# Auditmanager Diagnostics

> Use this skill to investigate and troubleshoot AWS Audit Manager problems by analyzing assessment creation, frameworks, controls, evidence collection, delegation, reports, custom frameworks, and following structured runbooks. Activate when: assessment creation failures, framework issues, control evaluation errors, evidence collection problems, delegation failures, report generation errors, custom framework issues, or the user says something is wrong with Audit Manager.

- Skill: `aws-samples/auditmanager-diagnostics` (Agent Skill, multi-file: 18 files)
- Install (CLI): `npx skillmds@latest add aws-samples/auditmanager-diagnostics`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aws-samples/auditmanager-diagnostics/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: aws-samples (https://skillmd.com/u/aws-samples)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aws-samples/auditmanager-diagnostics

---


# AWS Audit Manager Diagnostics

## When to use

Any AWS Audit Manager investigation — assessment creation, framework selection, control evaluation, evidence collection, delegation management, report generation, or custom framework configuration.

## Investigation workflow

### Step 1 — Collect and triage

```
aws auditmanager get-settings --attribute ALL
aws auditmanager list-assessments --query 'assessmentMetadata[*].{Id:id,Name:name,Status:status}'
version: "1.0.0"
last_updated: "2025-04-12"
aws auditmanager list-assessment-frameworks --frameworkType Standard --query 'frameworkMetadataList[*].{Id:id,Name:name,Type:type}'
version: "1.0.0"
last_updated: "2025-04-12"
```

### Step 2 — Domain deep dive

```
aws auditmanager get-assessment --assessment-id <id>
aws auditmanager get-evidence-folder --assessment-id <id> --control-set-id <set-id> --evidence-folder-id <folder-id>
aws auditmanager list-assessment-control-insights-by-control-domain --control-domain-id <domain-id>
```

### Step 3 — Detailed investigation

```
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=auditmanager.amazonaws.com --max-results 20
aws auditmanager get-assessment-report-url --assessment-id <id> --assessment-report-id <report-id>
aws config describe-config-rules --query 'ConfigRules[*].{Name:ConfigRuleName,State:ConfigRuleState}'
version: "1.0.0"
last_updated: "2025-04-12"
```

Read `references/guardrails.md` before concluding on any Audit Manager issue.

## Tool quick reference

| Tool / API | When to use |
|------------|-------------|
| `auditmanager list-assessments` | List assessments |
| `auditmanager get-assessment` | Get assessment details |
| `auditmanager list-assessment-frameworks` | List frameworks |
| `auditmanager get-evidence-folder` | Get evidence details |
| `auditmanager create-assessment` | Create new assessment |
| `auditmanager get-settings` | Check Audit Manager settings |

## Gotchas: AWS Audit Manager

- Audit Manager requires AWS Config to be enabled for automated evidence collection. Without Config, many controls cannot collect evidence automatically.
- Evidence collection is NOT real-time. It follows a schedule based on the control type. Manual evidence must be uploaded separately.
- Frameworks are templates — they define which controls to evaluate. Standard frameworks (CIS, PCI DSS, SOC 2) cannot be modified. Create custom frameworks for modifications.
- Delegation assigns control sets to team members for review. Delegates need IAM permissions to access Audit Manager and the delegated assessment.
- Assessment reports are generated as PDF/CSV and stored in the configured S3 bucket. The S3 bucket must exist and have proper permissions.
- Audit Manager is regional. Assessments in one region don't include resources from other regions.

## Anti-hallucination rules

1. Always cite specific assessment IDs, control statuses, or API responses as evidence.
2. AWS Config must be enabled for automated evidence. Never assume evidence collection works without Config.
3. Standard frameworks cannot be modified. Never suggest editing built-in frameworks.
4. Evidence collection is scheduled, not real-time. Never claim instant evidence.
5. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.

## 14 runbooks

| Category | IDs | Covers |
|----------|-----|--------|
| A — Assessment | A1-A2 | Creation, configuration |
| B — Frameworks | B1-B2 | Standard frameworks, custom frameworks |
| C — Controls | C1-C2 | Control evaluation, control status |
| D — Evidence | D1-D3 | Automated collection, manual evidence, evidence quality |
| E — Delegation | E1-E2 | Delegation setup, delegate access |
| F — Reports | F1-F2 | Report generation, report access |
| Z — Catch-All | Z1 | General troubleshooting |