AWS Audit Manager Diagnostics
When to use
Any AWS Audit Manager investigation — assessment creation, framework selection, control evaluation, evidence collection, delegation management, report generation, or custom framework configuration.
Investigation workflow
Step 1 — Collect and triage
aws auditmanager get-settings --attribute ALL
aws auditmanager list-assessments --query 'assessmentMetadata[*].{Id:id,Name:name,Status:status}'
version: "1.0.0"
last_updated: "2025-04-12"
aws auditmanager list-assessment-frameworks --frameworkType Standard --query 'frameworkMetadataList[*].{Id:id,Name:name,Type:type}'
version: "1.0.0"
last_updated: "2025-04-12"
Step 2 — Domain deep dive
aws auditmanager get-assessment --assessment-id <id>
aws auditmanager get-evidence-folder --assessment-id <id> --control-set-id <set-id> --evidence-folder-id <folder-id>
aws auditmanager list-assessment-control-insights-by-control-domain --control-domain-id <domain-id>
Step 3 — Detailed investigation
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=auditmanager.amazonaws.com --max-results 20
aws auditmanager get-assessment-report-url --assessment-id <id> --assessment-report-id <report-id>
aws config describe-config-rules --query 'ConfigRules[*].{Name:ConfigRuleName,State:ConfigRuleState}'
version: "1.0.0"
last_updated: "2025-04-12"
Read references/guardrails.md before concluding on any Audit Manager issue.
Tool quick reference
| Tool / API |
When to use |
auditmanager list-assessments |
List assessments |
auditmanager get-assessment |
Get assessment details |
auditmanager list-assessment-frameworks |
List frameworks |
auditmanager get-evidence-folder |
Get evidence details |
auditmanager create-assessment |
Create new assessment |
auditmanager get-settings |
Check Audit Manager settings |
Gotchas: AWS Audit Manager
- Audit Manager requires AWS Config to be enabled for automated evidence collection. Without Config, many controls cannot collect evidence automatically.
- Evidence collection is NOT real-time. It follows a schedule based on the control type. Manual evidence must be uploaded separately.
- Frameworks are templates — they define which controls to evaluate. Standard frameworks (CIS, PCI DSS, SOC 2) cannot be modified. Create custom frameworks for modifications.
- Delegation assigns control sets to team members for review. Delegates need IAM permissions to access Audit Manager and the delegated assessment.
- Assessment reports are generated as PDF/CSV and stored in the configured S3 bucket. The S3 bucket must exist and have proper permissions.
- Audit Manager is regional. Assessments in one region don't include resources from other regions.
Anti-hallucination rules
- Always cite specific assessment IDs, control statuses, or API responses as evidence.
- AWS Config must be enabled for automated evidence. Never assume evidence collection works without Config.
- Standard frameworks cannot be modified. Never suggest editing built-in frameworks.
- Evidence collection is scheduled, not real-time. Never claim instant evidence.
- Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.
14 runbooks
| Category |
IDs |
Covers |
| A — Assessment |
A1-A2 |
Creation, configuration |
| B — Frameworks |
B1-B2 |
Standard frameworks, custom frameworks |
| C — Controls |
C1-C2 |
Control evaluation, control status |
| D — Evidence |
D1-D3 |
Automated collection, manual evidence, evidence quality |
| E — Delegation |
E1-E2 |
Delegation setup, delegate access |
| F — Reports |
F1-F2 |
Report generation, report access |
| Z — Catch-All |
Z1 |
General troubleshooting |
1---2name: auditmanager-diagnostics3description: Use this skill to investigate and troubleshoot AWS Audit Manager problems by analyzing assessment creation, frameworks, controls, evidence collection, delegation, reports, custom frameworks, and following structured runbooks. Activate when: assessment creation failures, framework issues, control evaluation errors, evidence collection problems, delegation failures, report generation errors, custom framework issues, or the user says something is wrong with Audit Manager.4---56# AWS Audit Manager Diagnostics78## When to use910Any AWS Audit Manager investigation — assessment creation, framework selection, control evaluation, evidence collection, delegation management, report generation, or custom framework configuration.1112## Investigation workflow1314### Step 1 — Collect and triage1516```17aws auditmanager get-settings --attribute ALL18aws auditmanager list-assessments --query 'assessmentMetadata[*].{Id:id,Name:name,Status:status}'19version: "1.0.0"20last_updated: "2025-04-12"21aws auditmanager list-assessment-frameworks --frameworkType Standard --query 'frameworkMetadataList[*].{Id:id,Name:name,Type:type}'22version: "1.0.0"23last_updated: "2025-04-12"24```2526### Step 2 — Domain deep dive2728```29aws auditmanager get-assessment --assessment-id <id>30aws auditmanager get-evidence-folder --assessment-id <id> --control-set-id <set-id> --evidence-folder-id <folder-id>31aws auditmanager list-assessment-control-insights-by-control-domain --control-domain-id <domain-id>32```3334### Step 3 — Detailed investigation3536```37aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=auditmanager.amazonaws.com --max-results 2038aws auditmanager get-assessment-report-url --assessment-id <id> --assessment-report-id <report-id>39aws config describe-config-rules --query 'ConfigRules[*].{Name:ConfigRuleName,State:ConfigRuleState}'40version: "1.0.0"41last_updated: "2025-04-12"42```4344Read `references/guardrails.md` before concluding on any Audit Manager issue.4546## Tool quick reference4748| Tool / API | When to use |49|------------|-------------|50| `auditmanager list-assessments` | List assessments |51| `auditmanager get-assessment` | Get assessment details |52| `auditmanager list-assessment-frameworks` | List frameworks |53| `auditmanager get-evidence-folder` | Get evidence details |54| `auditmanager create-assessment` | Create new assessment |55| `auditmanager get-settings` | Check Audit Manager settings |5657## Gotchas: AWS Audit Manager5859- Audit Manager requires AWS Config to be enabled for automated evidence collection. Without Config, many controls cannot collect evidence automatically.60- Evidence collection is NOT real-time. It follows a schedule based on the control type. Manual evidence must be uploaded separately.61- Frameworks are templates — they define which controls to evaluate. Standard frameworks (CIS, PCI DSS, SOC 2) cannot be modified. Create custom frameworks for modifications.62- Delegation assigns control sets to team members for review. Delegates need IAM permissions to access Audit Manager and the delegated assessment.63- Assessment reports are generated as PDF/CSV and stored in the configured S3 bucket. The S3 bucket must exist and have proper permissions.64- Audit Manager is regional. Assessments in one region don't include resources from other regions.6566## Anti-hallucination rules67681. Always cite specific assessment IDs, control statuses, or API responses as evidence.692. AWS Config must be enabled for automated evidence. Never assume evidence collection works without Config.703. Standard frameworks cannot be modified. Never suggest editing built-in frameworks.714. Evidence collection is scheduled, not real-time. Never claim instant evidence.725. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.7374## 14 runbooks7576| Category | IDs | Covers |77|----------|-----|--------|78| A — Assessment | A1-A2 | Creation, configuration |79| B — Frameworks | B1-B2 | Standard frameworks, custom frameworks |80| C — Controls | C1-C2 | Control evaluation, control status |81| D — Evidence | D1-D3 | Automated collection, manual evidence, evidence quality |82| E — Delegation | E1-E2 | Delegation setup, delegate access |83| F — Reports | F1-F2 | Report generation, report access |84| Z — Catch-All | Z1 | General troubleshooting |
aws-samples