AWS Audit Manager Specialized2020年〜
A service that automates evidence collection and assessment for compliance audits
What It Does
AWS Audit Manager is a service that automates the collection of evidence needed for compliance audits of your AWS environment. It provides pre-built assessment templates aligned with industry-standard frameworks such as GDPR, PCI DSS, and SOC 2, and automatically collects and organizes relevant evidence from sources like AWS Config and CloudTrail. It dramatically reduces the manual effort required for audit preparation.
Use Cases
Used for automating evidence collection for annual SOC 2 and PCI DSS audits, continuously monitoring compliance with internal security policies, and efficiently preparing submission materials for audit firms. It is also used for centralized compliance management across multi-account environments.
Everyday Analogy
Think of it like an assistant for your company's internal audit department. The assistant (Audit Manager) automatically gathers the required documents (evidence) from each department and organizes them according to a checklist. Instead of running around collecting paperwork, auditors can focus on reviewing content and making judgments.
What Is AWS Audit Manager?
AWS Audit Manager is a managed service that streamlines compliance auditing for cloud environments. Traditionally, audit preparation required enormous manual effort such as taking screenshots and manually collecting logs. Audit Manager automates this evidence collection and organizes it according to assessment frameworks. Since it continuously collects data from various AWS services, you no longer need to scramble to prepare when audit season arrives.
Frameworks and Assessments
Audit Manager comes with pre-built templates for major compliance frameworks including GDPR, PCI DSS, SOC 2, and HIPAA. When you select a framework and start an assessment, evidence for each control is automatically collected from AWS Config rules, CloudTrail logs, Security Hub findings, and more. You can also create custom frameworks to address your organization's unique audit criteria. For practical know-how on frameworks and assessments, related books on Amazon are a great resource.
Evidence Management and Reporting
Collected evidence is organized by control, and you can see compliance status at a glance on the dashboard. You manually review the assessment status of each control and set statuses such as compliant, non-compliant, or not applicable. Once the assessment is complete, you can export evidence folders as reports to submit to audit firms or internal audit teams. Evidence is stored in S3, supporting long-term retention.
Things to Watch Out For
- Audit Manager pricing is based on the number of resource assessments. S3 storage costs for evidence are charged separately
- Automatically collected evidence is technical proof only - final audit judgments must still be made by humans
- AWS Config and CloudTrail must be enabled as prerequisites. Evidence cannot be collected if these services are disabled
