c3.4 Produce compliance reports
Compliance is shared: AWS proves the security of the cloud, and you must prove your workloads on AWS meet the same regulation — a gap assessment. Continuously evaluate your resources against a framework with AWS Config conformance packs, and export the evidence auditors need.
Implementation guidance
Compliance is a shared responsibility
AWS provides audit reports and certifications proving the AWS infrastructure meets many regulations (via AWS Artifact). You are responsible for proving that the workloads you build on AWS meet the same regulation — auditors will ask for a gap assessment covering your side of the shared responsibility model.
Evaluate resources with AWS Config conformance packs
The recommended way to manage AWS resource compliance is AWS Config conformance packs: pre-built templates for common frameworks (PCI DSS, HIPAA, NIST, FedRAMP, and more) that deploy detective controls (Config Rules) across accounts and Regions, with a compliance dashboard, per-resource drill-down, and optional remediation. You can also author custom packs. Export evidence for auditors via Config advanced queries, the resource config history API, or Athena.
Service update: AWS Audit Manager moved to maintenance mode (announced March 2026). From April 30, 2026 it can no longer be enabled in new accounts, Regions, or organizations; existing customers keep using it as normal, but AWS is not adding new features or frameworks and steers new compliance-management use to AWS Config. See the Audit Manager availability change.
Complementary options
- AWS Security Hub CSPM — for frameworks mapped to a security standard (for example NIST 800-53, PCI DSS), it gives a compliance score and per-control status with severity, configurable across accounts and Regions.
- Existing Audit Manager customers can continue to use it to collect evidence and generate PDF/CSV audit reports.
- Partner tools such as Vanta and Drata, used alongside AWS Config, cover the full audit process — including the non-technical controls (documented policies and procedures) that Config Rules cannot evaluate.
For PCI-DSS specifically
If you are in scope for PCI-DSS (handling payment card data), use the dedicated PCI Security Maturity Model — it covers PCI environment isolation, payment cryptography, and the full set of PCI-DSS controls that go beyond this general Cloud model.
How to validate
- Are your resources continuously evaluated against the frameworks you must meet (for example with AWS Config conformance packs across accounts and Regions)?
- Can you export the evidence auditors need (config history, advanced queries, or a partner tool)?
- Do you have the people and process to produce compliance reports repeatably?
- Does your solution also cover non-technical controls (documented policies/procedures), for example via a partner tool alongside AWS Config?
Threats addressed
- Without a repeatable way to evaluate resources against a framework and produce evidence, audits are slow and error-prone, and a gap can lead to fines or loss of authorization to operate.
AWS services
AWS Config 
AWS Security Hub 
AWS Artifact