AWS.AuditManager reference

Assessment

Source: src/AWS/AuditManager/Assessment.ts

An AWS Audit Manager assessment — an active evidence-collection engagement created from a framework, continuously gathering evidence for the controls in scope.

Note

Audit Manager must be registered in the account (RegisterAccount) before assessments can be created.

Assessment: Creating Assessments

import * as AWS from "alchemy/AWS";

const reports = yield* AWS.S3.Bucket("AuditReports", {});

const owner = yield* AWS.IAM.Role("AuditOwner", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "auditmanager.amazonaws.com" },
      Action: ["sts:AssumeRole"],
    }],
  },
});

const assessment = yield* AWS.AuditManager.Assessment("Quarterly", {
  frameworkId: framework.frameworkId,
  assessmentReportsDestination: {
    destination: reports.bucketName.apply((name) => `s3://${name}`),
  },
  roles: [{ roleType: "PROCESS_OWNER", roleArn: owner.roleArn }],
});

AssociateAssessmentReportEvidenceFolder

Source: src/AWS/AuditManager/AssociateAssessmentReportEvidenceFolder.ts

Runtime binding for auditmanager:AssociateAssessmentReportEvidenceFolder.

Adds an evidence folder to the (in-progress) assessment report of the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.AssociateAssessmentReportEvidenceFolderHttp).

AssociateAssessmentReportEvidenceFolder: Assessment Reports

const associateAssessmentReportEvidenceFolder = yield* AWS.AuditManager.AssociateAssessmentReportEvidenceFolder(assessment);
const result = yield* associateAssessmentReportEvidenceFolder({ evidenceFolderId });

BatchAssociateAssessmentReportEvidence

Source: src/AWS/AuditManager/BatchAssociateAssessmentReportEvidence.ts

Runtime binding for auditmanager:BatchAssociateAssessmentReportEvidence.

Adds a batch of evidence items to the (in-progress) assessment report of the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.BatchAssociateAssessmentReportEvidenceHttp).

BatchAssociateAssessmentReportEvidence: Assessment Reports

const batchAssociateAssessmentReportEvidence = yield* AWS.AuditManager.BatchAssociateAssessmentReportEvidence(assessment);
const result = yield* batchAssociateAssessmentReportEvidence({ evidenceFolderId, evidenceIds });

BatchCreateDelegationByAssessment

Source: src/AWS/AuditManager/BatchCreateDelegationByAssessment.ts

Runtime binding for auditmanager:BatchCreateDelegationByAssessment.

Creates a batch of delegations — handing control sets of the bound assessment to reviewers. Provide the implementation with Effect.provide(AWS.AuditManager.BatchCreateDelegationByAssessmentHttp).

BatchCreateDelegationByAssessment: Delegations

const batchCreateDelegationByAssessment = yield* AWS.AuditManager.BatchCreateDelegationByAssessment(assessment);
const result = yield* batchCreateDelegationByAssessment({
  createDelegationRequests: [{
    roleArn: reviewerRoleArn,
    roleType: "RESOURCE_OWNER",
    controlSetId,
  }],
});

BatchDeleteDelegationByAssessment

Source: src/AWS/AuditManager/BatchDeleteDelegationByAssessment.ts

Runtime binding for auditmanager:BatchDeleteDelegationByAssessment.

Deletes a batch of delegations from the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.BatchDeleteDelegationByAssessmentHttp).

BatchDeleteDelegationByAssessment: Delegations

const batchDeleteDelegationByAssessment = yield* AWS.AuditManager.BatchDeleteDelegationByAssessment(assessment);
const result = yield* batchDeleteDelegationByAssessment({ delegationIds });

BatchDisassociateAssessmentReportEvidence

Source: src/AWS/AuditManager/BatchDisassociateAssessmentReportEvidence.ts

Runtime binding for auditmanager:BatchDisassociateAssessmentReportEvidence.

Removes a batch of evidence items from the (in-progress) assessment report of the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.BatchDisassociateAssessmentReportEvidenceHttp).

BatchDisassociateAssessmentReportEvidence: Assessment Reports

const batchDisassociateAssessmentReportEvidence = yield* AWS.AuditManager.BatchDisassociateAssessmentReportEvidence(assessment);
const result = yield* batchDisassociateAssessmentReportEvidence({ evidenceFolderId, evidenceIds });

BatchImportEvidenceToAssessmentControl

Source: src/AWS/AuditManager/BatchImportEvidenceToAssessmentControl.ts

Runtime binding for auditmanager:BatchImportEvidenceToAssessmentControl.

