Before touching the console, let’s build a clear mental model of what compliance documentation is, and why a self-service portal for it matters.

What Is a Compliance Report?

When a company uses cloud infrastructure, its auditors and customers often need proof that the underlying infrastructure provider — AWS, in this case — follows recognized security and privacy standards. That proof usually takes the form of official audit reports, such as an SOC 2 report (a widely recognized security audit standard) or a PCI DSS Attestation of Compliance (required for handling credit card data). These documents are produced by independent third-party auditors who examine AWS’s data centers, processes, and controls, then publish findings that AWS customers can rely on instead of conducting their own physical audit of AWS’s facilities, which would be impossible in practice for any single customer to carry out.

What AWS Artifact Actually Is

AWS Artifact is a free, self-service portal that gives AWS customers on-demand access to AWS’s compliance reports and lets them review, accept, and manage certain legal agreements with AWS electronically. It has two main halves: Artifact Reports, a library of downloadable audit and compliance documents, and Artifact Agreements, a workflow for reviewing and accepting agreements such as a Business Associate Addendum (BAA) for healthcare workloads or a Nondisclosure Agreement (NDA) needed to view certain sensitive reports.

Why Not Just Ask an Account Manager?

Large enterprises often go through security reviews dozens of times a year — with new customers, new partners, new internal audits. Requesting each document manually through a human point of contact does not scale, introduces delay, and creates inconsistency in which version of a document gets shared. AWS Artifact removes the human bottleneck entirely: every customer, regardless of size, gets the exact same instant, self-service access to the current, correct version of every report they are entitled to see.

This self-service model also benefits AWS itself: instead of a support or sales team fielding a constant stream of “can you send me your compliance documents” requests, that entire category of question is answered by a well-organized library anyone can search on their own, freeing those teams to focus on questions that genuinely need a human’s judgment.

AWS Artifact is built from two distinct product areas that share the same portal, plus the identity and access layer that controls who sees what.

• Artifact Reports — a searchable, downloadable library of AWS’s compliance and audit documentation, including SOC 1/2/3 reports, PCI DSS reports, ISO certifications, and region- or service-specific attestations.
• Artifact Agreements — the workflow area where an authorized account representative reviews and digitally accepts legal agreements with AWS, such as a Business Associate Addendum (BAA) or Nondisclosure Agreement (NDA).
• AWS Organizations Integration — lets an agreement be accepted once at the organization level and automatically applied across every account inside that organization, instead of accepting it account by account.
• IAM Permissions — control which users within an AWS account are allowed to view reports or accept agreements on the company’s behalf.
• Report Package — the actual downloadable file, typically a PDF, sometimes bundled with supporting documents like a control mapping spreadheet.

graph LR
    U[Authorized User] --> I[IAM Permissions Check]
    I --> A[AWS Artifact Console]
    A --> R[Artifact Reports
SOC / PCI / ISO Library]
    A --> G[Artifact Agreements
BAA / NDA Workflow]
    R --> D[Downloaded PDF Report]
    G --> S[Digitally Signed Agreement]
    O[AWS Organizations] --> G
    S --> ALL[Applied Across
All Member Accounts]
        

It’s worth noting that Reports and Agreements, while presented in the same console, follow different underlying processes: browsing and downloading a report is a read-only action available to anyone with the right IAM permission, while accepting an agreement is a one-way, recorded action that typically cannot simply be undone the way a file download can. Understanding this distinction helps explain why AWS treats permission to do each quite differently.

What actually happens behind the scenes between an independent auditor examining AWS and you downloading a PDF?

Third-party auditors — accredited firms independent of AWS — regularly examine AWS’s data centers, operational processes, and security controls against a given standard, such as SOC 2 or ISO 27001. When an audit concludes, the resulting report is reviewed, packaged, and published into the Artifact Reports library, tagged with the specific AWS services, Regions, and time period it covers. Reports are refreshed on a recurring cycle (commonly every six or twelve months, depending on the standard), and Artifact always surfaces the current version, retiring outdated ones.

How Agreement Acceptance Works

When an authorized user opens the Agreements tab and accepts a document like a BAA, AWS Artifact records that acceptance electronically — capturing who accepted it, when, and on behalf of which account or organization. This creates a legally recognized, digitally signed record, replacing what used to require a physically signed and mailed or faxed document.

Access Control Behind the Scenes

Not every report is visible to every account by default. Some especially sensitive reports (for example, certain government or highly regulated reports) require the account to first accept an NDA before the download becomes available, and IAM policies determine which individual users within an account are permitted to perform that acceptance or download the resulting file.

How Report Categories Are Organized

Artifact organizes its reports library by compliance framework rather than by AWS service, which matters because most audits span many services at once. Filtering by “SOC 2” surfaces a single report covering the security controls across the broad set of AWS services included in that audit’s scope, rather than requiring you to hunt for a separate document per service. Some frameworks also publish region-specific or country-specific reports — for example, certifications relevant only to customers operating in a particular country’s regulatory environment — so the same search interface lets you narrow results by geography as well as by standard.

Version History and Superseded Reports

When a report is refreshed after a new audit cycle, the previous version does not simply disappear from history — Artifact typically retains prior report versions for a period so customers who need to reference an audit period from a past year (for their own historical compliance records) can still locate it, while the library’s default and most prominent listing always points to the current version.

Whether you’re pulling a report or accepting an agreement, the flow follows the same broad pattern.

