Security Audits on AWS: What You Need to Know

What a security audit is

A security audit is an independent, structured check of whether your security controls exist and work as described. An auditor compares your policies, configurations and records against a defined set of requirements, such as a standard or a contract, and reports where you meet them and where you do not.

Audits differ from vulnerability scans and penetration tests. A scan or pen test looks for technical weaknesses at a point in time. An audit asks whether you have the right controls, whether they are documented, and whether you can prove they operated over a period. A good security program uses all three.

Common audit types

SOC 2

SOC 2 is an attestation framework from the American Institute of Certified Public Accountants (AICPA). A CPA firm reports on controls relevant to the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Security is always in scope; the others are chosen based on what you offer customers. A Type 1 report covers control design at a point in time. A Type 2 report covers whether controls operated effectively over a period, often six to twelve months, and is what most enterprise customers ask for.

ISO/IEC 27001

ISO/IEC 27001 is an international standard for an information security management system (ISMS). An accredited certification body audits whether you have a working ISMS: risk assessment, a statement of applicability for the controls in Annex A, internal audits and management review. Certification is followed by surveillance audits and periodic recertification.

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is a standard maintained by the PCI Security Standards Council. It applies to any organization that stores, processes or transmits cardholder data. Depending on transaction volume and card brand rules, you validate compliance either through a Qualified Security Assessor (QSA) producing a Report on Compliance, or through a Self-Assessment Questionnaire. PCI DSS v3.2.1 was retired in 2024, so assessments now use version 4 of the standard. Reducing the scope of the cardholder data environment, for example by using a payment provider’s hosted fields or tokenization, is often the most effective way to reduce audit effort.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a US law, and the HIPAA Security Rule sets safeguards for electronic protected health information (ePHI). There is no official government HIPAA certification. Organizations demonstrate compliance through risk analyses, policies, safeguards and documentation, and sometimes through third-party assessments. If you store or process ePHI on AWS, you need a Business Associate Addendum (BAA) with AWS and must keep ePHI on HIPAA eligible services. Other services can still be used for parts of the workload that do not store or process ePHI.

The shared responsibility model

On AWS, audit scope is split by the shared responsibility model. AWS is responsible for security of the cloud: the facilities, hardware, network and the software that runs AWS services. You are responsible for security in the cloud: identity and access management, network configuration, encryption choices, operating system patching on EC2, application security and your data.

How much falls on you depends on the service. With Amazon EC2 you manage the guest operating system. With a managed service such as Amazon RDS or AWS Lambda, AWS handles more of the stack, and your responsibilities center on configuration, access and data.

For audits, this means you can inherit AWS’s controls for the physical and infrastructure layers but must evidence your own controls for everything you configure.

AWS Artifact

AWS Artifact is a no-cost portal in the AWS Management Console where you download AWS’s own security and compliance reports, including SOC reports, PCI attestation documents and ISO certifications. Your auditor uses these to rely on AWS’s controls for the layers AWS manages. You also review and accept agreements in AWS Artifact, such as the BAA for HIPAA workloads, for a single account or across your organization.

These documents cover AWS, not your workload. You still need evidence for your own controls.

Collecting evidence on AWS

Most audit effort goes into evidence: showing that a control exists and operated. AWS services can produce much of it automatically.

AWS Config and conformance packs

AWS Config records resource configurations and changes over time and evaluates them against rules. A conformance pack is a collection of AWS Config rules and remediation actions that you deploy as one unit to an account or across an organization. AWS provides sample templates mapped to frameworks, such as Operational Best Practices for PCI DSS 4.0, Operational Best Practices for HIPAA Security and Operational Best Practices for NIST 800-53 rev 5. AWS states that these templates are not designed to ensure compliance with a standard and cannot guarantee you pass an assessment, so treat them as a starting point to adapt.

AWS Security Hub CSPM

AWS Security Hub CSPM runs automated checks against standards such as the CIS AWS Foundations Benchmark, PCI DSS and AWS Foundational Security Best Practices, and aggregates findings from services such as Amazon GuardDuty and Amazon Inspector. Its compliance scores and findings history show auditors that you monitor continuously, not just before the audit.

AWS CloudTrail

CloudTrail records API activity across your accounts. An organization trail with log file integrity validation, delivered to a separate log archive account, is the backbone of evidence for access control, change management and incident response controls.

AWS Audit Manager

AWS Audit Manager maps evidence from AWS Config, Security Hub CSPM and CloudTrail to prebuilt frameworks such as SOC 2, PCI DSS, HIPAA and the CIS benchmarks, and generates assessment reports. Note that Audit Manager is no longer open to new customers; existing customers can continue to use it. New programs should plan evidence collection around AWS Config, Security Hub CSPM and CloudTrail directly, or a third-party compliance platform. AWS also notes that Audit Manager does not assess compliance itself and is not a substitute for legal or compliance experts.

Evidence outside AWS

Auditors also ask for things no AWS service produces: security policies, risk assessments, access review records, security awareness training records, vendor assessments, incident response test results and change approval records. Keep these in one place with clear owners and dates.

Getting audit-ready

A practical sequence for a first audit:

1. Pick the framework and scope. Decide which standard your customers or regulators require and which accounts, systems and teams are in scope. Smaller scope means less work.
2. Download AWS’s reports from AWS Artifact and identify which controls you inherit.
3. Run a gap assessment. Compare your current controls with the framework’s requirements. Deploy the matching conformance pack and enable Security Hub CSPM standards to find technical gaps quickly.
4. Fix and document. Close the gaps, write or update policies, and assign an owner to each control.
5. Collect evidence continuously. For SOC 2 Type 2 and similar audits, evidence must cover the whole audit period, so start collecting before the period begins.
6. Do a readiness review. Many audit firms offer a readiness assessment before the formal audit. Use it.

Working with 9Acts

9Acts is an AWS Advanced Tier Services Partner and holds the AWS Level 1 MSSP Competency. If you are preparing an AWS environment for an audit, see our security and compliance service.