First, the 2026 availability change
AWS Audit Manager is in maintenance mode. According to the Audit Manager availability change page, from April 30, 2026 customers can no longer set up the service in new accounts. What that means in practice:
- Existing single-account customers can keep using Audit Manager in the account and Region where it is set up, including creating new assessments. They cannot set it up in additional Regions or accounts.
- Organizations that set it up in the management account can add accounts from that organization to assessments, but cannot extend it to new Regions or new organizations.
- The service is not being shut down. AWS will keep fixing it and maintaining data source mappings for the current frameworks, but will not add features, new frameworks, new versions of existing frameworks or new Regions.
If you already use Audit Manager, the rest of this post explains how to get the most from it. If you are starting fresh, skip to the section on alternatives.
What Audit Manager does
Audit Manager helps you prepare for audits of how you use AWS. It collects evidence from your accounts automatically, maps that evidence to the controls in a compliance framework, and lets you package it into a report for auditors. The goal is less time spent taking screenshots and exporting logs by hand.
The building blocks are:
- Frameworks. A framework is a set of controls grouped by the requirements of a standard. Audit Manager includes prebuilt (standard) frameworks for standards such as CIS AWS Foundations Benchmark, PCI DSS, GDPR, HIPAA, SOC 2 and AWS operational best practices. You can also build custom frameworks from standard or custom controls for internal audits, and share them with another account or copy them to another Region.
- Controls. Each control describes a requirement and defines which data sources supply evidence for it. You can create custom controls from scratch or from a copy of an existing control.
- Assessments. An assessment applies a framework to the AWS accounts you put in scope. Evidence collection starts when you create the assessment and continues until you set it to inactive.
How evidence is collected
Audit Manager runs resource assessments against in-scope resources and turns the results into evidence attached to the relevant controls. The evidence collection guide describes four automated sources and one manual one:
- AWS Config. Compliance check results from AWS Config rules, collected according to each rule’s trigger. You need to deploy the rules yourself, through AWS Config or AWS Control Tower.
- AWS Security Hub CSPM. Results of Security Hub CSPM security checks, following the schedule of those checks.
- AWS CloudTrail. User activity evidence, collected continually from CloudTrail logs.
- AWS API calls. Configuration snapshots from describe-style API calls to services such as Amazon EC2, Amazon S3 and IAM, at a daily, weekly or monthly frequency that you set on the control.
- Manual evidence. Files you upload (for example, policies or records from on-premises or other environments) and answers to questions defined in custom controls.
Evidence from Config and Security Hub CSPM arrives with a compliance result. Evidence from CloudTrail, API calls and manual uploads is marked inconclusive, which does not mean failure; it means a person has to review it.
Delegation and reports
Audit owners can delegate control sets to subject matter experts, such as a network or identity team, who review the evidence, add comments and update control status. The evidence finder lets you search evidence across assessments and export results as CSV. When it is time for the audit, you select evidence and generate an assessment report: a summary that links to folders holding the detailed evidence, written to an S3 bucket you choose.
For automation, Audit Manager publishes events to Amazon EventBridge, so you can route assessment and evidence events to Amazon SNS, AWS Lambda or a ticketing workflow.
What Audit Manager does not prove
This is the most important limit to understand. AWS states that Audit Manager helps collect evidence relevant to a standard, but it does not assess your compliance itself, the evidence it collects may not include everything an audit needs, and it is not a substitute for legal counsel or compliance experts (What is AWS Audit Manager?).
In practice:
- Many controls in a framework are procedural (documented policies, training, vendor reviews). Audit Manager can hold manual evidence for them but cannot check them.
- A passing Config rule shows a resource setting at a point in time. It does not show that the process behind it works.
- Audit Manager does not remediate non-compliant resources.
- AWS Artifact is different: it provides AWS’s own compliance reports for the AWS infrastructure, while Audit Manager is about evidence of how you use AWS.
Alternatives for new customers
AWS points new customers to conformance packs in AWS Config. A conformance pack deploys a group of Config rules (with optional remediation) to one account or across an organization, and AWS provides sample templates for frameworks such as HIPAA, NIST and PCI DSS. AWS also notes the gaps: there is no conformance pack template for some Audit Manager frameworks, including SOC 2 and GDPR, Config records configuration items rather than CloudTrail or Security Hub evidence, and it has no audit report export equivalent to Audit Manager’s.
Other options AWS lists:
- AWS Security Hub CSPM security standards, for the frameworks it covers (such as NIST SP 800-53 and PCI DSS), with compliance scores and per-resource findings.
- AWS Control Tower controls, which can be deployed by framework to organizational units.
- Partner compliance platforms used alongside AWS Config, for the procedural controls that no Config rule can verify.
If you plan to disable Audit Manager, AWS recommends enabling evidence finder first, because it exports evidence to a CloudTrail Lake event data store that remains accessible afterwards.
How 9Acts can help
9Acts is an AWS Advanced Tier Services Partner and holds the AWS Level 1 MSSP Competency. We help teams decide what to keep in Audit Manager, set up AWS Config conformance packs and Security Hub CSPM standards, and organize evidence for auditors. See our security and compliance services or contact us.