RetailHub’s compliance team needs to achieve PCI DSS across 50 AWS accounts. They want to continuously collect evidence (for example, IAM configuration, CloudTrail activity, ELB logging) mapped to PCI controls and generate auditor-ready reports with minimal manual effort. Which service should they use?

AWS Audit Manager is the correct choice because it automates the collection of evidence from various AWS services (like IAM, CloudTrail, and ELB logs) and maps it to controls within predefined frameworks, such as PCI DSS. Using a delegated administrator allows for centralized evidence collection across multiple AWS accounts, significantly reducing manual effort and generating auditor-ready reports. AWS Artifact provides access to AWS compliance reports and certifications, but it doesn't collect evidence from your specific AWS environment. AWS Security Hub aggregates security findings and performs automated security checks against standards like PCI DSS, but it doesn't generate auditor-ready reports for compliance evidence collection. AWS Config conformance packs assess compliance against desired configurations and can export data, but Audit Manager is specifically designed for continuous evidence collection and report generation for compliance frameworks.