary rules in every region unless required.<\/li>\n<li><strong>Be intentional with CloudTrail data events<\/strong>: enable narrowly.<\/li>\n<li><strong>Apply S3 lifecycle policies<\/strong> to evidence\/report buckets where retention rules allow.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Avoid excessive scope:<\/strong> collecting evidence for unnecessary accounts\/services increases noise and operational overhead.<\/li>\n<li><strong>Use consistent tagging and naming:<\/strong> helps filter and search evidence and reports quickly.<\/li>\n<li><strong>Schedule governance work:<\/strong> assign owners to review evidence gaps periodically rather than letting backlog build.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Ensure evidence sources are resilient:<\/strong> organization-wide CloudTrail and standardized Config setup reduce gaps.<\/li>\n<li><strong>Centralize logging and evidence storage thoughtfully:<\/strong> ensure buckets are protected and monitored; consider cross-account patterns for separation of duties where appropriate.<\/li>\n<li><strong>Back up critical governance artifacts:<\/strong> store reports appropriately and apply retention controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Operationalize control gaps:<\/strong> integrate findings into ticketing (Jira\/ServiceNow) or incident management processes.<\/li>\n<li><strong>Document exceptions:<\/strong> if a control is not applicable, record rationale and approvals as manual evidence.<\/li>\n<li><strong>Monitor changes to frameworks:<\/strong> track changes and align to audit cycle timing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Name assessments with:<\/li>\n<li>Program (SOC2\/PCI\/CIS\/internal)<\/li>\n<li>Scope (OU or account group)<\/li>\n<li>Region<\/li>\n<li>Period (e.g., <code>2026-Q1<\/code>)<\/li>\n<li>Tag assessments and related S3 buckets with:<\/li>\n<li><code>Owner<\/code>, <code>Program<\/code>, <code>DataClassification<\/code>, <code>Retention<\/code>, <code>CostCenter<\/code><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Audit Manager is controlled via <strong>IAM<\/strong>.<\/li>\n<li>Prefer:<\/li>\n<li>SSO-integrated roles (AWS IAM Identity Center) for workforce access<\/li>\n<li>Minimal permissions for evidence readers<\/li>\n<li>Use CloudTrail to audit:<\/li>\n<li>Who created or modified assessments\/frameworks<\/li>\n<li>Who generated reports<\/li>\n<li>Who accessed evidence buckets (consider S3 data event logging selectively due to cost)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Evidence and reports are stored in S3; ensure encryption is enabled:<\/li>\n<li>SSE-S3 or SSE-KMS depending on policy requirements<\/li>\n<li>If using SSE-KMS:<\/li>\n<li>Ensure KMS key policies allow required service access and authorized humans to decrypt for review.<\/li>\n<li>Consider key rotation and separation of duties.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Access occurs via AWS service endpoints.<\/li>\n<li>Reduce exposure with:<\/li>\n<li>Strict IAM, SCPs, and session policies<\/li>\n<li>Controlled egress where possible<\/li>\n<li>No public access to evidence buckets (block public access)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not store secrets in manual evidence attachments.<\/li>\n<li>Redact sensitive fields from documents before attaching as manual evidence.<\/li>\n<li>Prefer references to controlled systems (ticketing approvals, signed PDFs stored in secured S3 locations) over copying sensitive content.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable CloudTrail organization trails where possible.<\/li>\n<li>Consider logging critical bucket access and report downloads (evaluate cost).<\/li>\n<li>Apply immutable logging patterns where required (for example, S3 Object Lock for CloudTrail logs; evaluate whether to use for evidence buckets based on retention and legal hold needs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Evidence may include sensitive metadata (resource ARNs, account IDs, IAM role names).<\/li>\n<li>Apply data classification and retention policies to evidence store buckets.<\/li>\n<li>Consider data residency: assessments and evidence are region-bound; align region choice with compliance requirements.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Granting broad admin access to auditors when read-only evidence access is sufficient.<\/li>\n<li>Storing evidence in an S3 bucket without proper access controls or without blocking public access.<\/li>\n<li>Not protecting CloudTrail\/Config from being disabled in workload accounts.