c4.2 Automate evidence gathering for audits
Turn audit evidence collection into a continuous process. Deploy AWS Config conformance packs so your resources are constantly evaluated against a framework, and export the resulting evidence for auditors instead of gathering it by hand each cycle.
Implementation guidance
Make evidence collection continuous
Deploy AWS Config conformance packs so your resources are continuously evaluated against the frameworks you must meet (PCI DSS, HIPAA, NIST, FedRAMP, and more). Each pack gives you a live compliance dashboard and per-resource status, and the underlying Config data is your evidence — export it for auditors via Config advanced queries, the resource config-history API, or Amazon Athena. This replaces the periodic scramble of an audit with an always-on process, and pairs with Produce compliance reports.
Cover the controls Config cannot evaluate
Config Rules evaluate technical resource configuration, not the documented policies and procedures an auditor also needs. For end-to-end audit automation — including those non-technical controls and framework-ready report exports — layer a partner solution such as Vanta or Drata on top of AWS Config.
Service update: AWS Audit Manager (which automated evidence collection and report export) moved to maintenance mode in 2026 and can no longer be enabled in new accounts. Existing Audit Manager customers can keep using it; new implementations should build on AWS Config. See the Audit Manager availability change.
How to validate
- Are your resources continuously evaluated against the required frameworks with AWS Config conformance packs (not gathered manually each cycle)?
- Can you export the evidence auditors need (config history, advanced queries, Athena, or a partner tool)?
- Do you cover non-technical controls (documented policies/procedures) — for example with a partner tool on top of AWS Config?
- Is coverage in place across all in-scope accounts and Regions?
Threats addressed
- Manual evidence collection is slow and error-prone; gaps or stale evidence during an audit can delay certification or cause findings.
AWS services
AWS Config 
AWS Security Hub