An existing AWS Audit Manager customer, a fintech company, must prove PCI DSS controls on EC2, RDS, and IAM to external auditors with organized control-mapped evidence, auditor-ready reports, and continuous collection. Manual screenshots are no longer accepted. Which audit evidence service combination should the compliance team use to demonstrate resource compliance?

AWS Audit Manager provides prebuilt frameworks including PCI DSS that automatically collect configuration snapshots, API activity, and manual attestations mapped to controls with organized evidence folders and auditor sharing workflows, meeting continuous collection and reporting needs for EC2, RDS, and IAM. AWS Artifact provides on-demand download of AWS compliance reports and agreements such as PCI attestations about AWS itself, but it does not collect customer resource configuration evidence or map controls. AWS Config aggregators record configuration history and rules evaluations useful as evidence sources, yet alone they lack control mapping, workflow, and auditor-ready report generation. AWS Security Hub centralizes security findings from controls but does not structure them into audit frameworks with evidence collection and attestation. On the exam, remember Artifact proves AWS compliance while Audit Manager proves your usage compliance, and in practice link Audit Manager to Config, CloudTrail, and Security Hub as evidence sources and review delegation. Audit Manager is no longer open to new customers, so this fits accounts that already use it.