A regulated bank runs 40 accounts under AWS Organizations with centralized CloudTrail and Config. Auditors demand quarterly SOC 2 and PCI evidence, tamper-evident resource history, and self-service access to AWS compliance reports. Which evidence-collection design satisfies centralized audit reporting and compliance documentation needs?
Select an answer to reveal the explanation.
Short Explanation
You've got auditors knocking and you need receipts ready, not scrambled for. Audit Manager automates your evidence trail while Artifact hands over AWS compliance papers on demand.
Full Explanation
AWS Audit Manager with a delegated administrator account continuously maps AWS Config, CloudTrail, and Security Hub data into prebuilt SOC 2 and PCI frameworks, producing timestamped, auditor-ready evidence with ownership workflows, while AWS Artifact provides self-service access to AWS third-party attestations and agreements without support tickets. Amazon Security Hub aggregation centralizes security posture findings but does not map controls to audit frameworks or retain assessment evidence with attestation workflow. Amazon Macie discovery on log buckets identifies sensitive data and Athena queries enable ad hoc analysis, but neither provides framework-aligned evidence collection or AWS compliance reports. CloudTrail Lake federation supports powerful cross-account investigation, yet raw event exports lack control mapping, review workflows, and Artifact documentation, forcing manual assembly that fails scale and repeatability. For the exam remember Artifact hosts AWS reports while Audit Manager proves your usage, and in practice verify delegated admin, framework scope, and auditor share permissions before the quarter closes.