<\/li>\n<li>Treating Audit Manager as an enforcement tool (it does not replace guardrails like SCPs, Config rules, or Control Tower controls).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Centralize Audit Manager administration in a dedicated governance account (delegated admin).<\/li>\n<li>Use separate buckets\/accounts for logs and evidence where separation of duties is required.<\/li>\n<li>Use SCPs to enforce:<\/li>\n<li>CloudTrail enabled<\/li>\n<li>Config enabled (where required)<\/li>\n<li>Evidence bucket protections<\/li>\n<li>Regularly review IAM access to evidence buckets and report artifacts.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Because AWS evolves quickly, confirm all limits in official docs and Service Quotas. Common gotchas include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Regional nature:<\/strong> Assessments and evidence are region-scoped; multi-region environments require deliberate planning.<\/li>\n<li><strong>Evidence depends on source configuration:<\/strong> If AWS Config and CloudTrail are not properly configured, automated evidence will be incomplete.<\/li>\n<li><strong>Not all controls can be automated:<\/strong> Many compliance requirements require manual evidence (policies, approvals, HR processes).<\/li>\n<li><strong>Noise from overscoping:<\/strong> Including too many accounts\/services can produce large volumes of evidence that are hard to review.<\/li>\n<li><strong>S3\/KMS permissions complexity:<\/strong> Report generation and evidence storage can fail if KMS key policies or bucket policies are too restrictive.<\/li>\n<li><strong>Retention and deletion:<\/strong> Deleting an assessment does not necessarily delete all related artifacts in S3 (behavior can vary; verify). You must manage retention and deletion in accordance with your policies.<\/li>\n<li><strong>CloudTrail data events cost:<\/strong> If you enable broad data events to satisfy certain audit needs, cost can increase quickly.<\/li>\n<li><strong>SCP conflicts:<\/strong> Org-wide SCPs can block required read actions for evidence collection or report storage if not planned.<\/li>\n<li><strong>Framework version drift:<\/strong> Prebuilt frameworks may update; align your audit program with a stable version and document changes.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>AWS Audit Manager is focused on <strong>audit evidence collection and assessment reporting<\/strong>. It complements other governance and security services rather than replacing them.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>AWS Audit Manager<\/strong><\/td>\n<td>Audit evidence automation on AWS<\/td>\n<td>Frameworks, automated evidence collection, assessment reports, org scaling<\/td>\n<td>AWS-focused; not a full GRC suite; some controls remain manual<\/td>\n<td>You need continuous AWS evidence and audit packaging<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Artifact<\/strong><\/td>\n<td>Getting AWS compliance reports (AWS responsibility)<\/td>\n<td>Easy access to AWS SOC\/ISO\/PCI reports and agreements<\/td>\n<td>Not your workload evidence<\/td>\n<td>You need AWS-provided compliance documents<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Config (+ Config Rules)<\/strong><\/td>\n<td>Config tracking and compliance evaluation<\/td>\n<td>Detects drift; configuration history; policy checks<\/td>\n<td>Not an audit report generator by itself<\/td>\n<td>You need enforcement\/detection and configuration history<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Security Hub<\/strong><\/td>\n<td>Security findings aggregation<\/td>\n<td>Centralizes findings, standards checks<\/td>\n<td>Findings-focused, not audit evidence packaging<\/td>\n<td>You need security posture visibility and operational alerts<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Control Tower<\/strong><\/td>\n<td>Landing zone governance<\/td>\n<td>Guardrails, account vending, baseline controls<\/td>\n<td>Not an evidence\/reporting tool by itself<\/td>\n<td>You\u2019re building a multi-account foundation<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Policy \/ Microsoft Purview Compliance Manager<\/strong><\/td>\n<td>Compliance management in Azure ecosystems<\/td>\n<td>Strong Azure-native governance and compliance workflows<\/td>\n<td>Not AWS-native; multi-cloud adds complexity<\/td>\n<td>Your workloads are primarily on Azure<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Cloud Security Command Center \/ Assured Workloads<\/strong><\/td>\n<td>GCP security\/compliance management<\/td>\n<td>GCP-native