AWS Artifact – Your On-Demand Audit Binder For The Cloud
A deep, practical walkthrough of AWS Artifact — how it hands auditors and compliance teams the proof they need without a single email to AWS, and where organizations still trip over agreement management.
Picture a company undergoing a major external audit. In the old world, someone on the compliance team would spend days emailing vendors, waiting for responses, and assembling a binder of certifications, attestations, and signed agreements just to prove that the infrastructure their product runs on meets the required standards. AWS Artifact exists to make that entire binder available instantly, self-service, any hour of the day, without a single support ticket. It is the part of AWS that most engineers never touch, but that compliance, security, and legal teams rely on constantly. This tutorial walks through what AWS Artifact actually contains, how its two very different halves work, and the patterns that separate an organization with clean, current compliance documentation from one scrambling the week before an audit.
1Core Concepts That Actually Matter
AWS Artifact is not a single tool — it is two distinct services bundled under one name, and mixing them up causes real confusion.
AWS Artifact is a no-cost, self-service portal that provides on-demand access to AWS’s compliance documentation and lets an account or organization manage certain legal agreements with AWS. It does not generate new compliance evidence about your own workloads; instead, it is the distribution point for AWS’s own compliance reports and the formal agreements you sometimes need to sign in order to use certain AWS services.
Imagine a landlord who keeps a locked filing cabinet containing the building’s fire safety certification, insurance documents, and lease agreements. Instead of calling the landlord’s office and waiting for a fax, every tenant gets a key to a self-service copy machine standing right next to that cabinet. AWS Artifact is that copy machine for AWS’s own compliance paperwork.
AWS Artifact Reports
A library of third-party audit reports and certifications describing AWS’s own security, compliance, and operational controls, downloadable directly by customers.
AWS Artifact Agreements
A place to review, accept, and manage formal agreements between your organization and AWS, some of which are prerequisites for using specific services.
NDA-Gated Reports
Certain highly sensitive audit reports require accepting a non-disclosure agreement before they become downloadable, reflecting the sensitivity of the information they contain.
Shared Responsibility Boundary
Artifact documents describe controls AWS itself is responsible for; they do not certify or audit anything about how a customer configures their own workloads on top of AWS.
Understanding that last point is essential at the intermediate level: a customer downloading an ISO certification from Artifact is retrieving proof of AWS’s own compliance posture for the infrastructure layer, not a statement that the customer’s own application is automatically compliant simply because it runs on AWS.
2Architecture & Components
Artifact’s architecture is deliberately simple, because its job is distribution and record-keeping, not data processing.
flowchart TD
A[AWS Account] --> B[AWS Artifact Console]
B --> C[Reports Library]
B --> D[Agreements Library]
C --> E[Third-Party Audit Reports]
C --> F[Certifications]
D --> G[Business Associate Addendum]
D --> H[Non-Disclosure Agreement]
D --> I[Other Service-Specific Agreements]
IAM-Controlled Access
Access to Artifact, and to specific categories of reports or agreements within it, is governed by IAM permissions, letting an organization decide which roles can view general reports versus which can accept legally binding agreements.
Per-Account And Organization Scope
Agreements can be accepted individually per AWS account, or centrally across an entire AWS Organization, which matters significantly for large enterprises operating many accounts.
Report Categories
Reports are organized by compliance framework and region of applicability, covering areas such as security management, industry-specific regulatory frameworks, and international standards, so customers can filter to exactly what a given audit requires.
Because Artifact is a console feature rather than a data-processing service, there is no infrastructure to provision or configure — the only real architectural decision is how permissions to it are structured across an organization.
3Internal Working: Where This Documentation Actually Comes From
Artifact’s reports are not generated on demand — they are the published output of a continuous external audit cycle.
Independent Audit Engagement
AWS engages independent third-party auditors on a recurring schedule to assess its infrastructure, processes, and controls against specific compliance frameworks.
Audit Execution
Auditors examine evidence of AWS’s operational controls over a defined period, producing a formal report describing what was tested and the outcome.
