The problem

Audits are usually a scramble: screenshots, spreadsheets and late nights. For FedRAMP and other regulated workloads that scramble repeats every year. The fix is to make compliance continuous: express each control as an automated check, collect the evidence on a schedule, and query it whenever an auditor asks.

What you’ll build

• A 24-rule AWS Config conformance pack where every rule name encodes its NIST control (AC-2, IA-5, AU-9, SC-7, SC-28, SI-4, CP-9, CM-8…)
• The Security Hub NIST 800-53 standard for hundreds of additional automated checks
• A daily evidence collector that writes JSON evidence to a KMS-encrypted, versioned, Object Lock S3 bucket
• A Glue table with partition projection and two saved Athena queries: posture by control, and open findings for the auditor
• Real-time drift alerts whenever a NIST-mapped rule turns non-compliant

Architecture

AWS Config conformance pack (24 rules, each named nist-<control>-...)
        │                                  │
        │ NON_COMPLIANT                    │ daily 06:00 UTC
        ▼                                  ▼
EventBridge ──▶ SNS drift alert     Lambda evidence collector ──▶ S3 (KMS, Object Lock, versioned)
                                                                      │
Security Hub NIST 800-53 standard                         Glue table (partition projection)
                                                                      │
                                                         Athena named queries ──▶ QuickSight

AWS services used

How it works

1. CodifyEach control family maps to managed Config rules, named nist-<family>-<n>-… so evidence can be grouped by control automatically.
2. CollectAt 06:00 UTC a Lambda walks the conformance pack and records every resource evaluation as a JSON line.
3. ProtectEvidence lands in an Object Lock bucket (governance mode) so nobody can quietly edit history.
4. ReportAthena answers “what percentage of SC-28 is compliant today?” in seconds, and QuickSight turns it into a live dashboard.

Key design decisions

• Encoding the control ID in the rule name keeps the mapping in one place: the template.
• Partition projection means no crawlers or MSCK repairs. New days are queryable instantly.
• Object Lock is deliberate: evidence you can delete isn’t evidence.

Deploy it

aws cloudformation deploy \
  --stack-name nist-compliance \
  --template-file template.yaml \
  --capabilities CAPABILITY_IAM \
  --parameter-overrides NotificationEmail=you@example.com EnableSecurityHub=true

Full prerequisites, parameters and clean-up steps are in the project README on the code page.

See it work

Invoke the collector, open Athena, and run posture-by-control. You get a ranked table of NIST controls by percent compliant, ready to export for an assessor.

Skills this demonstrates