This lifecycle looks identical whether the person using Artifact is a solo founder checking a single report for the first time, or a compliance analyst at a large enterprise pulling dozens of reports across multiple accounts every quarter — the same simple, predictable steps scale from the smallest to the largest use case without any special setup.

The Core Trade-off: Convenience vs. Completeness

AWS Artifact makes obtaining proof of AWS’s own compliance effortless, but it is only one piece of a much larger compliance puzzle. A company still has to demonstrate that it configured its own AWS resources correctly, encrypted the right data, and restricted access appropriately — Artifact proves the foundation is solid, not that everything built on top of it automatically is too.

There is also a subtler trade-off around scope versus specificity. A single SOC 2 report might cover dozens of AWS services at once, which is convenient for a broad review, but a customer with a very narrow question — “is this one specific service, in this one specific Region, covered by this one specific control?” — sometimes needs to read carefully through the report’s detailed control mapping rather than assuming the top-level certification automatically answers their exact question.

AWS Artifact is not a compute service, so “scalability” here means scaling compliance administration across many accounts and many people, not handling traffic spikes.

For a single-account startup, Artifact usage might mean one founder occasionally downloading a SOC 2 report to satisfy a potential customer’s security questionnaire. For a large enterprise running hundreds of AWS accounts across many business units, the same tool needs to support centralized governance: accepting agreements once at the organization level, delegating report access to specific compliance team members through IAM, and maintaining a consistent audit trail across the entire account structure.

Delegating Without Losing Control

A common scaling pattern is to grant a compliance or security team read-only IAM access to browse and download reports, while restricting the ability to accept legally binding agreements to a small, designated group of account owners or legal representatives — separating “can view evidence” from “can sign on the company’s behalf.”

Building Repeatable Compliance Workflows

Organizations that go through frequent customer security reviews often build a small internal playbook around Artifact: a short document listing exactly which report answers which common customer question, who on the team is authorized to download or accept what, and how often to re-check the library for updated versions. This turns what could be a scramble every time a security questionnaire arrives into a five-minute, repeatable task, which is really what “scaling” a compliance process across a growing organization looks like in practice.

AWS Artifact runs on the same globally distributed, multi-Availability-Zone infrastructure that backs the rest of the AWS Management Console, meaning the portal itself is built to be highly available without any configuration on your part. There is no “Artifact server” for you to worry about going down.

Keeping Evidence Current

Because compliance reports are refreshed on a recurring cycle, a “reliable” compliance program treats Artifact as the single source of truth to check each time evidence is needed for an audit, rather than archiving a downloaded copy indefinitely and assuming it will still be accurate a year later.

This also protects against a subtle risk: a customer’s own internal auditor might, months later, ask to see “the current version” of a report that was originally downloaded and shared long ago. If a company only kept the old PDF rather than a process for re-pulling the latest version, it can end up unintentionally presenting outdated evidence — a mistake that is easy to avoid simply by re-downloading from Artifact each time evidence is actually requested, rather than reusing a saved file indefinitely.

Because Artifact deals with sensitive audit information and legally binding agreements, access to it needs to be tightly controlled.

• IAM Policies — determine exactly which users can view the Reports library, download specific report categories, or accept Agreements on the account’s behalf.
• NDA-Gated Reports — certain reports require accepting a Nondisclosure Agreement before they can be downloaded, adding a legal safeguard around especially sensitive content.
• AWS Organizations Delegation — restricts who can accept an organization-wide agreement, preventing an unauthorized member account from binding the entire organization.
• Encryption in Transit — all interactions with the Artifact console occur over TLS, matching the security standard of the rest of the AWS Management Console.
• CloudTrail Logging — actions taken in Artifact, including agreement acceptances, are recorded, supporting internal audit and accountability needs.

Separating Duties Between Teams

A mature security posture around Artifact usually splits responsibilities across three groups: a compliance or security team that regularly browses and downloads reports to support audits and customer questionnaires, a legal or account-owner group that reviews and accepts binding agreements, and a cloud platform team that manages the underlying IAM policies granting each group exactly the access it needs and nothing more. Keeping these responsibilities distinct prevents any single person from both deciding to accept a legal agreement and having no oversight over that decision.

Because Artifact’s core value is evidentiary — proving what was accepted and when — its most important “monitoring” signal is not a performance metric but an audit trail. AWS CloudTrail records API activity related to Artifact, including who viewed the console and who accepted an agreement, giving compliance teams a verifiable record they can hand to their own auditors.

Many compliance teams set a recurring calendar reminder — separate from any AWS-native alert — to re-check Artifact ahead of major audit cycles, since report refresh dates don’t always align neatly with a company’s own internal audit calendar.

It is also worth periodically reviewing exactly who currently holds Artifact-related IAM permissions, especially after organizational changes such as a team reorganization or an employee departure. Because agreement acceptance carries legal weight, stale permissions left over from a former employee’s account represent a governance gap that a routine, scheduled access review can catch well before it becomes a real problem.

A frequently overlooked best practice is mapping which specific report each customer or auditor actually needs before searching the library — SOC 2 Type II, PCI DSS, and ISO 27001 all answer slightly different questions, and pulling the wrong one wastes time on both sides of the conversation.

It also helps to designate a single internal owner for AWS Artifact — often someone on the security or compliance team — whose job includes knowing which agreements the company has already accepted, which reports are used most often in customer conversations, and when the next refresh cycle for a key report is expected. Without a clear owner, this knowledge tends to live in one person’s memory and gets lost when that person changes roles.