An auditor requests third-party reports about AWS security controls.
The team needs to review AWS-side compliance information.
Which AWS service is appropriate for this purpose?
AWS Artifact provides on-demand access to AWS security and compliance reports and selected agreements.
Detailed explanation
Inspector manages workload vulnerabilities and exposure, not application unit testing.
Inspector manages workload vulnerabilities and exposure, not application unit testing.
AWS Artifact provides documents such as SOC, ISO, and PCI reports describing AWS security and compliance controls.
AWS Artifact provides documents such as SOC, ISO, and PCI reports describing AWS security and compliance controls.
Shield provides DDoS protection and is not used to retrieve or encrypt compliance documents.
Shield provides DDoS protection and is not used to retrieve or encrypt compliance documents.
CloudWatch monitors metrics and logs; it is not the portal for AWS audit reports.
CloudWatch monitors metrics and logs; it is not the portal for AWS audit reports.
Check official documentation
Compare the following points with the official documentation.
AWS Artifact User GuideのWhat is AWS Artifact?で提供されるレポートの種類を確認する。
What to confirm
SOC、ISO、PCIなどAWS側のコンプライアンス文書を取得する用途としてAWS Artifactが対応する。
Key points
- AWS Artifact
- Compliance report
- SOC and ISO reports
Notes
- Environment: AWS公式ドキュメントのサービス用途確認
- Confirm current service capabilities and compliance guidance in the official AWS documentation.
Foundation review
Evidence boundary
Artifact describes AWS controls; it does not automatically create evidence for a customer's workload.
Role separation
Compliance documents, performance metrics, vulnerabilities, and DDoS controls come from different services.