| name | auditmanager-diagnostics |
| version | 1.0.0 |
| last_updated | 2025-04-12 |
| description | Use this skill to investigate and troubleshoot AWS Audit Manager problems by analyzing assessment creation, frameworks, controls, evidence collection, delegation, reports, custom frameworks, and following structured runbooks. Activate when: assessment creation failures, framework issues, control evaluation errors, evidence collection problems, delegation failures, report generation errors, custom framework issues, or the user says something is wrong with Audit Manager.
|
| compatibility | Requires AWS CLI or SDK access with auditmanager, config, cloudtrail, securityhub, iam, and s3 permissions.
|
AWS Audit Manager Diagnostics
When to use
Any AWS Audit Manager investigation — assessment creation, framework selection, control evaluation, evidence collection, delegation management, report generation, or custom framework configuration.
Investigation workflow
Step 1 — Collect and triage
aws auditmanager get-settings --attribute ALL
aws auditmanager list-assessments --query 'assessmentMetadata[*].{Id:id,Name:name,Status:status}'
version: "1.0.0"
last_updated: "2025-04-12"
aws auditmanager list-assessment-frameworks --frameworkType Standard --query 'frameworkMetadataList[*].{Id:id,Name:name,Type:type}'
version: "1.0.0"
last_updated: "2025-04-12"
Step 2 — Domain deep dive
aws auditmanager get-assessment --assessment-id <id>
aws auditmanager get-evidence-folder --assessment-id <id> --control-set-id <set-id> --evidence-folder-id <folder-id>
aws auditmanager list-assessment-control-insights-by-control-domain --control-domain-id <domain-id>
Step 3 — Detailed investigation
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=auditmanager.amazonaws.com --max-results 20
aws auditmanager get-assessment-report-url --assessment-id <id> --assessment-report-id <report-id>
aws config describe-config-rules --query 'ConfigRules[*].{Name:ConfigRuleName,State:ConfigRuleState}'
version: "1.0.0"
last_updated: "2025-04-12"
Read references/guardrails.md before concluding on any Audit Manager issue.
Tool quick reference
| Tool / API | When to use |
|---|
auditmanager list-assessments | List assessments |
auditmanager get-assessment | Get assessment details |
auditmanager list-assessment-frameworks | List frameworks |
auditmanager get-evidence-folder | Get evidence details |
auditmanager create-assessment | Create new assessment |
auditmanager get-settings | Check Audit Manager settings |
Gotchas: AWS Audit Manager
- Audit Manager requires AWS Config to be enabled for automated evidence collection. Without Config, many controls cannot collect evidence automatically.
- Evidence collection is NOT real-time. It follows a schedule based on the control type. Manual evidence must be uploaded separately.
- Frameworks are templates — they define which controls to evaluate. Standard frameworks (CIS, PCI DSS, SOC 2) cannot be modified. Create custom frameworks for modifications.
- Delegation assigns control sets to team members for review. Delegates need IAM permissions to access Audit Manager and the delegated assessment.
- Assessment reports are generated as PDF/CSV and stored in the configured S3 bucket. The S3 bucket must exist and have proper permissions.
- Audit Manager is regional. Assessments in one region don't include resources from other regions.
Anti-hallucination rules
- Always cite specific assessment IDs, control statuses, or API responses as evidence.
- AWS Config must be enabled for automated evidence. Never assume evidence collection works without Config.
- Standard frameworks cannot be modified. Never suggest editing built-in frameworks.
- Evidence collection is scheduled, not real-time. Never claim instant evidence.
- Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.
14 runbooks
| Category | IDs | Covers |
|---|
| A — Assessment | A1-A2 | Creation, configuration |
| B — Frameworks | B1-B2 | Standard frameworks, custom frameworks |
| C — Controls | C1-C2 | Control evaluation, control status |
| D — Evidence | D1-D3 | Automated collection, manual evidence, evidence quality |
| E — Delegation | E1-E2 | Delegation setup, delegate access |
| F — Reports | F1-F2 | Report generation, report access |
| Z — Catch-All | Z1 | General troubleshooting |
