What is AWS Artifact? Compliance reports and agreements
AWS Artifact is a self-service portal for AWS compliance documents. Artifact Reports lets you download AWS reports such as ISO certifications and PCI and SOC reports, and Artifact Agreements lets you review, accept, track and terminate agreements with AWS such as the Business Associate Addendum (BAA).
Artifact Reports
Artifact Reports gives on-demand downloads of AWS security and compliance documents, such as AWS ISO certifications, Payment Card Industry (PCI) reports and SOC reports.
You give these to your auditors or regulators as evidence of AWS's security controls. They show what AWS does. Your own workload still needs its own controls and its own audit.
Reports from software vendors in AWS Marketplace are also available, but only to customers granted access through AWS Marketplace Vendor Insights for that vendor. Whether you can share an AWS report with your own customers is set by the terms on the first page of that report.
Artifact Agreements
Artifact Agreements lets you review, accept and track agreements with AWS, such as the BAA, for one account or for an organization. You can also terminate an agreement you accepted earlier.
Before entering any agreement you must download and agree to the AWS Artifact nondisclosure agreement (NDA). Each agreement is confidential and cannot be shared outside your company.
Who can use it
All AWS accounts have access to AWS Artifact. The root user and IAM users with admin permissions can download reports after agreeing to their terms.
IAM users without admin permissions must be granted access to AWS Artifact through IAM permissions. No particular support plan or AWS Organizations setup is required.
Where the exam catches people
Believing AWS Artifact makes your workload compliant: it supplies AWS's reports as evidence of AWS's controls; your own controls remain your job.
Believing an accepted agreement can be shared with partners: Artifact agreements are confidential and cannot be shared outside your company.
Believing a BAA can be accepted straight away: you must first download and agree to the AWS Artifact NDA.
Believing a non-admin IAM user can download reports by default: that user needs AWS Artifact access granted through IAM permissions.
Believing AWS Artifact records API calls for auditors: that is AWS CloudTrail; Artifact holds compliance reports and agreements.