# Auditmanager Diagnostics

> >

- **Type:** Skill
- **Install:** `agentstack add skill-aws-samples-sample-ai-agent-skills-auditmanager-troubleshooting`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [aws-samples](https://agentstack.voostack.com/s/aws-samples)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT-0
- **Upstream author:** [aws-samples](https://github.com/aws-samples)
- **Source:** https://github.com/aws-samples/sample-ai-agent-skills/tree/main/auditmanager-troubleshooting

## Install

```sh
agentstack add skill-aws-samples-sample-ai-agent-skills-auditmanager-troubleshooting
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AWS Audit Manager Diagnostics

## When to use

Any AWS Audit Manager investigation — assessment creation, framework selection, control evaluation, evidence collection, delegation management, report generation, or custom framework configuration.

## Investigation workflow

### Step 1 — Collect and triage

```
aws auditmanager get-settings --attribute ALL
aws auditmanager list-assessments --query 'assessmentMetadata[*].{Id:id,Name:name,Status:status}'
version: "1.0.0"
last_updated: "2025-04-12"
aws auditmanager list-assessment-frameworks --frameworkType Standard --query 'frameworkMetadataList[*].{Id:id,Name:name,Type:type}'
version: "1.0.0"
last_updated: "2025-04-12"
```

### Step 2 — Domain deep dive

```
aws auditmanager get-assessment --assessment-id 
aws auditmanager get-evidence-folder --assessment-id  --control-set-id  --evidence-folder-id 
aws auditmanager list-assessment-control-insights-by-control-domain --control-domain-id 
```

### Step 3 — Detailed investigation

```
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=auditmanager.amazonaws.com --max-results 20
aws auditmanager get-assessment-report-url --assessment-id  --assessment-report-id 
aws config describe-config-rules --query 'ConfigRules[*].{Name:ConfigRuleName,State:ConfigRuleState}'
version: "1.0.0"
last_updated: "2025-04-12"
```

Read `references/guardrails.md` before concluding on any Audit Manager issue.

## Tool quick reference

| Tool / API | When to use |
|------------|-------------|
| `auditmanager list-assessments` | List assessments |
| `auditmanager get-assessment` | Get assessment details |
| `auditmanager list-assessment-frameworks` | List frameworks |
| `auditmanager get-evidence-folder` | Get evidence details |
| `auditmanager create-assessment` | Create new assessment |
| `auditmanager get-settings` | Check Audit Manager settings |

## Gotchas: AWS Audit Manager

- Audit Manager requires AWS Config to be enabled for automated evidence collection. Without Config, many controls cannot collect evidence automatically.
- Evidence collection is NOT real-time. It follows a schedule based on the control type. Manual evidence must be uploaded separately.
- Frameworks are templates — they define which controls to evaluate. Standard frameworks (CIS, PCI DSS, SOC 2) cannot be modified. Create custom frameworks for modifications.
- Delegation assigns control sets to team members for review. Delegates need IAM permissions to access Audit Manager and the delegated assessment.
- Assessment reports are generated as PDF/CSV and stored in the configured S3 bucket. The S3 bucket must exist and have proper permissions.
- Audit Manager is regional. Assessments in one region don't include resources from other regions.

## Anti-hallucination rules

1. Always cite specific assessment IDs, control statuses, or API responses as evidence.
2. AWS Config must be enabled for automated evidence. Never assume evidence collection works without Config.
3. Standard frameworks cannot be modified. Never suggest editing built-in frameworks.
4. Evidence collection is scheduled, not real-time. Never claim instant evidence.
5. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.

## 14 runbooks

| Category | IDs | Covers |
|----------|-----|--------|
| A — Assessment | A1-A2 | Creation, configuration |
| B — Frameworks | B1-B2 | Standard frameworks, custom frameworks |
| C — Controls | C1-C2 | Control evaluation, control status |
| D — Evidence | D1-D3 | Automated collection, manual evidence, evidence quality |
| E — Delegation | E1-E2 | Delegation setup, delegate access |
| F — Reports | F1-F2 | Report generation, report access |
| Z — Catch-All | Z1 | General troubleshooting |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [aws-samples](https://github.com/aws-samples)
- **Source:** [aws-samples/sample-ai-agent-skills](https://github.com/aws-samples/sample-ai-agent-skills)
- **License:** MIT-0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-aws-samples-sample-ai-agent-skills-auditmanager-troubleshooting
- Seller: https://agentstack.voostack.com/s/aws-samples
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.