controls and posture tools<\/td>\n<td>Not AWS-native<\/td>\n<td>Your workloads are primarily on GCP<\/td>\n<\/tr>\n<tr>\n<td><strong>Third-party GRC platforms<\/strong> (e.g., enterprise GRC)<\/td>\n<td>Cross-cloud + process controls<\/td>\n<td>Broader workflow, approvals, risk registers<\/td>\n<td>Cost, integration effort, may still need AWS evidence connectors<\/td>\n<td>You need enterprise-wide GRC beyond AWS<\/td>\n<\/tr>\n<tr>\n<td><strong>Open-source tooling<\/strong> (e.g., Prowler\/Steampipe\/OPA-based checks)<\/td>\n<td>Engineering-led compliance-as-code<\/td>\n<td>Flexible, developer-friendly, customizable<\/td>\n<td>You must build evidence storage, reporting, and audit processes<\/td>\n<td>You want customizable checks and can operate the tooling yourself<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: multi-account SOC-style audit operations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A regulated enterprise runs 300+ AWS accounts across multiple OUs. Internal audit needs quarterly evidence for logging, access control, and change governance, and external auditors need a consistent evidence package.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>AWS Organizations with a dedicated <strong>governance\/audit account<\/strong> as <strong>Audit Manager delegated admin<\/strong><\/li>\n<li>Organization CloudTrail (or standardized per-account trails) writing to centralized logging buckets<\/li>\n<li>AWS Config enabled across in-scope accounts\/regions using standard baselines (often via IaC)<\/li>\n<li>AWS Audit Manager assessments per OU and per audit program, with reports stored in a controlled S3 bucket encrypted with SSE-KMS<\/li>\n<li>IAM roles for: Audit Admin, Evidence Reviewer, Report Generator; SCPs prevent disabling CloudTrail\/Config<\/li>\n<li><strong>Why AWS Audit Manager was chosen:<\/strong><\/li>\n<li>Reduced manual evidence collection across hundreds of accounts<\/li>\n<li>Standardized controls mapped to automated AWS evidence<\/li>\n<li>Repeatable report generation per quarter<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Measurable reduction in audit prep time<\/li>\n<li>Fewer evidence gaps due to continuous collection<\/li>\n<li>Clear traceability of control-to-evidence mapping<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: baseline security benchmark tracking<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A startup pursuing enterprise customers needs to demonstrate baseline AWS security posture quickly. The team is small and can\u2019t spend weeks compiling evidence manually.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Single AWS account (or small multi-account setup)<\/li>\n<li>CloudTrail enabled with management events<\/li>\n<li>AWS Config enabled for key resource types<\/li>\n<li>AWS Audit Manager assessment using a baseline benchmark framework (e.g., CIS-style if available)<\/li>\n<li>Monthly report generation stored in an S3 bucket with restricted access<\/li>\n<li><strong>Why AWS Audit Manager was chosen:<\/strong><\/li>\n<li>Fast setup using a prebuilt framework<\/li>\n<li>Automated evidence collection reduced operational burden<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Faster responses to customer security questionnaires<\/li>\n<li>Clear roadmap of control gaps to remediate<\/li>\n<li>Repeatable monthly evidence packages<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1) Is AWS Audit Manager a replacement for AWS Config?<\/h3>\n\n\n\n<p>No. AWS Config tracks configuration history and evaluates compliance via rules. <strong>AWS Audit Manager uses evidence from services like Config and CloudTrail<\/strong> and organizes it into assessments and reports.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2) Is AWS Audit Manager a replacement for AWS Artifact?<\/h3>\n\n\n\n<p>No. <strong>AWS Artifact provides AWS\u2019s compliance reports and agreements<\/strong>. Audit Manager helps you collect <strong>your own workload evidence<\/strong> to demonstrate your controls.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3) Is AWS Audit Manager global or regional?<\/h3>\n\n\n\n<p>It is generally operated as a <strong>regional service<\/strong> (assessments and evidence are region-scoped). Confirm current behavior and regional availability in official docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4) Do I need AWS Organizations?<\/h3>\n\n\n\n<p>Not for a single-account setup. For multi-account governance, <strong>AWS Organizations integration is a major advantage<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5) What evidence sources does Audit Manager support?