Automating Audits - Continuously Collecting Compliance Evidence with AWS Audit Manager
Learn how to automate audit evidence collection with AWS Audit Manager. This guide covers automated assessments based on frameworks such as SOC 2, PCI DSS, and GDPR, centralized evidence management, and audit report generation.
Audit Challenges and the Role of Audit Manager
Compliance auditing in cloud environments is a significant burden for many organizations. SOC 2 and PCI DSS audits require collecting, organizing, and submitting evidence for hundreds of controls. Traditionally, this involved enormous manual effort, including downloading CloudTrail logs, taking screenshots of Config rule evaluation results, and manually verifying security settings. AWS Audit Manager is a service that automates this audit evidence collection and management. It provides prebuilt assessment templates for major compliance frameworks (SOC 2, PCI DSS, GDPR, HIPAA, ISO 27001, NIST 800-53, and more) and automatically collects and organizes evidence from AWS Config, CloudTrail, Security Hub, and manual inputs for each control. Because evidence accumulates continuously throughout the audit period, the last-minute scramble to gather evidence before an audit becomes unnecessary.
Creating Assessments and Collecting Evidence
Using Audit Manager starts with creating an assessment. You select a framework (e.g., SOC 2), specify the target AWS accounts and regions, and automatic evidence collection begins for the framework's controls. Evidence is collected from three sources: AWS Config rule evaluation results (whether resource configurations comply with controls), CloudTrail event logs (who did what and when), and Security Hub findings (compliance with security best practices). You can also upload manual evidence such as policy documents and process descriptions. Collected evidence is automatically categorized and organized by control, and a dashboard provides an overview of evidence collection status for each control.
Custom Frameworks and Delegation
In addition to prebuilt frameworks, you can define your organization's own audit criteria using custom frameworks. Create custom control sets and custom controls, and specify the evidence sources (Config rules, CloudTrail events, manual) for each control. This lets you automate audits for internal security policies and industry-specific regulations. The delegation feature lets you assign owners to each control and request evidence review and approval. For example, you can delegate network security controls to the infrastructure team and access management controls to the security team. Assignees can view their assigned controls on the dashboard, review evidence, and add comments. For a systematic understanding of AWS compliance from basics to advanced topics, books on Amazon are a great resource.
Audit Reports and Organizations Integration
When the assessment period ends, you generate an audit report and output it to an S3 bucket. The report includes the framework's control list, evidence for each control, and assessment results, and can be used directly as submission materials for external auditors. Integration with AWS Organizations lets you create assessments targeting multiple accounts within your organization from the management account. By designating a delegated administrator account, your security team can operate Audit Manager without management account privileges. Pricing is pay-per-use based on resource assessments, with automated evidence costing $0.0012 per resource per assessment. For example, assessing 1,000 resources against a single framework costs approximately $1.20 per month, making it very affordable. Config and CloudTrail usage charges apply separately, but since these services are used for purposes beyond auditing, the incremental cost attributable to Audit Manager is minimal.
Audit Manager Pricing
Audit Manager pricing is based on the number of resource assessments. Each resource assessment costs approximately $0.001, with costs varying based on the number of resources assessed and the number of controls in the framework. Config rule evaluation charges (approximately $0.003 per evaluation) apply separately. In large-scale environments, limit the frameworks you assess to only those you need rather than enabling all frameworks uniformly to manage costs. Compared to manual audit evidence collection (which can take weeks of effort), Audit Manager's automated collection delivers significant cost savings.
Summary - Guidelines for Using Audit Manager
AWS Audit Manager is a service that automates compliance audit evidence collection and management. Its key strengths include prebuilt templates for major frameworks like SOC 2, PCI DSS, and GDPR; automated evidence collection from Config, CloudTrail, and Security Hub; delegation-based review workflows; and automated audit report generation. For organizations spending hundreds of hours per year on audit response, Audit Manager delivers significant time savings. With its low cost ($0.0012 per resource assessment), we recommend starting with a single framework and expanding gradually.