# Cryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evident

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/integrity-verification-and-immutability

Recipe id: `integrity-verification-and-immutability` · cadence weekly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-SVC-VRI`
- KSI `KSI-SVC-VCM`
- KSI `KSI-SCR-MIT`
- control `si-7`
- control `si-7.1`

## Collection

Kind: `cli`

```sh
# cloud-trail-log-file-validation-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-log-file-validation-enabled --compliance-types NON_COMPLIANT
# validate-logs
aws cloudtrail validate-logs --trail-arn <TRAIL_ARN> --start-time <START_TIME> --verbose
# s3-bucket-default-lock-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-default-lock-enabled --compliance-types NON_COMPLIANT
# describe-backup-vault
aws backup describe-backup-vault --backup-vault-name evidence-vault --query '{Locked:Locked,LockDate:LockDate,MinRetentionDays:MinRetentionDays,MaxRetentionDays:MaxRetentionDays}'
# ecr-private-tag-immutability-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name ecr-private-tag-immutability-enabled --compliance-types NON_COMPLIANT
```

## Expected output

Three EvaluationResults arrays, a validation run and a vault description. Empty NON_COMPLIANT sets mean every trail signs digest files, every evaluated bucket has Object Lock on by default and every private ECR repository refuses to move a tag. validate-logs prints the window it actually found and two ratios — for example '3/3 digest files valid' and '15/15 log files valid'; any shortfall names the file. describe-backup-vault returns Locked true with a LockDate, the UTC instant the compliance-mode grace time ends. Managed rule identifiers: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED, S3_BUCKET_DEFAULT_LOCK_ENABLED, ECR_PRIVATE_TAG_IMMUTABILITY_ENABLED

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

All five calls work in AWS GovCloud (US): none of the three managed rules names a GovCloud Region in its exclusion list, and AWS Backup Vault Lock is documented among the features offered for all supported resources with no Region carve-out — unlike restore testing and logically air-gapped vaults, which are blank for both GovCloud rows in the feature-availability table. Trail, bucket, vault and repository ARNs use partition arn:aws-us-gov, and because CloudTrail uses a different key pair per Region, validate the logs in the Region that produced them

## Notes

The strong claim here is narrow and worth stating precisely. validate-logs is real cryptography — SHA-256 hashing with SHA-256/RSA signing, an hourly digest file that references the last hour's log files and carries the signature of the previous digest — so a clean run positively asserts that the delivered log files were not modified or deleted, and can even assert that no log files were delivered in a window you believed was empty. What it will not do: validate files you moved, since they must stay where CloudTrail put them; and it cannot report tampering across a gap — disable validation for an hour and no digest exists for that hour, so the chain simply breaks. Enabling the feature is not the same as checking it, which is why both the Config rule and the CLI run belong here: the rule proves digests are being produced, the run is the only thing that verifies them. Object Lock and Vault Lock are prevention, not detection — they make a deletion fail rather than proving none happened, and Object Lock only counts if the mode and period match your policy: the rule's optional mode parameter is what pins GOVERNANCE versus COMPLIANCE, and unset it passes either. Vault Lock in governance mode can be removed by anyone holding the IAM permission, so read Locked together with LockDate — before that date even a compliance-mode lock is still removable. The honest gap is the host: SI-7 asks for integrity verification of software, firmware and information, and nothing above watches a filesystem. ECR tag immutability stops a tag being repointed at a different image but says nothing about drift inside a running instance; file integrity monitoring is third-party or self-built on AWS, and SI-7(1)'s ‘defined frequency’ is a policy number you compare against, not an API result. Finally, a NON_COMPLIANT-only query returns an empty array on success and says nothing about resources Config never evaluated — join it against recorder coverage before reading emptiness as compliance.

## References

- {"title":"AWS Config managed rule: cloud-trail-log-file-validation-enabled (CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED)","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-log-file-validation-enabled.html"}
- {"title":"CloudTrail: validating log file integrity (SHA-256, SHA-256 with RSA, hourly digest files, per-Region key pairs)","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html"}
- {"title":"AWS CLI: cloudtrail validate-logs (syntax, output ratios, documented limitations)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/validate-logs.html"}
- {"title":"AWS Config managed rule: s3-bucket-default-lock-enabled (optional mode parameter GOVERNANCE|COMPLIANCE)","url":"https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-default-lock-enabled.html"}
- {"title":"AWS Backup Vault Lock (governance vs compliance mode, grace time, DescribeBackupVault Locked and LockDate)","url":"https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html"}
- {"title":"AWS Backup feature availability (Vault Lock offered for all supported resources; GovCloud rows for restore testing and air-gapped vaults)","url":"https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-feature-availability.html"}
- {"title":"AWS Config managed rule: ecr-private-tag-immutability-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/ecr-private-tag-immutability-enabled.html"}