<\/h3>\n\n\n\n<p>Common evidence sources include <strong>AWS Config<\/strong> and <strong>AWS CloudTrail<\/strong>, and AWS supports additional sources that may change over time. Verify the current supported services list in the documentation for your region.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6) Can Audit Manager collect evidence from on-prem systems or SaaS apps?<\/h3>\n\n\n\n<p>Audit Manager is primarily AWS-focused. You can attach <strong>manual evidence<\/strong> for non-AWS controls, but native automated collection is centered on AWS sources.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7) How do I handle controls that can\u2019t be automated?<\/h3>\n\n\n\n<p>Use <strong>manual evidence<\/strong> attachments and define a process: owner, review frequency, and approval workflow. Store sensitive documents securely and attach only what\u2019s needed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">8) Does AWS Audit Manager enforce compliance?<\/h3>\n\n\n\n<p>Audit Manager is mainly for <strong>assessment and evidence collection\/reporting<\/strong>. Enforcement typically comes from SCPs, Config rules, Control Tower guardrails, CI\/CD policies, and operational remediation processes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">9) How long does it take for evidence to appear?<\/h3>\n\n\n\n<p>It varies by evidence source and configuration. Some items appear quickly, others require collection intervals. If evidence is missing, confirm Config and CloudTrail are enabled and correctly scoped.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">10) Where is evidence stored?<\/h3>\n\n\n\n<p>Evidence is stored in an <strong>S3-backed evidence store<\/strong> in your AWS account. Review and secure the bucket (encryption, access controls, logging, retention).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">11) Can I encrypt evidence with my own KMS key?<\/h3>\n\n\n\n<p>Commonly yes (SSE-KMS is a typical option), but configuration and permissions must be correct. Verify current encryption options in the service settings and docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">12) What are the common reasons report generation fails?<\/h3>\n\n\n\n<p>Often:\n&#8211; S3 bucket policy blocks writes\n&#8211; KMS key policy blocks encrypt\/decrypt\n&#8211; IAM\/SCP restrictions\n&#8211; Misconfigured destination settings<\/p>\n\n\n\n<p>Check CloudTrail for relevant errors.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">13) How do I prove evidence hasn\u2019t been altered?<\/h3>\n\n\n\n<p>Consider S3 bucket protections, versioning, access logging, and retention controls. For stricter requirements, evaluate immutable storage patterns (e.g., S3 Object Lock) based on your compliance needs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">14) Can I use Audit Manager for dev\/test?<\/h3>\n\n\n\n<p>Yes, and it\u2019s helpful for validating your control baselines. But the biggest value is in production where real evidence is needed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">15) How do I structure assessments for a large enterprise?<\/h3>\n\n\n\n<p>Common patterns:\n&#8211; One baseline assessment per OU (security baseline)\n&#8211; Separate assessments for regulated workloads (PCI-like, healthcare, etc.)\n&#8211; Assessments per region if required by data residency or operational boundaries\n&#8211; Versioned frameworks with change control<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">16) Does AWS Audit Manager integrate with CI\/CD?<\/h3>\n\n\n\n<p>Not directly as a deployment gate in the same way a policy engine might, but you can use APIs\/CLI to automate assessment lifecycle and export results into governance workflows.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">17) What\u2019s the biggest \u201cgotcha\u201d for new users?<\/h3>\n\n\n\n<p>Assuming Audit Manager will \u201cmagically\u201d produce evidence without properly enabling and governing <strong>CloudTrail and AWS Config<\/strong> across the assessment scope.