Compliance: AWS Artifact, audit and governance

In mid-November, Cascade Ridge's insurer sent its annual cyber questionnaire. It ran to eleven pages. Question 4 asked how physical access to servers holding client data was controlled. Question 7 asked whether the company's service providers held independent security certifications. Question 12 asked for evidence that data was encrypted at rest. Lorraine forwarded it to Hannah with a single line: "Can we answer this now that we are in the cloud?"

Hannah had answered the same questionnaire every year by guessing about the old server room. This year she could do better, and this lesson explains how. It covers compliance on AWS: the certifications and attestations AWS holds, where to find them with AWS Artifact, why compliance needs vary by location, industry and service, and the services that help customers govern their own side and gather evidence.

Compliance and governance

Compliance means meeting external requirements: laws, regulations, industry standards and contracts. Governance means the internal rules and processes an organization uses to direct and control its activities, including how it makes sure it stays compliant. On AWS, both follow the shared responsibility model from lesson 1. AWS demonstrates that its infrastructure and services meet many standards. The customer is responsible for how it uses those services and for showing that its own configuration, processes and people meet its obligations.

AWS compliance programs

AWS participates in a large number of compliance programs. Independent auditors assess AWS against standards, and AWS publishes the results. Some programs are global, some apply to particular countries or industries.

These programs matter to Cascade Ridge in different ways. The SOC 2 and ISO 27001 reports answer the insurer's questions about the service provider's controls. PCI DSS matters because BookVet takes deposits for some procedures by card. FedRAMP is not a requirement for a private veterinary group, but it shows how AWS services are assessed for US government workloads.

AWS Artifact

AWS Artifact is the self-service portal in the AWS console where customers download AWS's compliance reports and review and accept agreements. It has two parts.

• Artifact Reports provide on-demand access to AWS security and compliance documents, such as SOC reports, ISO certificates, PCI attestations of compliance and many regional assessments. Some reports require accepting terms that restrict how they may be shared, because they describe AWS's controls in detail.
• Artifact Agreements let customers review, accept and manage agreements with AWS for an individual account or for all accounts in an organization, such as a business associate addendum for HIPAA workloads in the US.

Hannah downloaded the latest SOC 2 report and ISO 27001 certificate from Artifact and attached them to the insurer's questionnaire for questions 4 and 7. She wrote beside question 4: "Physical access controls for the infrastructure are performed by AWS and independently audited; see attached report." That is the shared responsibility model working as intended: an inherited control, evidenced by the provider's audit.

Compliance needs vary

The exam guide expects candidates to understand that compliance needs differ by geography, by industry and by service.

Geography. Privacy and data protection laws differ from place to place. In the US, privacy is governed by a mix of sector laws, such as HIPAA for health care, and state laws, such as Colorado's consumer privacy law. Some laws or contracts require data to stay in a particular country. AWS lets customers choose the Regions where data is stored and does not move it out of the chosen Region without the customer's action, which is why Cascade Ridge chose US West (Oregon) and US East (Ohio).

Industry. Health care, finance, government and payments each have their own frameworks. A veterinary group is not covered by human health privacy rules, but card payments bring PCI DSS, and insurers and partners bring their own expectations.

Service. Not every AWS service is in scope for every program. AWS publishes services in scope lists for each compliance program, and a workload that must meet a standard should use services that are in scope for it. Before Kwame added a new service to the payment flow in phase two, Hannah planned to check the PCI DSS in-scope list.

Governance services

AWS provides several services that help customers govern their accounts and gather evidence for their side of the model.

Service control policies deserve a second look. An SCP attached to an account or an organizational unit sets the maximum permissions for every identity in it, including administrators. Gwen used SCPs for three organization-wide rules: deny actions outside the approved Regions, deny turning off CloudTrail or deleting its logs, and deny leaving the organization. These are governance decisions expressed as code, and no local administrator can override them.

AWS Audit Manager helps with the most time-consuming part of compliance: collecting evidence. It provides prebuilt frameworks, continuously gathers evidence such as Config rule results and CloudTrail activity, and organizes it by control, so that when an auditor asks for proof, much of it is already collected and timestamped. The exam guide also mentions access reports, which in practice means the IAM credential report from lesson 2 and the last-accessed information from lesson 4.

