AWS compliance means AWS has had its infrastructure assessed against frameworks and publishes reports you can use as evidence. It does not make your workload compliant. Under the shared responsibility model, you still configure services, manage access, protect data and secure your own code.
What does AWS cover and what do you cover?
AWS describes the split as security "of" the cloud and security "in" the cloud. AWS is responsible for the facilities, hardware, networking and the software that runs its services. The customer is responsible for what they put in the cloud and how they configure it.
The line moves with the service. With a virtual machine you manage the operating system, patching and firewall rules. With a managed database AWS patches the engine, but you still control who can connect, how data is encrypted and which backups exist. With a serverless function you give up the server, not the application code or its permissions.
Where do you find the evidence?
AWS Artifact is the portal where customers download AWS compliance reports and review certain agreements. An auditor asking about the physical security of a data center can usually be pointed to the relevant report instead of a site visit. Reports are listed by name and scope, so check which services and regions a report covers before you cite it.
Read the scope carefully. A report that covers a service does not mean your use of that service was configured correctly. Treat it as proof for the layer AWS owns.
Constructed example: a payments feature
A team builds a feature that stores card related data on AWS. During an audit, the assessor asks four questions. Is the data center secure? That points to AWS Artifact. Is data encrypted at rest with keys you control? That is a configuration you must show. Who can read the storage? That is your access policy. Does the application validate input? That is your code.
Only one of the four is answered by the AWS report. The other three need your own evidence, such as configuration exports, access reviews and test results.
Which controls fall to you almost every time?
- Identity: least privilege policies, multi factor authentication, key rotation.
- Logging: audit trails switched on, retained and protected from tampering.
- Data: encryption, classification and deletion rules.
- Network: restrictive security groups and no needless public exposure.
- Software: patching, dependency management and secure development practices.
The last item is where many teams have no cloud-side answer. Frameworks such as the NIST Secure Software Development Framework (SP 800-218) ask you to manage vulnerabilities in your own and third party code. Safeguard's compliance automation maps findings from dependency and code scanning to framework controls so that evidence stays current. It helps you gather and organize proof. It does not certify you for anything, and no tool does that. Only an auditor or assessor can.
What do auditors usually ask for?
Expect requests for evidence of the customer side: a list of accounts and regions, identity and access reviews, encryption settings, logging configuration and retention, vulnerability scan results, and your incident response plan. Auditors also like to see that checks repeat on a schedule, so a point in time screenshot is weaker than a report generated every month.
Keep the mapping in one place. A simple table with each control, the owner (AWS or you), the evidence source and the last review date saves hours at audit time and shows gaps early.
How to check or apply this
- Write down which frameworks you must meet and who asks for proof, whether customers, regulators or auditors.
- Download the relevant AWS reports from Artifact and note the services and regions in scope.
- List every AWS service you use and mark who owns each control for it, AWS or you.
- Collect your own evidence for each customer owned control: configuration exports, access reviews, logs.
- Automate checks where you can, so evidence does not go stale between audits.
- Cover your application layer separately, including dependencies and code scanning results.
- Review the mapping whenever you adopt a new service or region.
Quick check
If AWS is certified, am I compliant?
No. AWS assessments cover AWS's layer. Your configuration, access control, data handling and application code remain yours to demonstrate.
Where do I get AWS compliance reports?
From AWS Artifact, which provides on demand access to AWS compliance reports for customers with an account.
Sources
- AWS shared responsibility model
- What is AWS Artifact
- NIST SP 800-218, Secure Software Development Framework
Last reviewed: 18 October 2026.