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn AWS Audit Manager<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official Documentation<\/td>\n<td>AWS Audit Manager User Guide \u2014 https:\/\/docs.aws.amazon.com\/audit-manager\/latest\/userguide\/what-is.html<\/td>\n<td>Primary source for current concepts, setup, and workflows<\/td>\n<\/tr>\n<tr>\n<td>Official Pricing Page<\/td>\n<td>AWS Audit Manager Pricing \u2014 https:\/\/aws.amazon.com\/audit-manager\/pricing\/<\/td>\n<td>Confirms billable dimensions and current pricing model<\/td>\n<\/tr>\n<tr>\n<td>Official Getting Started<\/td>\n<td>\u201cGetting started\u201d sections in the User Guide \u2014 https:\/\/docs.aws.amazon.com\/audit-manager\/latest\/userguide\/getting-started.html (verify exact URL in docs)<\/td>\n<td>Step-by-step onboarding guidance from AWS<\/td>\n<\/tr>\n<tr>\n<td>API Reference<\/td>\n<td>AWS Audit Manager API Reference \u2014 https:\/\/docs.aws.amazon.com\/audit-manager\/latest\/APIReference\/Welcome.html<\/td>\n<td>Needed for automation and integration development<\/td>\n<\/tr>\n<tr>\n<td>AWS CLI Reference<\/td>\n<td>AWS CLI <code>auditmanager<\/code> commands \u2014 https:\/\/docs.aws.amazon.com\/cli\/latest\/reference\/auditmanager\/<\/td>\n<td>Practical command reference for scripting<\/td>\n<\/tr>\n<tr>\n<td>AWS Security Reference<\/td>\n<td>AWS Security Reference Architecture \u2014 https:\/\/docs.aws.amazon.com\/prescriptive-guidance\/latest\/security-reference-architecture\/welcome.html<\/td>\n<td>Broader security architecture patterns that complement Audit Manager<\/td>\n<\/tr>\n<tr>\n<td>Related Service Docs<\/td>\n<td>AWS Config \u2014 https:\/\/docs.aws.amazon.com\/config\/latest\/developerguide\/WhatIsConfig.html<\/td>\n<td>Config is a common evidence source; correct setup is critical<\/td>\n<\/tr>\n<tr>\n<td>Related Service Docs<\/td>\n<td>AWS CloudTrail \u2014 https:\/\/docs.aws.amazon.com\/awscloudtrail\/latest\/userguide\/cloudtrail-user-guide.html<\/td>\n<td>CloudTrail is a core audit data source<\/td>\n<\/tr>\n<tr>\n<td>Pricing Tool<\/td>\n<td>AWS Pricing Calculator \u2014 https:\/\/calculator.aws\/#\/<\/td>\n<td>Build estimates for Audit Manager + Config + CloudTrail + S3 + KMS<\/td>\n<\/tr>\n<tr>\n<td>Videos (Official)<\/td>\n<td>AWS YouTube Channel \u2014 https:\/\/www.youtube.com\/user\/AmazonWebServices<\/td>\n<td>Search for \u201cAWS Audit Manager\u201d sessions and demos (verify latest playlists)<\/td>\n<\/tr>\n<tr>\n<td>Samples\/Automation<\/td>\n<td>AWS Samples on GitHub \u2014 https:\/\/github.com\/awslabs and https:\/\/github.com\/aws-samples<\/td>\n<td>Sometimes includes governance automation patterns; verify relevance and recency<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<p>Below are training providers shared as-is (verify course availability and modality on each website):<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>DevOpsSchool.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps engineers, cloud engineers, SREs, platform teams\n   &#8211; <strong>Likely learning focus:<\/strong> AWS governance, DevOps tooling, security\/compliance foundations\n   &#8211; <strong>Mode:<\/strong> check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>ScmGalaxy.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps practitioners, build\/release engineers, students\n   &#8211; <strong>Likely learning focus:<\/strong> SCM\/DevOps practices, automation, cloud basics\n   &#8211; <strong>Mode:<\/strong> check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.scmgalaxy.com\/<\/p>\n<\/li>\n<li>\n<p><strong>CLoudOpsNow.in<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> Cloud operations teams, DevOps\/SRE\n   &#8211; <strong>Likely learning focus:<\/strong> Cloud operations, monitoring, reliability, governance\n   &#8211; <strong>Mode:<\/strong> check website\n   &#8211; <strong>Website:<\/strong> https:\/\/cloudopsnow.in\/<\/p>\n<\/li>\n<li>\n<p><strong>SreSchool.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> SREs, operations engineers, platform engineering\n   &#8211; <strong>Likely learning focus:<\/strong> Reliability engineering, operational readiness, incident management\n   &#8211; <strong>Mode:<\/strong> check website\n   &#8211; <strong>Website:<\/strong> https:\/\/sreschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>AiOpsSchool.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> Operations teams exploring AIOps, monitoring automation\n   &#8211; <strong>Likely learning focus:<\/strong> AIOps concepts, observability, automation\n   &#8211; <strong>Mode:<\/strong> check website\n   &#8211; <strong>Website:<\/strong> https:\/\/aiopsschool.com\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<p>Presented as training resource platforms\/sites (verify specific trainers and offerings on each site):<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>RajeshKumar.xyz<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps\/cloud training and mentoring (verify current scope on site)\n   &#8211; <strong>Suitable