Designing AWS compliance evidence that stays current

A control finding enters a review loop

Inventory and evaluation produce findings; response and evidence collection retain different responsibilities.

Inventory and evaluation produce findings; response and evidence collection retain different responsibilities.

Framework mappings organize evidence. They do not establish that an organization meets a framework.

• Assessment loop: Inventory: Config records selected resource types and Systems Manager adds managed-instance inventory. → Evaluate: Managed rules, Security Hub standards and custom checks produce control findings. → Triage: EventBridge routes known low-risk findings to bounded remediation and ambiguous findings to a person. → Collect evidence: Audit Manager maps evidence to selected framework controls; reviewers assess the organization and its scope.
• Inventory: AWS Config records configured resource types across onboarded accounts and regions; Systems Manager Inventory adds host-level details where its agent runs. AWS Organizations, AWS Config, Systems Manager Inventory
• Assessment: Managed rules and Security Hub standards assess generic controls; custom evaluations express organization policy. Config rules, Security Hub standards, Custom Lambda checks, ASFF findings
• Findings: Security Hub aggregates relevant findings from configuration and threat-detection services. Security Hub, GuardDuty, Inspector, Macie
• Response: EventBridge routes by type and severity to a bounded automated action or a human owner. Amazon EventBridge, Lambda, Systems Manager Automation, SNS
• Evidence: Audit Manager and protected storage support evidence collection and control mapping; assessors still determine compliance. AWS Audit Manager, Amazon S3, Object Lock, Config history
• How are organization-specific requirements checked? Managed standards cannot infer every classification rule, region policy or cross-resource relationship. Implement custom evaluations as reviewed code and publish their results in AWS Security Finding Format to Security Hub. Custom and managed findings can share triage, but the custom rules become software that must be tested and maintained.
• Which findings can be remediated automatically? A generic remediation can disrupt a production dependency or erase evidence of why a resource exists. Route only known, bounded cases to automation and send ambiguous cases for human review. Automation remains constrained by explicit policy and the owner can record a risk decision.
• Does mapped evidence prove the organization is compliant? A service configuration or framework mapping is not an independent assessment of the organization. Describe the pipeline as readiness support and leave audit, certification and assurance to the appropriate assessor. Collected evidence supports review without implying an outcome the architecture cannot establish.

The operational failure modes this design addresses.

Broad Config recording improves visibility but increases recorded-item volume and cost. Automated remediation can reduce toil but is dangerous when resource context is ambiguous. Custom rules cover local policy, but require tests, review and maintenance to avoid false passes or alert noise.

• Continuous evidence: Replace point-in-time screenshots with dated state. Configuration history and collected evidence help teams inspect how a control changed over time rather than infer the past from a current console view.
• Organization-specific controls: Evaluate the rules the managed standards cannot know. Custom checks can test required tags, classification-aware encryption, approved regions and relationships across resources.
• Safe remediation: Automate only bounded, understood actions. Event routing separates low-risk fixes from ambiguous findings that require a person; suppression should carry a reason and reviewer.
• AWS Config aggregates configured resource types across onboarded accounts and regions; Systems Manager adds managed-instance inventory where available.
• Standards and Config rules are complemented by organization-specific Lambda evaluations that publish findings to Security Hub.
• EventBridge routes findings to narrowly scoped remediation or a human, with documented handling for accepted risk.
• Audit Manager maps collected material to selected frameworks; it does not issue a compliance determination.

How the system is intended to work.

A compliance-readiness blueprint that gathers configuration evidence continuously, routes findings by risk, and keeps framework mapping separate from certification.

• Account and resource inventory: AWS Config aggregates configured resource types across onboarded accounts and regions; Systems Manager adds managed-instance inventory where available.
• Managed and custom controls: Standards and Config rules are complemented by organization-specific Lambda evaluations that publish findings to Security Hub.
• Severity-aware response: EventBridge routes findings to narrowly scoped remediation or a human, with documented handling for accepted risk.
• Evidence collection: Audit Manager maps collected material to selected frameworks; it does not issue a compliance determination.
• Inventory: AWS Config records configured resource types across onboarded accounts and regions; Systems Manager Inventory adds host-level details where its agent runs. AWS Organizations AWS Config Systems Manager Inventory
• Assessment: Managed rules and Security Hub standards assess generic controls; custom evaluations express organization policy. Config rules Security Hub standards Custom Lambda checks ASFF findings
• Findings: Security Hub aggregates relevant findings from configuration and threat-detection services. Security Hub GuardDuty Inspector Macie
• Response: EventBridge routes by type and severity to a bounded automated action or a human owner. Amazon EventBridge Lambda Systems Manager Automation SNS
• Evidence: Audit Manager and protected storage support evidence collection and control mapping; assessors still determine compliance. AWS Audit Manager Amazon S3 Object Lock Config history

Test the boundaries before relying on the design.

The following checks define evidence to collect before implementation is accepted. None is represented as already run.

• Account and resource inventory: AWS Config aggregates configured resource types across onboarded accounts and regions; Systems Manager adds managed-instance inventory where available.
• Managed and custom controls: Standards and Config rules are complemented by organization-specific Lambda evaluations that publish findings to Security Hub.
• Severity-aware response: EventBridge routes findings to narrowly scoped remediation or a human, with documented handling for accepted risk.
• Evidence collection: Audit Manager maps collected material to selected frameworks; it does not issue a compliance determination.
• Custom finding path: Create a controlled noncompliant test resource and confirm the custom check produces the expected Security Hub finding.
• Account onboarding: Add a test account and verify inventory and assessment are enabled for the approved resource and region scope.
• Remediation bounds: Verify an intended finding triggers only its allowed action and ambiguous findings route to human review.
• Evidence protection: Attempt the documented mutation path against archived evidence and verify the configured retention control blocks it.
• Exception review: Verify suppressed findings carry a rationale, owner and review record.
• No measured performance, cost, recovery or compliance outcome is published for this project.

A design that makes operational boundaries reviewable.

The intended value is a reviewable record of control state, findings and decisions. The design still needs deployment and validation before it can support an audit. No measured performance, cost, recovery or compliance outcome is published for this project.

• Inspect control history: Dated configuration and evidence records would let reviewers examine how a control changed, not just its current state.
• Assign findings to an owner: Bounded automation and human review would give each finding a documented response path.

Review the constraints before selecting the implementation.

Start with workload limits, owners and failure behavior. Then turn the validation plan into environment-specific tests and acceptance criteria.