Adds one or more pieces of manual evidence to a control in the bound assessment — free-form text, an S3 object, or a file uploaded via GetEvidenceFileUploadUrl. Provide the implementation with Effect.provide(AWS.AuditManager.BatchImportEvidenceToAssessmentControlHttp).

BatchImportEvidenceToAssessmentControl: Manual Evidence

const batchImportEvidenceToAssessmentControl = yield* AWS.AuditManager.BatchImportEvidenceToAssessmentControl(assessment);
const result = yield* batchImportEvidenceToAssessmentControl({
  controlSetId,
  controlId,
  manualEvidence: [{ textResponse: "Reviewed 2026-Q3: no findings" }],
});

Control

Source: src/AWS/AuditManager/Control.ts

A custom control in AWS Audit Manager — a compliance requirement paired with the data sources (CloudTrail, Config, Security Hub, API calls, or manual evidence) Audit Manager collects evidence from to demonstrate it.

Note

Audit Manager must be registered in the account (RegisterAccount) before controls can be created.

Control: Creating Controls

Manual-Evidence Control

import * as AWS from "alchemy/AWS";

const control = yield* AWS.AuditManager.Control("AccessReview", {
  description: "Quarterly review of privileged access",
  controlMappingSources: [{
    sourceName: "access-review-records",
    sourceSetUpOption: "Procedural_Controls_Mapping",
    sourceType: "MANUAL",
  }],
});

CloudTrail-Backed Control

const control = yield* AWS.AuditManager.Control("RootLoginMonitor", {
  description: "Detects console logins by the root user",
  controlMappingSources: [{
    sourceName: "root-console-logins",
    sourceSetUpOption: "System_Controls_Mapping",
    sourceType: "AWS_Cloudtrail",
    sourceKeyword: {
      keywordInputType: "SELECT_FROM_LIST",
      keywordValue: "ConsoleLogin",
    },
    sourceFrequency: "DAILY",
  }],
});

CreateAssessmentReport

Source: src/AWS/AuditManager/CreateAssessmentReport.ts

Runtime binding for auditmanager:CreateAssessmentReport.

Creates an assessment report — a finalized document generated from the bound assessment’s evidence — in the assessment’s S3 destination. Provide the implementation with Effect.provide(AWS.AuditManager.CreateAssessmentReportHttp).

CreateAssessmentReport: Assessment Reports

const createAssessmentReport = yield* AWS.AuditManager.CreateAssessmentReport(assessment);
const result = yield* createAssessmentReport({ name: "quarterly-report" });

DeleteAssessmentReport

Source: src/AWS/AuditManager/DeleteAssessmentReport.ts

Runtime binding for auditmanager:DeleteAssessmentReport.

Deletes an assessment report from the bound assessment and its S3 destination. Provide the implementation with Effect.provide(AWS.AuditManager.DeleteAssessmentReportHttp).

DeleteAssessmentReport: Assessment Reports

const deleteAssessmentReport = yield* AWS.AuditManager.DeleteAssessmentReport(assessment);
const result = yield* deleteAssessmentReport({ assessmentReportId });

DisassociateAssessmentReportEvidenceFolder

Source: src/AWS/AuditManager/DisassociateAssessmentReportEvidenceFolder.ts

Runtime binding for auditmanager:DisassociateAssessmentReportEvidenceFolder.

Removes an evidence folder from the (in-progress) assessment report of the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.DisassociateAssessmentReportEvidenceFolderHttp).

DisassociateAssessmentReportEvidenceFolder: Assessment Reports

const disassociateAssessmentReportEvidenceFolder = yield* AWS.AuditManager.DisassociateAssessmentReportEvidenceFolder(assessment);
const result = yield* disassociateAssessmentReportEvidenceFolder({ evidenceFolderId });

Framework

Source: src/AWS/AuditManager/Framework.ts

A custom assessment framework in AWS Audit Manager — a named collection of control sets that assessments are created from.

Note

Audit Manager must be registered in the account (RegisterAccount) before frameworks can be created.

Framework: Creating Frameworks

import * as AWS from "alchemy/AWS";

const control = yield* AWS.AuditManager.Control("AccessReview", {
  controlMappingSources: [{
    sourceName: "access-review-records",
    sourceSetUpOption: "Procedural_Controls_Mapping",
    sourceType: "MANUAL",
  }],
});

const framework = yield* AWS.AuditManager.Framework("Compliance", {
  description: "Internal compliance framework",
  controlSets: [{
    name: "Access Management",
    controls: [{ id: control.controlId }],
  }],
});

GetAccountStatus

Source: src/AWS/AuditManager/GetAccountStatus.ts

Runtime binding for auditmanager:GetAccountStatus.

