Compliant

A Compliant system can demonstrate its controls and produce evidence on demand, without a two-week scramble for screenshots. The AWS Baseline evaluates every account continuously against a SOC 2 baseline, keeps a library of framework packs and standards ready to switch on, makes the audit trail tamper-evident, and gives auditors read access that cannot reach data.

Continuous evaluation

Two services evaluate configuration against frameworks, and each is a switch rather than a project:

Service	Runs from	What is on by default	What is available
AWS Config conformance packs	Management account, aggregated in the audit account	The BuiltForProd-soc2-baseline pack (encrypted volumes, multi-region CloudTrail, S3 SSL-only, MFA for the console, no root access keys, VPC Flow Logs and similar rules)	28 further packs: HIPAA, PCI DSS v4 (with and without global resource types), NIST CSF, CMMC 2.0 levels 1 and 2, CIS Controls v8 IG1 to IG3, Well-Architected Security and Reliability, encryption and keys, and service packs for S3, IAM, EKS, RDS, Lambda, WAF and more
Security Hub standards	security account as delegated administrator, aggregated across regions	Security Hub itself, with GuardDuty and Access Analyzer integrated	CIS AWS Foundations Benchmark v5.0.0, AWS Foundational Security Best Practices, PCI DSS v4.0.1 and the Resource Tagging standard, each a key in security_hub_standards

The sandbox account is excluded from conformance packs. AWS Config records every supported resource type in every account and region, so the configuration history behind each evaluation is complete. The AWS Config and Security Hub explainers describe the two services.

Framework to switch

The compliance guide delivered with the repositories maps each framework to what to enable:

Framework	Security Hub standards	Conformance packs
SOC 2	cis_v5, fsbp	soc2-baseline (on by default), nist-csf, encryption-keys
CIS v5	cis_v5	cis-controls-v8-ig1, -ig2, -ig3
PCI DSS v4.0.1	pci_dss_v4	pci-dss-v4-incl-global
HIPAA and HITECH	fsbp	hipaa-security
NIST SP 800-53 Rev 5	fsbp	nist-csf, encryption-keys
NIST SP 800-171 Rev 2	fsbp	nist-csf, cis-controls-v8-ig2
FedRAMP Moderate	fsbp, pci_dss_v4	nist-csf, encryption-keys
CMMC 2.0	fsbp	cmmc-2-level-1, cmmc-2-level-2
AWS Well-Architected	fsbp	wa-security-pillar, wa-reliability-pillar

Each standard adds checks and therefore Security Hub cost, which is why they are off until a requirement exists. Through CODEOWNERS, security.hcl is owned by the infra admins and the security team.

Evidence that cannot be altered

• One organization CloudTrail, multi-region, with log file validation, KMS encryption and delivery to the audit bucket; management events for every account and S3 data events for the audit bucket itself.
• The audit bucket in a dedicated log-archive account: versioned, encrypted with a dedicated key, TLS-only, current objects never deleted.
• The acme-audit-protection SCP denies stopping, deleting or updating CloudTrail and stopping or deleting the Config recorder and delivery channel to everyone but the root user.
• Git history of every change, pipeline logs and the JSON run reports for every plan and apply.
• The organization tag policy pins the keys and values of Namespace, Environment, Stage, ManagedBy, Repository and Team, report-only until the compliance report is clean.

The CloudTrail explainer covers validation and delivery; the Observable page covers retention.

Access governance

• Human access goes through IAM Identity Center only; an SCP denies IAM users and access keys. Onboarding and offboarding are a group change.
• Two auditor permission sets, SecurityAuditorAccess and LeadSecurityAuditorAccess, grant SecurityAudit (the lead adds ReadOnlyAccess) with an explicit deny on s3:GetObject, ssm:GetParameter*, secretsmanager:GetSecretValue, database data and logs:GetLogEvents. An auditor sees every control and no customer data.
• The unused-access analyzer reports roles, users and permissions unused for 90 days.
• The Team and Access Management workbook defines a quarterly access audit: export group membership, cross-reference with active employees, remove orphaned accounts, review production access, document the result.

The least privilege page shows the full matrix.

Producing evidence

The compliance guide's procedures are read-only and run from the auditor profiles:

• Security Hub summary in the security account for the security score per standard and the findings behind it.
• Config conformance packs in the management account for the compliance score per pack, and the aggregator in the audit account for resource history.
• A quarterly evidence snapshot: Security Hub findings, conformance pack statuses, Config rule compliance, GuardDuty findings and Access Analyzer findings exported as JSON.
• External auditors receive a dedicated Identity Center group with ReadOnlyAccess to the security, audit and management accounts, never to workload accounts.

How you verify it

• Config console in the management account, Conformance packs: BuiltForProd-soc2-baseline deployed to every account except sandbox.
• Security Hub console in the security account: the enabled standards and the organization enrollment status.
• Organizations console: the acme-audit-protection SCP attached to both OUs.
• IAM Identity Center in the identity account: the two auditor permission sets with their inline deny.

The security posture summary condenses this page and the Secure page for a reviewer; the policy as code page explains why controls expressed in code produce evidence automatically.