audience:<\/strong> Beginners to intermediate engineers\n   &#8211; <strong>Website:<\/strong> https:\/\/rajeshkumar.xyz\/<\/p>\n<\/li>\n<li>\n<p><strong>devopstrainer.in<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps tools and cloud coaching (verify course listings)\n   &#8211; <strong>Suitable audience:<\/strong> DevOps and cloud learners\n   &#8211; <strong>Website:<\/strong> https:\/\/devopstrainer.in\/<\/p>\n<\/li>\n<li>\n<p><strong>devopsfreelancer.com<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps consulting\/training resources (verify current offerings)\n   &#8211; <strong>Suitable audience:<\/strong> Teams seeking external support or individuals seeking guidance\n   &#8211; <strong>Website:<\/strong> https:\/\/devopsfreelancer.com\/<\/p>\n<\/li>\n<li>\n<p><strong>devopssupport.in<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps support and training resources (verify current scope)\n   &#8211; <strong>Suitable audience:<\/strong> Ops\/DevOps teams needing hands-on help\n   &#8211; <strong>Website:<\/strong> https:\/\/devopssupport.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<p>Listed neutrally; verify service catalogs and case studies directly with each company.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>cotocus.com<\/strong>\n   &#8211; <strong>Likely service area:<\/strong> Cloud\/DevOps consulting, delivery support (verify on website)\n   &#8211; <strong>Where they may help:<\/strong> Cloud adoption, governance setup, operational support\n   &#8211; <strong>Consulting use case examples:<\/strong> Multi-account baseline design, CI\/CD pipeline improvements, operational runbooks\n   &#8211; <strong>Website:<\/strong> https:\/\/cotocus.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DevOpsSchool.com<\/strong>\n   &#8211; <strong>Likely service area:<\/strong> DevOps and cloud consulting\/training (verify on website)\n   &#8211; <strong>Where they may help:<\/strong> DevOps transformation, platform engineering, cloud governance enablement\n   &#8211; <strong>Consulting use case examples:<\/strong> AWS landing zone operations, compliance automation planning, team enablement workshops\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DEVOPSCONSULTING.IN<\/strong>\n   &#8211; <strong>Likely service area:<\/strong> DevOps consulting services (verify on website)\n   &#8211; <strong>Where they may help:<\/strong> DevOps implementation, cloud operations, automation\n   &#8211; <strong>Consulting use case examples:<\/strong> IaC standardization, monitoring\/alerting setup, release engineering support\n   &#8211; <strong>Website:<\/strong> https:\/\/devopsconsulting.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before AWS Audit Manager<\/h3>\n\n\n\n<p>To use AWS Audit Manager effectively, you should understand:\n&#8211; <strong>AWS IAM fundamentals:<\/strong> policies, roles, least privilege, permission boundaries, and Organizations SCPs\n&#8211; <strong>AWS Organizations basics:<\/strong> accounts, OUs, delegated admin concepts\n&#8211; <strong>AWS CloudTrail:<\/strong> management vs data events, log destinations, retention\n&#8211; <strong>AWS Config:<\/strong> recorders, configuration items, rules, and multi-account setup patterns\n&#8211; <strong>S3 security:<\/strong> bucket policies, Block Public Access, encryption options, lifecycle policies\n&#8211; <strong>KMS basics:<\/strong> CMKs, key policies, grants, rotation<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after AWS Audit Manager<\/h3>\n\n\n\n<p>To mature an audit\/compliance program on AWS:\n&#8211; <strong>AWS Control Tower<\/strong> and landing zone patterns\n&#8211; <strong>Compliance-as-code \/ policy-as-code<\/strong>:\n  &#8211; SCP strategy\n  &#8211; Config rules at scale\n  &#8211; Infrastructure as Code (CloudFormation\/Terraform\/CDK)\n&#8211; <strong>Centralized logging\/security analytics<\/strong>:\n  &#8211; CloudWatch, OpenSearch, SIEM integrations\n&#8211; <strong>Security posture management<\/strong>:\n  &#8211; AWS Security Hub standards and operationalization\n&#8211; <strong>Incident response and forensics<\/strong> on AWS<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud security engineer<\/li>\n<li>Security compliance engineer<\/li>\n<li>Platform engineer (governance)<\/li>\n<li>DevOps\/SRE in regulated environments<\/li>\n<li>Internal auditor \/ technology risk analyst (with AWS access patterns)<\/li>\n<li>Cloud solutions architect (security\/compliance focus)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (AWS)<\/h3>\n\n\n\n<p>AWS Audit Manager is not