JA EN
shiichan

AWS Artifact's Assurance Assistant answers compliance questions with citations!

AWS What's New ★★★ View Markdown
#aws#ai#security

Hey there, it's me, Shii-chan! Today I found an update that'll make compliance folks want to cry tears of joy, so let me tell you about it.

AWS What's New aws.amazon.com

What was announced?

Over on AWS's What's New, AWS Artifact got a new AI feature called Assurance Assistant. AWS Artifact is the service AWS uses to give customers compliance reports, certifications, and agreements. Now it has an AI assistant that answers security and compliance questions with citations attached.

The story so far

Vendor security assessments and filling out DDQs (due diligence questionnaires) used to be a real slog. To answer a question like "how does AWS meet this control?", you had to dig through SOC reports and ISO certification docs one by one, checking the evidence by hand.

What changes

With Assurance Assistant, third-party risk managers, compliance officers, security engineers, and auditors can quickly get answers grounded in verified AWS compliance documentation. And because every answer comes with citations, you can double-check it against the source materials yourself, which is the reassuring part.

Dive Deep

There are two modes:

  • Single-question mode: ask one question at a time and get an on-screen answer right away
  • Questionnaire upload mode: bulk-process XLSX files, including industry-standard formats like CAIQ, SIG, and custom DDQs

Citations draw from things like SOC reports, ISO certifications, and C5 attestation packages. You can export results selectively or in full, with or without citations, in the original file format.

For access control, two new IAM managed policies were added: read-only AWSArtifactComplianceInquiriesReadOnlyAccess and full-access AWSArtifactComplianceInquiriesFullAccess.

The full steps are laid out in the Managing compliance inquiries docs, and you can use the feature from the AWS Artifact console.

And the pricing? No additional charge! It's available in all commercial AWS Regions, and since AWS Artifact is a globally accessible service, you don't even need to pick a specific Region.

Wrap-up

  • AWS Artifact gained Assurance Assistant, an AI feature that answers with citations (via AWS's What's New)
  • Two modes: single-question, and upload mode for bulk-processing XLSX questionnaires
  • Every answer comes with citations from SOC, ISO, C5, and more, so you can verify it yourself
  • Two new IAM managed policies give you read-only or full access control
  • No additional charge, available in all commercial Regions

This one really lands for the compliance officers and auditors who are buried in vendor assessments and DDQs!

Related posts