Gets the registration status of the account in Audit Manager (ACTIVE, INACTIVE, or PENDING_ACTIVATION). Provide the implementation with Effect.provide(AWS.AuditManager.GetAccountStatusHttp).

GetAccountStatus: Account Status

const getAccountStatus = yield* AWS.AuditManager.GetAccountStatus();
const result = yield* getAccountStatus();

GetAssessmentReportUrl

Source: src/AWS/AuditManager/GetAssessmentReportUrl.ts

Runtime binding for auditmanager:GetAssessmentReportUrl.

Gets the presigned URL for downloading a generated assessment report. Provide the implementation with Effect.provide(AWS.AuditManager.GetAssessmentReportUrlHttp).

GetAssessmentReportUrl: Assessment Reports

const getAssessmentReportUrl = yield* AWS.AuditManager.GetAssessmentReportUrl(assessment);
const result = yield* getAssessmentReportUrl({ assessmentReportId });

GetChangeLogs

Source: src/AWS/AuditManager/GetChangeLogs.ts

Runtime binding for auditmanager:GetChangeLogs.

Lists the changelog — who did what, when — for the bound assessment, optionally narrowed to a control set or control. Provide the implementation with Effect.provide(AWS.AuditManager.GetChangeLogsHttp).

GetChangeLogs: Audit Trail

const getChangeLogs = yield* AWS.AuditManager.GetChangeLogs(assessment);
const result = yield* getChangeLogs({ maxResults: 20 });

GetDelegations

Source: src/AWS/AuditManager/GetDelegations.ts

Runtime binding for auditmanager:GetDelegations.

Lists the delegations assigned to the calling account. Provide the implementation with Effect.provide(AWS.AuditManager.GetDelegationsHttp).

GetDelegations: Delegations

const getDelegations = yield* AWS.AuditManager.GetDelegations();
const result = yield* getDelegations({ maxResults: 20 });

GetEvidence

Source: src/AWS/AuditManager/GetEvidence.ts

Runtime binding for auditmanager:GetEvidence.

Gets a single evidence item from the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.GetEvidenceHttp).

GetEvidence: Reading Evidence

const getEvidence = yield* AWS.AuditManager.GetEvidence(assessment);
const result = yield* getEvidence({ controlSetId, evidenceFolderId, evidenceId });

GetEvidenceByEvidenceFolder

Source: src/AWS/AuditManager/GetEvidenceByEvidenceFolder.ts

Runtime binding for auditmanager:GetEvidenceByEvidenceFolder.

Lists the evidence collected in an evidence folder of the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.GetEvidenceByEvidenceFolderHttp).

GetEvidenceByEvidenceFolder: Reading Evidence

const getEvidenceByEvidenceFolder = yield* AWS.AuditManager.GetEvidenceByEvidenceFolder(assessment);
const result = yield* getEvidenceByEvidenceFolder({ controlSetId, evidenceFolderId });

GetEvidenceFileUploadUrl

Source: src/AWS/AuditManager/GetEvidenceFileUploadUrl.ts

Runtime binding for auditmanager:GetEvidenceFileUploadUrl.

Creates a presigned Amazon S3 URL that can be used to upload a manual-evidence file — pair with BatchImportEvidenceToAssessmentControl to attach the uploaded file to a control. Provide the implementation with Effect.provide(AWS.AuditManager.GetEvidenceFileUploadUrlHttp).

GetEvidenceFileUploadUrl: Manual Evidence

const getEvidenceFileUploadUrl = yield* AWS.AuditManager.GetEvidenceFileUploadUrl();
const result = yield* getEvidenceFileUploadUrl({ fileName: "access-review.pdf" });

GetEvidenceFolder

Source: src/AWS/AuditManager/GetEvidenceFolder.ts

Runtime binding for auditmanager:GetEvidenceFolder.

Gets an evidence folder from the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.GetEvidenceFolderHttp).

GetEvidenceFolder: Reading Evidence

const getEvidenceFolder = yield* AWS.AuditManager.GetEvidenceFolder(assessment);
const result = yield* getEvidenceFolder({ controlSetId, evidenceFolderId });

GetEvidenceFoldersByAssessment

Source: src/AWS/AuditManager/GetEvidenceFoldersByAssessment.ts

Runtime binding for auditmanager:GetEvidenceFoldersByAssessment.

