audit-manager

This component is responsible for configuring AWS Audit Manager within an AWS Organization.

AWS Audit Manager helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards. It automates evidence collection, organizes compliance data, and generates audit-ready reports.

Key Features

Prebuilt Frameworks: AWS Control Tower, CIS, FedRAMP, GDPR, HIPAA, PCI DSS, SOC 2, NIST 800-53
Custom Controls: Build custom frameworks and controls for specific business requirements
Automated Evidence: Collects evidence from CloudTrail, Config, Security Hub, License Manager
Multi-account: Supports assessments across multiple AWS accounts via AWS Organizations
Delegation Workflow: Delegate control sets to specialized team members
Evidence Search: Search through thousands of pieces of collected evidence with filters and groupings
Assessment Reports: Cryptographically verified reports with organized evidence
Manual Evidence: Upload policy documents, training transcripts, architecture diagrams

Architecture

Audit Manager uses a unique single-step deployment model different from other AWS security services:

Component	Description
Organization Management Account	Enables Audit Manager AND delegates administration in a single deployment
Delegated Administrator Account	Receives delegated administration automatically, creates/manages assessments
Member Accounts	Evidence automatically collected, no additional configuration required

Deployment Model Comparison

Aspect	AWS Audit Manager	AWS Inspector2	AWS Access Analyzer
Deployment Approach	Single-step in root account only	Delegated administrator (2 steps)	Delegated administrator (2 steps)
Member Account Setup	No setup (evidence auto-collected)	Auto-enabled by delegated admin	No setup (auto-analyzed)
Provisioning Steps	1 step (root only)	2 steps (root → security)	2 steps (root → security)

Regional Deployment

Audit Manager is a regional service. You must deploy it to each region where you want to run compliance assessments. Assessment reports are stored in region-specific S3 buckets.

Service-Linked Role

AWS Audit Manager automatically creates a service-linked role when you enable the service. No manual role creation is required.

Assessment Report S3 Buckets

When generating assessment reports, Audit Manager publishes reports to an S3 bucket of your choice:

Same-Region Buckets: Recommended. Supports up to 22,000 evidence items (vs. 3,500 for cross-region)
Encryption: If using SSE-KMS, the KMS key must match your Audit Manager data encryption settings
Account: Use buckets in the delegated administrator account (cross-account not recommended)
Per-Region: Create a bucket in each region where you'll run assessments

Configuration

Defaults (Abstract Component)

components:
  terraform:
    audit-manager/defaults:
      metadata:
        component: audit-manager
        type: abstract
      vars:
        enabled: true
        global_environment: gbl
        account_map_tenant: core
        root_account_stage: root
        delegated_administrator_account_name: core-security
        deregister_on_destroy: true

Root Account Configuration (Single-Step Deployment)

import:
  - catalog/audit-manager/defaults

components:
  terraform:
    # Single-step: Enable Audit Manager and delegate administration
    audit-manager/root:
      metadata:
        component: audit-manager
        inherits:
          - audit-manager/defaults
      vars:
        # Requires SuperAdmin permissions
        privileged: true

Provisioning

Deploy to the organization management (root) account for each region where you want assessments:

# Deploy to us-east-1
atmos terraform apply audit-manager/root -s plat-use1-root

# Deploy to us-west-2
atmos terraform apply audit-manager/root -s plat-usw2-root

This single deployment:

Enables Audit Manager in the organization
Delegates administration to the security account
Begins automatic evidence collection from member accounts

Assessment Report S3 Bucket Setup

Create S3 buckets in the delegated administrator (security) account for each region:

# stacks/catalog/s3-bucket/audit-manager-reports.yaml
import:
  - catalog/s3-bucket/defaults

components:
  terraform:
    audit-manager-reports-bucket:
      metadata:
        component: s3-bucket
        inherits:
          - s3-bucket/defaults
      vars:
        enabled: true
        name: audit-manager-reports
        s3_object_ownership: "BucketOwnerEnforced"
        versioning_enabled: false

Deploy to each region in the security account:

atmos terraform apply audit-manager-reports-bucket -s plat-use1-security
atmos terraform apply audit-manager-reports-bucket -s plat-usw2-security

Creating Assessments

After deploying Audit Manager, create assessments in the delegated administrator account:

Via Console: AWS Audit Manager console → Assessments → Create assessment
Via CLI: Use aws auditmanager CLI commands
Via Terraform: Use aws_auditmanager_assessment resource

Assessment Components:

Framework: Choose prebuilt or custom framework
Scope: Select AWS accounts and services to assess
Roles: Define who can access the assessment
Report Destination: Specify S3 bucket for reports

Cost Considerations

Assessment Price: Based on number of evidence items collected per month
Evidence Storage: S3 storage costs for assessment reports
Evidence Finder: Additional cost if enabling CloudTrail Lake integration
Free Tier: Limited free usage during first 13 months
Regional: Costs are per region

See AWS Audit Manager Pricing for current rates.