Report Publication To Artifact
Once finalized, the resulting report or certification is published into the Artifact Reports library, replacing the prior version for that framework and period.
Customer Retrieval
Customers with appropriate permissions, and who have accepted any required non-disclosure agreement, can download the current report directly, with no request or waiting period.
This works much like a restaurant’s health inspection certificate posted near the entrance — an independent inspector visits periodically, produces a rating, and the restaurant displays the current result. Artifact is simply the digital, always-current version of that posted certificate, but for AWS’s own infrastructure.
Downloading a report from Artifact does not itself constitute an audit of your application. It provides evidence about AWS’s controls that your own auditors can incorporate into a broader assessment that also covers how you configured and operate your workloads.
4Data Flow & Lifecycle
Agreements in Artifact follow a distinct lifecycle from reports, because they are legally binding rather than purely informational.
sequenceDiagram
participant Admin as Account Administrator
participant Artifact as AWS Artifact
participant Org as AWS Organizations
Admin->>Artifact: Review agreement (e.g. BAA)
Artifact-->>Admin: Present current agreement terms
Admin->>Artifact: Accept agreement
Artifact->>Org: Record acceptance for account or organization scope
Note over Artifact: AWS later updates agreement terms
Artifact-->>Admin: Notify that a new version requires re-acceptance
A Business Associate Addendum, commonly needed by organizations handling health information under United States regulations, is one of the most frequently accepted agreements in Artifact, since certain AWS services can only be used for workloads involving protected health information after this addendum has been accepted.
When AWS updates the terms of an agreement, previously accepted versions do not automatically transfer — a new acceptance is generally required, and Artifact surfaces this clearly rather than silently assuming continued consent. This lifecycle detail matters for compliance teams that need to track exactly when a given version of an agreement was accepted, since audits often ask for that specific evidence.
Report versions also have a lifecycle: a new audit period produces a new report that supersedes the prior one, so downloading the latest report periodically, rather than relying on a copy saved months earlier, keeps compliance evidence current.
5Advantages, Disadvantages & Trade-offs
Artifact removes friction from compliance evidence gathering, but it cannot remove the underlying complexity of compliance itself.
Advantages
- Instant, self-service access to compliance reports without submitting a request or waiting on a response from AWS.
- Centralized management of agreements across an entire AWS Organization rather than account by account.
- Reports are always the current, audited version, removing the risk of relying on outdated documentation.
- No cost to access — the service itself carries no fee.
- Clear separation between evidence about AWS’s own controls and agreements requiring formal acceptance.
Disadvantages / Trade-offs
- Artifact says nothing about a customer’s own workload configuration or compliance posture — that remains entirely the customer’s responsibility.
- Updated agreements require a fresh, deliberate acceptance, adding a governance task that is easy to overlook.
- Some highly sensitive reports require an NDA acceptance first, adding a step before access is granted.
- Organizations with poor IAM hygiene can end up with agreement acceptance authority spread across too many people.
6Performance & Scalability
Artifact does not scale in the traditional sense — its “scalability” question is really about organizational reach and governance structure.
Because there is no compute, storage, or throughput to provision, the meaningful scaling consideration for Artifact is how a large enterprise, potentially operating hundreds of AWS accounts under one Organization, manages agreement acceptance and report access consistently across all of them. Accepting an agreement at the Organization level, where supported, avoids the operational burden of repeating the same acceptance individually across every member account.
Centralizing agreement management through AWS Organizations, rather than delegating acceptance authority broadly across many individual account owners, keeps a large, multi-account environment’s compliance posture consistent and auditable.
7High Availability & Reliability
Reliability for Artifact means one specific thing: the documentation an organization depends on for an audit is available exactly when needed.
Because Artifact runs on the same highly available AWS console infrastructure used across the platform, access to reports and agreements does not depend on any single point of failure that a customer needs to plan around. The more practical reliability concern is process-based rather than infrastructure-based: an organization needs to ensure someone is actually responsible for periodically checking for updated reports and agreement versions, since Artifact will not proactively chase down a compliance team that never logs in.