Lists the evidence folders in the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.GetEvidenceFoldersByAssessmentHttp).

GetEvidenceFoldersByAssessment: Reading Evidence

const getEvidenceFoldersByAssessment = yield* AWS.AuditManager.GetEvidenceFoldersByAssessment(assessment);
const result = yield* getEvidenceFoldersByAssessment({ maxResults: 20 });

GetEvidenceFoldersByAssessmentControl

Source: src/AWS/AuditManager/GetEvidenceFoldersByAssessmentControl.ts

Runtime binding for auditmanager:GetEvidenceFoldersByAssessmentControl.

Lists the evidence folders associated with a specific control in the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.GetEvidenceFoldersByAssessmentControlHttp).

GetEvidenceFoldersByAssessmentControl: Reading Evidence

const getEvidenceFoldersByAssessmentControl = yield* AWS.AuditManager.GetEvidenceFoldersByAssessmentControl(assessment);
const result = yield* getEvidenceFoldersByAssessmentControl({ controlSetId, controlId });

GetInsights

Source: src/AWS/AuditManager/GetInsights.ts

Runtime binding for auditmanager:GetInsights.

Gets the latest analytics data for all active assessments — compliance-check counts by status across the account. Provide the implementation with Effect.provide(AWS.AuditManager.GetInsightsHttp).

GetInsights: Insights

const getInsights = yield* AWS.AuditManager.GetInsights();
const result = yield* getInsights();

GetInsightsByAssessment

Source: src/AWS/AuditManager/GetInsightsByAssessment.ts

Runtime binding for auditmanager:GetInsightsByAssessment.

Gets the latest analytics data for the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.GetInsightsByAssessmentHttp).

GetInsightsByAssessment: Insights

const getInsightsByAssessment = yield* AWS.AuditManager.GetInsightsByAssessment(assessment);
const result = yield* getInsightsByAssessment();

GetServicesInScope

Source: src/AWS/AuditManager/GetServicesInScope.ts

Runtime binding for auditmanager:GetServicesInScope.

Lists the AWS services that Audit Manager can include in the scope of an assessment. Provide the implementation with Effect.provide(AWS.AuditManager.GetServicesInScopeHttp).

GetServicesInScope: Account Status

const getServicesInScope = yield* AWS.AuditManager.GetServicesInScope();
const result = yield* getServicesInScope();

ListAssessmentControlInsightsByControlDomain

Source: src/AWS/AuditManager/ListAssessmentControlInsightsByControlDomain.ts

Runtime binding for auditmanager:ListAssessmentControlInsightsByControlDomain.

Lists the latest control insights for a control domain within the bound (active) assessment. Provide the implementation with Effect.provide(AWS.AuditManager.ListAssessmentControlInsightsByControlDomainHttp).

ListAssessmentControlInsightsByControlDomain: Insights

const listAssessmentControlInsightsByControlDomain = yield* AWS.AuditManager.ListAssessmentControlInsightsByControlDomain(assessment);
const result = yield* listAssessmentControlInsightsByControlDomain({ controlDomainId });

ListAssessmentReports

Source: src/AWS/AuditManager/ListAssessmentReports.ts

Runtime binding for auditmanager:ListAssessmentReports.

Lists the assessment reports created in the account. Provide the implementation with Effect.provide(AWS.AuditManager.ListAssessmentReportsHttp).

ListAssessmentReports: Assessment Reports

const listAssessmentReports = yield* AWS.AuditManager.ListAssessmentReports();
const result = yield* listAssessmentReports({ maxResults: 20 });

ListControlDomainInsights

Source: src/AWS/AuditManager/ListControlDomainInsights.ts

Runtime binding for auditmanager:ListControlDomainInsights.

Lists the latest analytics data for control domains across all active assessments. Provide the implementation with Effect.provide(AWS.AuditManager.ListControlDomainInsightsHttp).

ListControlDomainInsights: Insights

const listControlDomainInsights = yield* AWS.AuditManager.ListControlDomainInsights();
const result = yield* listControlDomainInsights({ maxResults: 20 });

ListControlDomainInsightsByAssessment

Source: src/AWS/AuditManager/ListControlDomainInsightsByAssessment.ts

Runtime binding for auditmanager:ListControlDomainInsightsByAssessment.

Lists the latest analytics data for control domains within the bound (active) assessment. Provide the implementation with Effect.provide(AWS.AuditManager.ListControlDomainInsightsByAssessmentHttp).