Compliance Frameworks Supported

Audit Manager provides prebuilt frameworks for common compliance standards:

PCI DSS: Payment Card Industry Data Security Standard
HIPAA: Health Insurance Portability and Accountability Act
SOC 2: Service Organization Control 2
NIST 800-53: National Institute of Standards and Technology (Rev 4 and Rev 5)
FedRAMP: Federal Risk and Authorization Management Program
GDPR: General Data Protection Regulation
ISO 27001: Information Security Management
CIS: Center for Internet Security benchmarks (v1.2.0, v1.3.0, v1.4.0, v7.1, v8)
GxP: Good Practice quality guidelines (21 CFR Part 11)
AWS Control Tower: AWS Control Tower guardrails

References

AWS Documentation

Terraform Resources

Additional Resources

Variables

Required Variables

Optional Variables

Context Variables

The following variables are defined in the context.tf file of this module and part of the terraform-null-label pattern.

additional_tag_map (map(string)) optional

Additional key-value pairs to add to each map in tags_as_list_of_maps. Not added to tags or id.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.

Required: No

Default value: { }

attributes (list(string)) optional

ID element. Additional attributes (e.g. workers or cluster) to add to id,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the delimiter
and treated as a single ID element.

Required: No

Default value: [ ]

context (any) optional

Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as null to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.

Required: No

Default value:

{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}

delimiter (string) optional

Delimiter to be used between ID elements.
Defaults to - (hyphen). Set to "" to use no delimiter at all.

Required: No

Default value: null

descriptor_formats (any) optional

Describe additional descriptors to be output in the descriptors output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
\{<br/> format = string<br/> labels = list(string)<br/> \}
(Type is any so the map values can later be enhanced to provide additional options.)
format is a Terraform format string to be passed to the format() function.
labels is a list of labels, in order, to pass to format() function.
Label values will be normalized before being passed to format() so they will be
identical to how they appear in id.
Default is {} (descriptors output will be empty).

Required: No

Default value: { }

enabled (bool) optional

Set to false to prevent the module from creating any resources
Required: No

Default value: null

environment (string) optional

ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'
Required: No

Default value: null

id_length_limit (number) optional

Limit id to this many characters (minimum 6).
Set to 0 for unlimited length.
Set to null for keep the existing setting, which defaults to 0.
Does not affect id_full.

Required: No

Default value: null

label_key_case (string) optional

Controls the letter case of the tags keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the tags input.
Possible values: lower, title, upper.
Default value: title.

Required: No

Default value: null

label_order (list(string)) optional

The order in which the labels (ID elements) appear in the id.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.

Required: No

Default value: null

label_value_case (string) optional

Controls the letter case of ID elements (labels) as included in id,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the tags input.
Possible values: lower, title, upper and none (no transformation).
Set this to title and set delimiter to "" to yield Pascal Case IDs.
Default value: lower.

Required: No

Default value: null

labels_as_tags (set(string)) optional

Set of labels (ID elements) to include as tags in the tags output.
Default is to include all labels.
Tags with empty values will not be included in the tags output.
Set to [] to suppress all generated tags.
Notes:
The value of the name tag, if included, will be the id, not the name.
Unlike other null-label inputs, the initial setting of labels_as_tags cannot be
changed in later chained modules. Attempts to change it will be silently ignored.

Required: No

Default value:

[
  "default"
]

name (string) optional

ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a tag.
The "name" tag is set to the full id string. There is no tag with the value of the name input.

Required: No

Default value: null

namespace (string) optional

ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique
Required: No

Default value: null

regex_replace_chars (string) optional

Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits.

Required: No

Default value: null

stage (string) optional

ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'
Required: No

Default value: null

tags (map(string)) optional

Additional tags (e.g. {'BusinessUnit': 'XYZ'}).
Neither the tag keys nor the tag values will be modified by this module.

Required: No

Default value: { }

tenant (string) optional

ID element (Rarely used, not included by default). A customer identifier, indicating who this instance of a resource is for
Required: No

Default value: null

Outputs

mock: Mock output example for the Cloud Posse Terraform component template

Dependencies

Requirements

terraform, version: >= 1.3.0
aws, version: >= 4.66.1, < 6.0.0

Modules

Name	Version	Source	Description
`this`	0.25.0	`cloudposse/label/null`	n/a

Key Features​

Architecture​

Deployment Model Comparison​

Regional Deployment​

Service-Linked Role​

Assessment Report S3 Buckets​

Configuration​

Defaults (Abstract Component)​

Root Account Configuration (Single-Step Deployment)​

Provisioning​

Assessment Report S3 Bucket Setup​

Creating Assessments​

Cost Considerations​

Compliance Frameworks Supported​

References​

AWS Documentation​

Terraform Resources​

Additional Resources​

Variables​

Required Variables​

Optional Variables​

Context Variables​

Outputs​

Dependencies​

Requirements​

Modules​

Key Features

Architecture

Deployment Model Comparison

Regional Deployment

Service-Linked Role

Assessment Report S3 Buckets

Configuration

Defaults (Abstract Component)

Root Account Configuration (Single-Step Deployment)

Provisioning

Assessment Report S3 Bucket Setup

Creating Assessments

Cost Considerations

Compliance Frameworks Supported

References

AWS Documentation

Terraform Resources

Additional Resources

Variables

Required Variables

Optional Variables

Context Variables

Outputs

Dependencies

Requirements

Modules