A public fintech that already uses AWS Audit Manager and AWS Config must prove PCI DSS and SOC compliance quarterly to enterprise buyers, showing current AWS certifications and its own control activity. Security wants centralized evidence without manual screenshots. Which compliance evidence collection and reporting solution using AWS Artifact and audit services meets buyer due diligence?
Select an answer to reveal the explanation.
Short Explanation
You’re answering two parts of the buyer’s request: AWS’s certifications and your own control activity. Attestation is strongest when Artifact supplies AWS reports and Audit Manager with Config supplies your evidence.
Full Explanation
AWS Artifact provides on-demand access to AWS compliance reports and agreements, including SOC and PCI attestations, demonstrating AWS’s side of shared responsibility. AWS Audit Manager with AWS Config continuously collects your control evidence, maps resources to frameworks, and produces audit-ready reports, so together they address both parts of buyer due diligence. Inspector and GuardDuty findings support vulnerability and threat detection, but do not provide the control mapping and audit evidence packages needed here. Artifact Organizations agreements manage agreement acceptance rather than workload evidence, while CloudTrail event history alone lacks control mapping and audit-oriented reporting. Security Hub aggregates security posture; it is not the source of AWS’s official compliance reports, and the Artifact Reports API does not collect evidence about your resources. An exam caveat: Audit Manager is in maintenance mode and closed to new accounts since April 30, 2026, so this approach fits an existing customer. Before the quarterly review, check that Config recorders are enabled and Audit Manager assessment frameworks are collecting evidence for the relevant controls.