Verifiable Controls Evidence Store

Deploy a mechanism to store cloud security control findings and results


This solution provides a mechanism to centrally store evidence issued by cloud security controls governing AWS workloads, as enduring evidence records that are safeguarded against tampering. Stored controls evidence can subsequently be utilized in compliance evaluation mechanisms, deployment decisions, or audit processes.

An evidence record is a system- or human-generated digital record of a historical fact, related to one or more target entities, and issued by an evidence provider.

Note: AWS does not provide compliance or regulatory advice. You should independently evaluate the suitability of Verifiable Controls Evidence Store for your use case, including for the purposes of meeting any audit, compliance, and regulatory requirements that you may have.

What's new

Added a new (optional) S3 evidence collector to monitor a set of S3 buckets and create evidences when new objects are put into any of these buckets.

To find out more, refer to the Revisions page.


Facilitate compliance and auditing

Store and retrieve evidence in near real-time. Query evidence records to determine if software releases meet compliance requirements to help with deployment decisions, or access evidence retrospectively to assist in ad hoc audits or investigations.

Balance flexibility with traceability

Onboard AWS, third-party providers, as well as custom, system, or human evidence providers, with different data formats. Custom schemas allow support for various evidence types. Correlate historical evidence related to target entities defined for your environment, such as application releases or deployment environments.

User interface and APIs

Interact via a web application and/or APIs to manage evidence and onboard evidence providers. All actions and tasks are supported by both interfaces.

Data integrity

Verify the data integrity of evidence records that have been stored. The solution uses Amazon Quantum Ledger Database (QLDB) to ensure immutability and allow cryptographic verification of evidence.

Technical details

You can automatically deploy this architecture using the implementation guide.

Use cases for this AWS Solution
  • Headline

Was this page helpful?