Proving PCI DSS Compliance with AWS Artifact

The adjacent decision: which AWS artifact is actually audit evidence. The company needs to prove PCI DSS compliance for infrastructure AWS operates. Under the shared responsibility model, AWS is responsible for the security of the cloud and publishes independent third-party assurance reports that cover its data centers, infrastructure, networking, and the specific PCI DSS requirements it operates. Those reports are not sitting in your account — they are published through AWS Artifact, the self-service portal for on-demand compliance reports. That makes option A the correct action: download the applicable PCI DSS report (plus the associated Attestation of Compliance) from Artifact and supply it to the auditors.

Why the logging options fail. Options B and C misunderstand what an external PCI assessor asks for. CloudTrail log files and CloudWatch logs are your evidence of activity inside your own account — useful for your own control testing, but they contain no attestation that AWS's underlying infrastructure satisfies PCI DSS, and they do not map to the inherited AWS-owned requirements. Also note that neither is normally "complete" in a portable sense: CloudTrail can be filtered, archived, and delivered to S3, and CloudWatch log groups retain data only for a configured period, so a raw dump may be partial and does nothing to prove AWS-side compliance. Uploading logs is a classic distractor because it sounds compliance-oriented while answering a different question.

Why giving access is wrong. Option D hands auditors administrative access to a production AWS account. This is a violation of least privilege and of PCI DSS requirement 7 itself, exposes cardholder data and credentials, and gives the assessor no documentation of AWS's shared-responsibility obligations. Auditors require evidence, not standing privileges.

What would flip the answer. If the question instead asked how the company demonstrates compliance of its own configured controls inside the account — security group rules, IAM policies, encryption settings — then evidence would come from AWS Config conformance packs, Security Hub PCI DSS standards, or your CloudTrail configuration, not from Artifact. And if a Marketplace or third-party SaaS component were in scope, Artifact also exposes third-party supplier reports, so the same portal still applies.

Operational consequence. Choosing B, C, or D stalls the audit: the assessor rejects the evidence and the engagement slips, whereas Artifact gives the auditor the authoritative, AWS-signed documentation immediately.