ListControlDomainInsightsByAssessment: Insights

const listControlDomainInsightsByAssessment = yield* AWS.AuditManager.ListControlDomainInsightsByAssessment(assessment);
const result = yield* listControlDomainInsightsByAssessment({ maxResults: 20 });

ListControlInsightsByControlDomain

Source: src/AWS/AuditManager/ListControlInsightsByControlDomain.ts

Runtime binding for auditmanager:ListControlInsightsByControlDomain.

Lists the latest control analytics for a specific control domain across active assessments. Provide the implementation with Effect.provide(AWS.AuditManager.ListControlInsightsByControlDomainHttp).

ListControlInsightsByControlDomain: Insights

const listControlInsightsByControlDomain = yield* AWS.AuditManager.ListControlInsightsByControlDomain();
const result = yield* listControlInsightsByControlDomain({ controlDomainId });

ListKeywordsForDataSource

Source: src/AWS/AuditManager/ListKeywordsForDataSource.ts

Runtime binding for auditmanager:ListKeywordsForDataSource.

Lists the keywords that are pre-mapped to the specified control data source (CloudTrail event names, Config rules, Security Hub controls, …). Provide the implementation with Effect.provide(AWS.AuditManager.ListKeywordsForDataSourceHttp).

ListKeywordsForDataSource: Control Data Sources

const listKeywordsForDataSource = yield* AWS.AuditManager.ListKeywordsForDataSource();
const result = yield* listKeywordsForDataSource({ source: "AWS_Cloudtrail" });

ListNotifications

Source: src/AWS/AuditManager/ListNotifications.ts

Runtime binding for auditmanager:ListNotifications.

Lists the notifications for the account — delegation requests, control-set review handoffs, and completed report generation. Provide the implementation with Effect.provide(AWS.AuditManager.ListNotificationsHttp).

ListNotifications: Notifications

const listNotifications = yield* AWS.AuditManager.ListNotifications();
const result = yield* listNotifications({ maxResults: 20 });

UpdateAssessmentControl

Source: src/AWS/AuditManager/UpdateAssessmentControl.ts

Runtime binding for auditmanager:UpdateAssessmentControl.

Updates a control within the bound assessment — sets its review status and/or adds a comment. Provide the implementation with Effect.provide(AWS.AuditManager.UpdateAssessmentControlHttp).

UpdateAssessmentControl: Assessment Workflow

const updateAssessmentControl = yield* AWS.AuditManager.UpdateAssessmentControl(assessment);
const result = yield* updateAssessmentControl({ controlSetId, controlId, controlStatus: "REVIEWED" });

UpdateAssessmentControlSetStatus

Source: src/AWS/AuditManager/UpdateAssessmentControlSetStatus.ts

Runtime binding for auditmanager:UpdateAssessmentControlSetStatus.

Updates the review status of a control set in the bound assessment. Provide the implementation with Effect.provide(AWS.AuditManager.UpdateAssessmentControlSetStatusHttp).

UpdateAssessmentControlSetStatus: Assessment Workflow

const updateAssessmentControlSetStatus = yield* AWS.AuditManager.UpdateAssessmentControlSetStatus(assessment);
const result = yield* updateAssessmentControlSetStatus({ controlSetId, status: "REVIEWED", comment: "Signed off" });

UpdateAssessmentStatus

Source: src/AWS/AuditManager/UpdateAssessmentStatus.ts

Runtime binding for auditmanager:UpdateAssessmentStatus.

Sets the bound assessment’s status — mark it INACTIVE to complete it and stop evidence collection. Provide the implementation with Effect.provide(AWS.AuditManager.UpdateAssessmentStatusHttp).

UpdateAssessmentStatus: Assessment Workflow

const updateAssessmentStatus = yield* AWS.AuditManager.UpdateAssessmentStatus(assessment);
const result = yield* updateAssessmentStatus({ status: "INACTIVE" });

ValidateAssessmentReportIntegrity

Source: src/AWS/AuditManager/ValidateAssessmentReportIntegrity.ts

Runtime binding for auditmanager:ValidateAssessmentReportIntegrity.

Validates the integrity (checksums) of a generated assessment report in Amazon S3. Provide the implementation with Effect.provide(AWS.AuditManager.ValidateAssessmentReportIntegrityHttp).

ValidateAssessmentReportIntegrity: Assessment Reports

const validateAssessmentReportIntegrity = yield* AWS.AuditManager.ValidateAssessmentReportIntegrity();
const result = yield* validateAssessmentReportIntegrity({ s3RelativePath: "s3://audit-reports/report.zip" });