Compliance and audit evidence on AWS
Turning what your pipeline and your account already produce into evidence an auditor accepts.
CPS 234 and its 2025 sibling CPS 230 don't grade your AWS account directly — they grade whether you can prove your controls held, on demand. That's the thread through this group: CPS 234 control mapping ties each requirement to an AWS service and Config rule, CPS 230 covers what changed since it took effect on 1 July 2025 for landing-zone and provider-dependency work, and the evidence an auditor actually asks for is the export, not the screenshot.
Two lessons push past the checklist: which CPS 234 controls are theatre versus real risk reduction, and the 72-hour incident notification runbook, which treats the deadline as an engineering problem rather than a policy paragraph.
AWS ships its own starting point — the CPG 234 conformance pack maps roughly 130 Config rules to APRA's guidance — and Essential Eight at Maturity Level 3 translates ACSC's on-prem-era strategies to AWS-native controls. The last two close the loop from finding to narrative: turning Security Hub output into APRA-paragraph text with Bedrock, and Assure, the open-source CLI that automates that translation into a board-ready report.
Lessons
- CPS 234 on AWS: Mapping Every Control to a Real AWS ServiceA practitioner's mapping of every APRA CPS 234 requirement to the AWS service, Config rule, and audit evidence that satisfies it — and the one place most AWS environments fail.
- CPS 230 Is Live: What Changed for Your AWS EnvironmentCPS 230 took effect 1 July 2025. It's an operational-resilience standard, not a security one — but it reaches straight into your AWS setup through service providers, critical operations, and CPS 234.
- The CPS 234 72-Hour Notification Runbook on AWSCPS 234 gives you 72 hours to notify APRA of a material incident. That's not a documentation task — it's an automated path from a GuardDuty finding to a decision. Here's how to build and test it.
- CPS 234 Controls That Are Theatre (and What to Do Instead)Some of what teams do in the name of CPS 234 is security theatre — effort that produces a checkbox and no risk reduction. Here are the worst offenders and where to spend that effort instead.
- The Evidence an APRA Auditor Actually Asks For on AWSControls that work aren't the same as controls you can prove worked. Here's the exact AWS export that answers each thing an APRA auditor asks — and why a console screenshot fails every time.
- Deploy the AWS APRA CPG 234 Conformance Pack — and Read the FailuresAWS gives you a ready-made APRA CPG 234 conformance pack mapping 130 controls to 48 objectives. Deploying it takes ten minutes. Understanding the 40 failures it returns is the actual job.
- Essential Eight Maturity Level 3 on AWSThe ASD Essential Eight was written for on-prem Windows fleets. Here's what each of the eight mitigation strategies actually means when your workloads run on AWS — at Maturity Level 3.
- Turning AWS Security Findings into APRA-Paragraph Narrative with BedrockSecurity tools produce findings. Boards and regulators want narrative evidence mapped to the standard. That translation is the real bottleneck in an APRA review — so I built a tool that does it with Amazon Bedrock, on Australian-resident inference.
- Assure: An Open-Source CLI for APRA Compliance Reports on AWSScanners produce findings. Boards and APRA want narrative evidence mapped to the standard. Assure is a CLI that closes that gap — point it at an AWS account and get a board-ready CPS 234 / CPS 230 report, in your own environment. pip install aiopsone-assure.
Common questions
- Does CPS 234 apply to my AWS account directly?
- It applies to the regulated entity. Your AWS configuration is how you demonstrate the control, not the obligation itself.