AWS IAM evidence checklist for SOC 2 & HIPAA

AWS access evidence should answer four questions: who can sign in, who has privileged access, which long-lived credentials exist, and whether the evidence covers every in-scope account. One credential report is useful, but it is not the whole IAM story.

Account-level collection checklist

Capture these facts for each in-scope AWS account:

• account identity and collection timestamp;
• IAM users, groups, attached policies, and inline policies;
• MFA status, console-password status, and access-key age and last-used fields;
• the account password policy;
• roles and trust policies that can confer privileged access; and
• evidence of the review decision and remediation for exceptions.

AWS documents that its IAM credential report contains IAM-managed passwords, the first two access keys, MFA devices, and signing certificates. It does not include every credential type or more than two access keys, so treat it as one input rather than a complete inventory.

Interpret the evidence carefully

mfa_active=false deserves investigation for a human IAM user with console access. It does not, by itself, prove a control failure: workload identities should generally avoid console passwords, and federated users may authenticate through an identity provider instead of an IAM-user MFA device. Likewise, an old access key is a review signal, not automatic proof that the key is used or unnecessary.

AWS's security audit guidance recommends reviewing whether users, group memberships, policies, and credentials remain necessary, and recommends federation with temporary credentials for human users where possible.

Cover multi-account environments explicitly

Record the account ID with every artifact and reconcile collected accounts against your AWS Organizations or other authoritative inventory. A green result from one account does not say anything about an uncollected production account. Document exclusions and ownership rather than letting them disappear from the population.

Limitations of an IAM snapshot

AuditFetch collects supported IAM and account-security facts through scoped read-only permissions, timestamps the results, and can reuse compatible evidence mappings across SOC 2 and HIPAA workflows. Reuse does not mean that one artifact automatically satisfies two controls: framework scope, freshness, and reviewer sufficiency still need to be evaluated.