AWS Artifact
On-demand access to AWS security and compliance documents: SOC, PCI, and ISO reports and certifications, documents from AWS Marketplace vendors, reviewing and accepting agreements such as the HIPAA BAA for an account or an organization, notifications, Assurance Assistant, and cost.
2 min read · Last reviewed · SAA-C03
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
AWS Artifact provides on-demand downloads of AWS security and compliance documents. Examples are SOC (System and Organization Controls) reports, PCI DSS (Payment Card Industry Data Security Standard)The security standard for organizations that store, process, or send payment card data. AWS is assessed as a PCI DSS Level 1 service provider, but each customer is still responsible for the compliance of what it builds.Glossary entry (Payment Card Industry) reports, ISO certification reports, and certifications from accreditation bodies that validate AWS security controls. It also provides security and compliance documents from independent software vendors that sell on AWS Marketplace.
Artifact is also where you review, accept, and track agreements with AWS, for one account or for all accounts in an organization. For example, companies subject to HIPAA (Health Insurance Portability and Accountability Act)A US law that protects health information. AWS customers can process protected health information on HIPAA-eligible services after accepting a Business Associate Addendum (BAA) with AWS, which is available in AWS Artifact.Glossary entry accept the Business Associate Addendum (BAA) in Artifact to process protected health information on AWS.
Choose Artifact when a question asks where an auditor or compliance team can get AWS's compliance reports (such as a SOC 2 or PCI report), or how to accept an agreement such as the BAA.
Concepts
- Reports: download AWS audit reports and certifications to share with auditors or regulators, as evidence for the AWS part of the .
- Agreements: review and accept agreements for an account or, with AWS Organizations, for the whole organization.
- Notifications: email alerts when new reports or agreements become available.
- Assurance Assistant: AI-generated answers to compliance and due diligence questions.
- Cost: Artifact documents and agreements are free of charge.
Artifact or another option?
| If the requirement is | Choose |
|---|---|
| Download AWS's SOC, PCI, or ISO reports | AWS Artifact |
| Accept the HIPAA BAA for the organization | AWS Artifact agreements |
| Check our own resources against PCI DSS or CIS | AWS Security Hub CSPM (Cloud security posture management)Continuously checking cloud resources against security best practices and standards, and reporting misconfigurations, such as a public S3 bucket. AWS Security Hub CSPM runs these checks across AWS accounts.Glossary entry |
| Continuous configuration compliance of our resources | AWS Config |
| Audit our own API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry activity | AWS CloudTrail |
Reverse mindmap: when the question points here
- Yes, when the question says
- Auditor needs AWS's SOC 2 report leads to AWS Artifact
- Evidence of AWS PCI or ISO compliance leads to AWS Artifact reports
- Accept the HIPAA Business Associate Addendum leads to AWS Artifact agreements
- Accept an agreement for every account leads to Artifact with AWS Organizations
- No, when the question says
- Check our own resources' compliance leads to Security Hub or Config
Key takeaways
- AWS Artifact is a free, self-service portal for AWS compliance reports (SOC, PCI, ISO, and more) and Marketplace vendor documents.
- It is also where you review and accept agreements such as the HIPAA BAA, for one account or a whole organization.
- It proves AWS's side of compliance; Security Hub and Config check your own resources.