AWS Artifact: On-Demand Compliance Reports and Agreements

AWS Artifact is a free, self-service portal in the AWS Management Console where you download AWS’s third-party audit reports (such as SOC and ISO reports) and manage select legal agreements with AWS (such as the Business Associate Addendum for HIPAA). When an auditor, regulator, or customer asks you to prove that AWS itself meets a compliance standard, Artifact is where that evidence lives. On the CLF-C02 exam, any question about obtaining AWS compliance documentation on demand has Artifact as the answer.

Why AWS Artifact exists

When your organization undergoes an audit, the auditor examines your whole stack, including the infrastructure you rent from AWS. But AWS will not let your auditor walk into a data center or interview its engineers; with millions of customers, that would never scale. Instead, AWS hires independent third-party auditors to assess its own controls against major standards, and publishes the resulting attestations and certifications through Artifact.

This is the paperwork side of the AWS shared responsibility model. AWS is responsible for security of the cloud, and Artifact is how AWS documents that it holds up its end. Your responsibility for security in the cloud (your configurations, your data handling, your access controls) is yours to evidence separately; no report in Artifact certifies your workload. The division of labor is worth internalizing fully, and the AWS shared responsibility model article walks through it in depth.

Practical properties the exam cares about:

• Self-service and on-demand. You sign in to the console, open Artifact, and download documents. No support ticket, no waiting on an AWS representative.
• No cost. Artifact carries no charge on any support plan, including Basic.
• Access is controlled by IAM. AWS Identity and Access Management (IAM) permissions govern which principals in your account can retrieve reports or accept agreements, so a compliance team can be granted access without broad console rights.

Reports vs agreements

Artifact has two halves, and the exam sometimes checks whether you know both exist.

	Artifact Reports	Artifact Agreements
What it holds	Third-party audit reports and certifications about AWS	Legal agreements between your organization and AWS
Examples	SOC 1, SOC 2, SOC 3; ISO 27001; PCI DSS attestation	Business Associate Addendum (BAA), Nondisclosure Agreement (NDA)
What you do with it	Download and hand to auditors, regulators, or customers	Review, accept, and track status
Direction of proof	AWS proving its controls to you	You and AWS formalizing terms with each other
Scope options	Per document	Per account, or across an entire AWS Organization

Artifact Reports is the document library. The names you should recognize at Cloud Practitioner depth: SOC reports (System and Organization Controls, the workhorse attestations auditors request most), ISO 27001 (the international information security management standard), and PCI DSS (Payment Card Industry Data Security Standard) documentation for payment workloads. Dozens of other program documents exist for specific industries and countries, but recognizing those three families is enough for the exam.

Artifact Agreements handles contracts that certain regulated workloads require. The flagship example is the Business Associate Addendum (BAA), which organizations subject to HIPAA (the Health Insurance Portability and Accountability Act) must have in place with AWS before running workloads involving protected health information. Agreements can be accepted for a single account or, through AWS Organizations, for every account in the organization at once.

What Artifact is not

Cloud Practitioner distractor lists love services that sound compliance-adjacent, so the boundaries matter as much as the definition.

• Artifact does not audit you. It contains evidence about AWS. If a scenario asks about continuously collecting evidence of your own usage for your own audits, that is AWS Audit Manager.
• Artifact does not monitor resource configurations. Tracking whether your resources comply with rules you define (for example, “every EBS volume must be encrypted”) is AWS Config territory. The monitoring trio is compared in CloudWatch vs CloudTrail vs Config.
• Artifact does not record API activity. A history of who did what in your account is AWS CloudTrail.
• Artifact does not scan for vulnerabilities or threats. Amazon Inspector and Amazon GuardDuty own that space.
• Artifact does not make you compliant. Downloading AWS’s SOC 2 report does not mean your application meets SOC 2. It means the infrastructure layer beneath you does. Inheriting AWS controls shortens your audit; it never completes it.

A related resource worth one sentence: AWS Compliance Center and the public AWS compliance pages describe which services are in scope for which programs, while Artifact is where the actual signed reports are downloaded. If the question involves downloading a report, it is Artifact.

How the CLF-C02 exam tests this

• A scenario says an auditor or customer has requested a copy of AWS’s SOC 2 or ISO 27001 report and asks where to get it. The answer is AWS Artifact. Distractors usually include AWS Config, CloudTrail, and Trusted Advisor.
• A scenario involves a healthcare company needing to sign a BAA with AWS before handling patient data. The answer is Artifact Agreements. The BAA-to-Artifact mapping is tested surprisingly often.
• A scenario asks which service provides compliance documents on demand at no charge, stressing the self-service angle. Artifact again; the phrase “on-demand access to AWS compliance reports” is nearly a definition lifted from the service page.
• A scenario contrasts proving AWS’s compliance with checking your own resources against rules. Split it cleanly: AWS’s evidence comes from Artifact, your resource-level compliance checks come from AWS Config, and your own audit evidence gathering comes from Audit Manager.

Quick reference

• AWS Artifact is a free, self-service console portal for AWS compliance documents and agreements.
• Two halves: Reports (download AWS audit documents) and Agreements (accept contracts like the HIPAA BAA or an NDA).
• Recognize the report families: SOC 1/2/3, ISO 27001, PCI DSS.
• Agreements can be accepted per account or across an AWS Organization.
• IAM permissions control who in your account can access Artifact.
• Artifact evidences AWS’s side of the shared responsibility model, never your workload’s compliance.
• Your own compliance tooling lives elsewhere: AWS Config for resource rules, Audit Manager for evidence collection, CloudTrail for activity history.