# Map sample controls to the evidence Cascade Ridge holds, and who provides it.
controls = [
    ("Physical access to servers is restricted", "AWS", "SOC 2 report from AWS Artifact"),
    ("Data is encrypted at rest", "Customer", "AWS Config rule results: encrypted volumes and buckets"),
    ("Admin access requires MFA", "Customer", "Identity Center settings and IAM credential report"),
    ("Changes are logged and retained", "Customer", "Organization CloudTrail trail in the log archive account"),
    ("Storage media is destroyed securely", "AWS", "ISO 27001 certificate and SOC 2 report"),
]
for name, owner, evidence in controls:
    print(f"[{owner:8}] {name}\n           evidence: {evidence}")
print(sum(1 for c in controls if c[1] == "Customer"), "of", len(controls), "controls are proven by Cascade Ridge itself")

[AWS     ] Physical access to servers is restricted
           evidence: SOC 2 report from AWS Artifact
[Customer] Data is encrypted at rest
           evidence: AWS Config rule results: encrypted volumes and buckets
[Customer] Admin access requires MFA
           evidence: Identity Center settings and IAM credential report
[Customer] Changes are logged and retained
           evidence: Organization CloudTrail trail in the log archive account
[AWS     ] Storage media is destroyed securely
           evidence: ISO 27001 certificate and SOC 2 report
3 of 5 controls are proven by Cascade Ridge itself

The output makes the shared model concrete. Inherited controls are proven with AWS's reports; customer controls are proven with the customer's own configuration and records. An audit needs both columns.

Answering the questionnaire

Hannah worked through the insurer's eleven pages in an afternoon, a task that used to take her a week of guesswork. Physical security and the provider's certifications: AWS's reports from Artifact. Encryption at rest: Config rule results showing every volume and bucket encrypted, plus the KMS key policy from lesson 8. Multi-factor authentication for administrators: Identity Center settings and the credential report. Logging: the organization trail and its protected bucket. Vulnerability management: Inspector's coverage report. Incident response: the plan she had been drafting since lesson 2.

Only one question stumped her: whether staff received annual security awareness training. That one was not in AWS at all. It was a shared control in Cascade Ridge's own layer, and she added a training program to next year's plan.

Where to find more

AWS publishes compliance information on its compliance pages, including lists of programs and services in scope, and in whitepapers on security and compliance topics. The AWS Security Center and AWS Security Blog cover new features and guidance, and AWS Knowledge Center answers common how-to questions. For legal interpretation, such as exactly what a privacy law requires, organizations still need their own legal and compliance advice; AWS documents what its services do, not what a given law means for a given company.

AWS Control Tower and landing zones

Organizations with more than a few accounts often use AWS Control Tower to set up what AWS calls a landing zone: a well-architected multi-account environment created from a blueprint. Control Tower creates the core accounts, typically a management account, a log archive account and an audit account, sets up IAM Identity Center, and applies controls, the Control Tower name for guardrails. Preventive controls use service control policies to stop actions, such as disabling CloudTrail. Detective controls use AWS Config rules to report problems, such as public buckets. Proactive controls check resources before they are created. Control Tower's Account Factory creates new accounts that start out compliant.

Gwen considered Control Tower for Cascade Ridge and decided to adopt it during the spring cutover, once the pilot had proved the account design. For a small company, she explained, building the first few accounts by hand is a good way to understand what Control Tower automates; for a growing one, Control Tower keeps every new account consistent without relying on memory.

Continuous compliance

Traditional compliance happened once a year: an audit, a scramble for evidence, a report, and then eleven months of drift. In the cloud, the configuration of every resource is recorded and can be checked at any moment, which makes continuous compliance possible. Config rules and conformance packs flag drift as it happens, Security Hub scores the account against standards every day, Audit Manager keeps collecting evidence, and service control policies prevent the most serious deviations entirely. Hannah's goal for the next insurer questionnaire is to answer most questions with a link to a live report rather than a screenshot taken the week before.

Continuous compliance does not remove the need for people. Someone still decides which rules matter, reviews exceptions, signs off risk decisions and talks to auditors. What it removes is the gap between the day of the audit and every other day, which is exactly the gap that attackers and accidents exploit.