AWS Artifact
- What it is
- Self-service portal for AWS’s own compliance documentation, at no cost.
- Two parts
- Artifact Reports — download AWS audit artifacts: SOC 1/2/3, PCI DSS attestation of compliance, ISO 27001/27017/27018 certifications, FedRAMP packages.
- Artifact Agreements — review, accept, and manage legal agreements such as the Business Associate Addendum (BAA) for HIPAA, and the GDPR data processing addendum.
- What it does not do
- It says nothing about your compliance. It only proves the security of the cloud, not security in the cloud.
- Not to be confused with
- AWS Audit Manager — evidence about your own workloads.
- AWS Config / AWS Security Hub — your resource posture.
- Exam signal
- “Where do I get AWS’s SOC 2 report / sign a BAA?” → AWS Artifact.