a standalone certification, but it supports skills tested in broader security and governance domains. Relevant AWS certifications commonly include:\n&#8211; <strong>AWS Certified Security \u2013 Specialty<\/strong> (if currently available; verify latest AWS cert lineup)\n&#8211; <strong>AWS Certified Solutions Architect \u2013 Associate\/Professional<\/strong>\n&#8211; <strong>AWS Certified SysOps Administrator \u2013 Associate<\/strong><\/p>\n\n\n\n<p>Always verify the current AWS certification catalog:\n&#8211; https:\/\/aws.amazon.com\/certification\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a <strong>baseline governance stack<\/strong> (Organizations + CloudTrail + Config) and run monthly Audit Manager assessments.<\/li>\n<li>Create a <strong>custom framework<\/strong> mapping your internal security policy to AWS evidence sources and manual evidence tasks.<\/li>\n<li>Implement <strong>SCP guardrails<\/strong> preventing disabling CloudTrail\/Config and validate evidence continuity.<\/li>\n<li>Use AWS CLI to <strong>automate assessment creation<\/strong> for new accounts and generate monthly reports.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Assessment:<\/strong> An Audit Manager instance that evaluates a defined scope against a framework and collects evidence.<\/li>\n<li><strong>Framework:<\/strong> A structured set of control sets and controls representing compliance requirements.<\/li>\n<li><strong>Control set:<\/strong> A group of controls organized by theme (e.g., \u201cLogging\u201d).<\/li>\n<li><strong>Control:<\/strong> A specific requirement that needs evidence to demonstrate compliance.<\/li>\n<li><strong>Evidence:<\/strong> Collected artifacts\/metadata supporting a control (automated or manually attached).<\/li>\n<li><strong>Delegated administrator:<\/strong> An AWS Organizations account authorized to manage a service across the organization.<\/li>\n<li><strong>AWS Config:<\/strong> Service that records resource configurations and supports compliance evaluation through rules.<\/li>\n<li><strong>AWS CloudTrail:<\/strong> Service that records AWS API activity for governance, auditing, and investigations.<\/li>\n<li><strong>SCP (Service Control Policy):<\/strong> Organization-level policy that sets permission guardrails across accounts.<\/li>\n<li><strong>Evidence store:<\/strong> The S3-backed storage location in your account where Audit Manager stores evidence and reports.<\/li>\n<li><strong>SSE-S3 \/ SSE-KMS:<\/strong> Server-side encryption using S3-managed keys or customer-managed KMS keys.<\/li>\n<li><strong>Audit window:<\/strong> The time period for which an audit requires proof (e.g., Q1, annual).<\/li>\n<li><strong>Continuous compliance:<\/strong> Ongoing collection and validation of evidence rather than point-in-time checks.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>AWS Audit Manager (AWS) is a Security, identity, and compliance service that <strong>automates audit evidence collection<\/strong>, organizes it into <strong>framework-based assessments<\/strong>, and produces <strong>audit-ready reports<\/strong>. It matters because audits are often slow and manual; Audit Manager helps teams shift toward <strong>continuous compliance<\/strong> by collecting evidence over time and mapping it directly to controls.<\/p>\n\n\n\n<p>Architecturally, it fits best alongside <strong>AWS Organizations<\/strong>, <strong>AWS Config<\/strong>, and <strong>AWS CloudTrail<\/strong>, with evidence stored in <strong>Amazon S3<\/strong> and optionally encrypted with <strong>AWS KMS<\/strong>. Cost planning should focus not only on Audit Manager pricing, but also on indirect costs from Config, CloudTrail (especially data events), S3 storage, and KMS requests.<\/p>\n\n\n\n<p>Use AWS Audit Manager when you need repeatable, scalable audit evidence for AWS workloads\u2014especially in multi-account environments. Next, deepen your skills by standardizing CloudTrail\/Config across accounts, implementing SCP guardrails, and learning how to design custom frameworks that match your organization\u2019s control language.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security, identity, and compliance<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,39],"tags":[],"class_list":["post-313","post","type-post","status-publish","format-standard","hentry","category-aws","category-security-identity-and-compliance"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=313"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/313\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}