Audit Timing Alignment
Because reports refresh on the audit cycle of the underlying compliance framework, teams preparing for their own external audits benefit from checking Artifact early in that process rather than assuming a report downloaded a year earlier is still current.
8Security
Because Artifact handles sensitive audit material and legally binding agreements, controlling who can act on it matters as much as controlling who can read it.
IAM Permissions For Artifact
Separate permissions can distinguish between viewing general reports and accepting binding agreements, preventing a broad set of engineers from inadvertently entering into legal commitments on behalf of the organization.
NDA-Protected Reports
The most sensitive audit reports require accepting a non-disclosure agreement before download, reflecting the confidential nature of detailed security assessment findings.
Organization-Level Acceptance
Restricting who can accept agreements at the AWS Organization level ensures a single, deliberate decision-maker rather than inconsistent, ad-hoc acceptances scattered across accounts.
Recorded Acceptance History
Artifact retains a record of which agreements were accepted, by whom, and when, giving an organization the audit trail its own compliance reviews often require.
Leaving agreement-acceptance permissions open to a broad group of engineers, rather than a small, deliberately chosen set of accountable individuals, can result in an organization entering binding agreements without proper legal or compliance review.
9Monitoring, Logging & Metrics
Visibility into Artifact activity is less about performance metrics and entirely about audit-grade traceability.
| Signal | What It Tells You |
|---|---|
| AWS CloudTrail entries for Artifact actions | A record of who viewed, downloaded, or accepted agreements and reports, useful for internal governance review. |
| Agreement acceptance status | Whether the current version of a required agreement, such as a Business Associate Addendum, has been accepted for a given account or Organization. |
| Report publication dates | When the currently available report for a given framework was published, helping teams judge whether it still falls within an auditor’s required time window. |
Reviewing CloudTrail records for Artifact-related actions on a periodic cadence, rather than only when an audit is imminent, helps a compliance team catch an unaccepted updated agreement long before it becomes a last-minute scramble.
10Deployment & Cloud Integration
Artifact’s real integration value shows up in how it slots into an organization’s broader governance and audit tooling.
AWS Organizations
Lets designated administrators manage certain agreements across an entire Organization, rather than repeating the same acceptance in every member account individually.
AWS Audit Manager
Teams building a broader continuous audit program often reference Artifact reports as supporting evidence alongside evidence Audit Manager collects about the customer’s own AWS resource configuration.
IAM Policy Design
Permissions to Artifact are defined the same way as any other AWS service permission, letting compliance-specific roles be created deliberately rather than relying on broad administrative access.
Auditor & Customer Distribution
Downloaded reports are commonly shared with an organization’s own external auditors or enterprise customers as part of a broader due-diligence or vendor-risk package.
11Design Patterns & Anti-patterns
A small number of governance patterns separate organizations with clean compliance operations from those with recurring, avoidable gaps.
Pattern: Centralized Compliance Ownership
A specific, small team is designated as the owner of Artifact-related activity — reviewing new reports, tracking agreement versions, and distributing evidence to auditors — rather than leaving it to whichever engineer happens to need a document at a given moment.
Pattern: Scheduled Periodic Review
A recurring calendar reminder to check for updated reports and unaccepted agreement versions keeps compliance posture current continuously, rather than only right before an audit deadline.
Problem
Assuming an agreement accepted once, such as a Business Associate Addendum, remains valid indefinitely without ever checking for updated terms.
Why It’s Harmful
When AWS updates an agreement’s terms, the previous acceptance does not automatically extend to the new version, and continuing to operate certain workloads without a current acceptance can create a genuine compliance gap.
Correct Approach
Treat agreement status as something to check periodically, not as a one-time setup task, and assign clear ownership for re-accepting updated versions promptly.
Problem
Treating an AWS compliance report downloaded from Artifact as proof that a customer’s own application is automatically compliant with the same framework.
