Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

Cryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evident

JSON — GET /api/aws-evidenceMD — /collect/integrity-verification-and-immutability.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementcliweeklyAWS CloudTrailAWS ConfigAmazon S3AWS BackupAmazon ECR

Fetch

$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-log-file-validation-enabled --compliance-types NON_COMPLIANT
$ aws cloudtrail validate-logs --trail-arn <TRAIL_ARN> --start-time <START_TIME> --verbose
$ aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-default-lock-enabled --compliance-types NON_COMPLIANT
$ aws backup describe-backup-vault --backup-vault-name evidence-vault --query '{Locked:Locked,LockDate:LockDate,MinRetentionDays:MinRetentionDays,MaxRetentionDays:MaxRetentionDays}'
$ aws configservice get-compliance-details-by-config-rule --config-rule-name ecr-private-tag-immutability-enabled --compliance-types NON_COMPLIANT

Expected output

Three EvaluationResults arrays, a validation run and a vault description. Empty NON_COMPLIANT sets mean every trail signs digest files, every evaluated bucket has Object Lock on by default and every private ECR repository refuses to move a tag. validate-logs prints the window it actually found and two ratios — for example '3/3 digest files valid' and '15/15 log files valid'; any shortfall names the file. describe-backup-vault returns Locked true with a LockDate, the UTC instant the compliance-mode grace time ends. Managed rule identifiers: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED, S3_BUCKET_DEFAULT_LOCK_ENABLED, ECR_PRIVATE_TAG_IMMUTABILITY_ENABLED

Map — what it proves

  • recipe2
Key Security Indicators
KSI-SVC-VRIKSI-SVC-VCMKSI-SCR-MIT
NIST 800-53 controls
recipe · 1 recipeSI-07recipe · 1 recipeSI-07 (01)
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:SI 10/35 →

GovCloud

All five calls work in AWS GovCloud (US): none of the three managed rules names a GovCloud Region in its exclusion list, and AWS Backup Vault Lock is documented among the features offered for all supported resources with no Region carve-out — unlike restore testing and logically air-gapped vaults, which are blank for both GovCloud rows in the feature-availability table. Trail, bucket, vault and repository ARNs use partition arn:aws-us-gov, and because CloudTrail uses a different key pair per Region, validate the logs in the Region that produced them

Notes & assertions

The strong claim here is narrow and worth stating precisely. validate-logs is real cryptography — SHA-256 hashing with SHA-256/RSA signing, an hourly digest file that references the last hour's log files and carries the signature of the previous digest — so a clean run positively asserts that the delivered log files were not modified or deleted, and can even assert that no log files were delivered in a window you believed was empty. What it will not do: validate files you moved, since they must stay where CloudTrail put them; and it cannot report tampering across a gap — disable validation for an hour and no digest exists for that hour, so the chain simply breaks. Enabling the feature is not the same as checking it, which is why both the Config rule and the CLI run belong here: the rule proves digests are being produced, the run is the only thing that verifies them. Object Lock and Vault Lock are prevention, not detection — they make a deletion fail rather than proving none happened, and Object Lock only counts if the mode and period match your policy: the rule's optional mode parameter is what pins GOVERNANCE versus COMPLIANCE, and unset it passes either. Vault Lock in governance mode can be removed by anyone holding the IAM permission, so read Locked together with LockDate — before that date even a compliance-mode lock is still removable. The honest gap is the host: SI-7 asks for integrity verification of software, firmware and information, and nothing above watches a filesystem. ECR tag immutability stops a tag being repointed at a different image but says nothing about drift inside a running instance; file integrity monitoring is third-party or self-built on AWS, and SI-7(1)'s ‘defined frequency’ is a policy number you compare against, not an API result. Finally, a NON_COMPLIANT-only query returns an empty array on success and says nothing about resources Config never evaluated — join it against recorder coverage before reading emptiness as compliance.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Service Configuration run (10)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under SVC, in the order the plan works them. The mark says how much of the evidence the command produces on its own.