A fintech startup that already uses AWS Audit Manager in its Organizations management account must furnish SOC 2 evidence quarterly, needs tamper-evident collection across 12 accounts plus on-demand auditor access to AWS compliance reports. Which compliance evidence collection design streamlines reporting with Artifact?
Select an answer to reveal the explanation.
Short Explanation
Audit season shouldn’t mean screenshot scavenger hunts across accounts. You can use Audit Manager to gather tamper-evident evidence across your accounts, while Artifact Reports gives auditors and stakeholders on-demand access to official AWS compliance reports.
Full Explanation
Audit Manager provides automated, tamper-evident control evidence that you can organize into quarterly SOC 2 assessments and scope across all 12 accounts. Pairing those assessments with AWS Artifact Reports gives auditors and stakeholders on-demand self-service access to AWS third-party compliance reports, streamlining evidence gathering and review. Restricting Artifact Reports to internal teams would leave auditors without the requested access. Artifact Agreements manages contractual documents such as NDAs and BAAs; it does not provide the compliance reports supplied through Artifact Reports. AWS Config aggregation can provide a multi-account view of configuration snapshots and rule evaluations, but it does not replace Audit Manager’s audit-ready evidence collection and assessment workflows. Exam caveat: Audit Manager is in maintenance mode and closed to new accounts since April 30, 2026, so this design fits an organization that already uses it. For the exam, distinguish the evidence collection service from the compliance document portal, and Artifact Reports from Agreements. In practice, verify the Audit Manager delegated administrator in Organizations, confirm the assessment covers the required accounts and quarterly framework, and test auditor IAM or federated access to Artifact Reports before the audit window.