Why It’s Harmful
Compliance frameworks generally require evidence covering the entire system, not just the infrastructure layer. Presenting only AWS’s report to an auditor without addressing the customer’s own controls leaves a significant evidentiary gap.
Correct Approach
Use Artifact reports as one input into a broader compliance evidence package that also documents how the customer’s own workload, configuration, and processes meet the required framework.
12Best Practices & Common Mistakes
Most Artifact-related friction is avoidable with a handful of consistent operational habits.
Assign Clear Ownership
Designate a specific team or role responsible for monitoring Artifact activity rather than leaving it to whoever happens to need a document.
Centralize Agreement Acceptance
Use AWS Organizations to accept agreements once at the appropriate scope rather than repeating the process inconsistently across many accounts.
Scope IAM Permissions Deliberately
Separate the ability to view reports from the ability to accept binding agreements, and limit the latter to accountable individuals.
Pair Reports With Your Own Evidence
Always present Artifact reports alongside documentation of your own workload’s controls, never as a standalone substitute for it.
Waiting until an auditor formally requests documentation before checking Artifact for the first time in months often reveals an unaccepted updated agreement or an outdated saved report at the worst possible moment.
13Real-World & Industry Examples
Different industries lean on different parts of Artifact, depending on which regulatory frameworks apply to them.
Healthcare & The Business Associate Addendum
Healthcare technology companies handling protected health information rely on Artifact to review and accept the Business Associate Addendum, a prerequisite for using certain AWS services with that category of data.
Payments & PCI Compliance
Companies processing payment card data reference AWS’s PCI-related compliance reports from Artifact as part of the infrastructure-layer evidence required during their own PCI assessments.
Enterprise Vendor Risk Reviews
Large enterprises evaluating a smaller software vendor that runs on AWS frequently ask that vendor to produce Artifact-sourced reports as part of a broader vendor security questionnaire.
Government & Regulated Sectors
Organizations operating in heavily regulated public-sector or international contexts use region-specific and framework-specific reports available through Artifact to satisfy jurisdiction-specific compliance obligations.
14Frequently Asked Questions
No. Artifact provides evidence about AWS’s own infrastructure and controls. Whether your application meets a given compliance framework depends on how you configure and operate your own workload as well.
No, accessing AWS Artifact and downloading reports or reviewing agreements does not carry an additional service fee.
Reports are downloadable audit evidence describing AWS’s own compliance posture. Agreements are formal, sometimes legally required, terms that an account or organization must review and accept, such as a Business Associate Addendum.
Certain audit reports contain detailed, sensitive information about security controls and assessment findings, so AWS requires an NDA acceptance before granting access to that level of detail.
Where supported, agreements can be accepted at the AWS Organization level, applying centrally rather than requiring separate acceptance in every individual member account.
15Summary and Key Takeaways
AWS Artifact solves a narrow but genuinely important problem: giving organizations instant, self-service access to the compliance evidence and legal agreements they need from AWS, without the delays that used to come from requesting these documents manually. Its value is greatest for compliance, security, and legal teams who need current, authoritative proof of AWS’s own controls, and for organizations that must formally accept agreements like the Business Associate Addendum before certain services can be used for sensitive data. Its limits are equally important to internalize: Artifact never speaks to a customer’s own workload compliance, and its usefulness depends entirely on someone actually reviewing it regularly rather than treating a single download as permanent proof.
Key Takeaways
- Artifact has two distinct halves — Reports for downloadable evidence about AWS’s controls, and Agreements for legally binding terms you must accept.
- It proves AWS’s compliance, not yours — your own workload’s controls still need to be documented separately for a complete audit picture.
- Agreements need re-acceptance when updated — a prior acceptance does not automatically cover a newer version of the same agreement.
- Organization-level management reduces overhead — centralizing agreement acceptance avoids repeating the same task across many accounts.
- Sensitive reports require an NDA first — reflecting the confidentiality of detailed audit findings.
- Ownership and review cadence matter more than the tool itself — Artifact only helps if someone actually checks it regularly.
- Reports and agreements both have a lifecycle — treat the current version as temporary, not permanent, evidence.